Account monitoring method and device, electronic equipment and storage medium

Abstract

The invention relates to the field of computers, in particular to an account monitoring method and device. The method comprises the following steps: in the process of monitoring an account set and under the condition that current monitoring data meets a monitoring condition, acquiring a full-life-cycle monitoring data set corresponding to the account set from an encrypted database; decrypting the monitoring data set by using the received secret key closest to the current time to obtain a decrypted monitoring data set; performing risk identification on the monitoring data subset corresponding to each account in the account set by adopting at least one monitoring sub-model in the monitoring model to obtain at least one risk score corresponding to each account; according to the at least one risk score, obtaining a risk level corresponding to each account; and obtaining account types corresponding to the accounts, and executing transaction control measures on the accounts. According to the invention, the monitoring efficiency can be improved, the problem processing time can be shortened, and the satisfaction of account service can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an account monitoring method, device, electronic device and storage medium. Background Art

[0002] With the development of economy and technology, the awareness of the importance of account management is still insufficient. In account management, for example, the authenticity and completeness of account opening materials can be tested, but the account will exist for a long time from the beginning to the end. If the test is only carried out at the account opening stage, the monitoring of the account is incomplete and inaccurate, resulting in poor management and accuracy of the account, and delayed services provided to the account. Summary of the invention

[0003] The present application provides an account monitoring method, device, electronic device and storage medium to improve monitoring efficiency and reduce problem handling time, thereby improving account service satisfaction. The technical solution of the present application is as follows:

[0004] According to a first aspect of an embodiment of the present application, there is provided an account monitoring method, comprising:

[0005] In the process of monitoring the account set, if the current monitoring data meets the monitoring conditions, a full life cycle monitoring data set corresponding to the account set is obtained from the encrypted database;

[0006] Decrypting the monitoring data set using the received key closest to the current time to obtain the decrypted monitoring data set, wherein the key is generated by the key management server based on the monitoring data set corresponding to the preset risk level;

[0007] Using at least one monitoring sub-model in the monitoring model to perform risk identification on a monitoring data subset corresponding to each account in the account set, and obtaining at least one risk score corresponding to each account, wherein the monitoring data subset is a data set corresponding to each account and each monitoring sub-model in the decrypted monitoring data set;

[0008] Obtaining a risk level corresponding to each of the accounts according to the at least one risk score;

[0009] The account type corresponding to each of the accounts is obtained, and a transaction control measure is executed on each of the accounts, wherein the transaction control measure corresponds to the risk level and the account type.

[0010] According to some embodiments, the adopting at least one monitoring sub-model in the monitoring model to perform risk identification on a subset of monitoring data corresponding to each account in the account set to obtain at least one risk score corresponding to each account includes:

[0011] Obtaining account opening information corresponding to each of the accounts;

[0012] Acquire field extraction rules corresponding to each account according to the account opening information;

[0013] According to the field extraction rule, field extraction is performed on the monitoring data subset corresponding to each account in the account set to obtain field information in the monitoring data subset;

[0014] At least one monitoring sub-model in the monitoring model is used to identify risks of field information in the monitoring data subset to obtain at least one risk score.

[0015] According to some embodiments, obtaining the risk level corresponding to each account according to the at least one risk score includes:

[0016] Obtaining weight information corresponding to each risk score in the at least one risk score according to the account information of each account and the model information of the monitoring sub-model;

[0017] The risk level corresponding to each of the accounts is obtained according to the weight information and the at least one risk score.

[0018] According to some embodiments, the method further comprises:

[0019] When the risk level corresponding to each account is obtained and the risk level meets the level requirement, a key update request is sent to the key management server;

[0020] Receive a key sent by the key management server, wherein the key is generated by the key management server in response to a key update request sent by a database server or a client based on a monitoring data set corresponding to each account, wherein the monitoring data set corresponding to each account is a monitoring data set within a period most recent to a current time.

[0021] According to some embodiments, the adopting at least one monitoring sub-model in the monitoring model to perform risk identification on a subset of monitoring data corresponding to each account in the account set to obtain at least one risk score corresponding to each account includes:

[0022] According to the account opening information and transaction authority information of each account in the account set, obtaining a model number set corresponding to each account;

[0023] Acquire, according to the model number set, at least one monitoring sub-model in the monitoring model corresponding to each of the accounts;

[0024] The at least one monitoring sub-model is used to perform risk identification on the monitoring data subset corresponding to each account, and at least one risk score corresponding to each account is obtained.

[0025] According to some embodiments, the method further comprises:

[0026] Obtaining update time information corresponding to each monitoring sub-model in the monitoring model;

[0027] According to the update time information, deviation detection and scoring accuracy detection are performed on each monitoring sub-model to obtain model performance information corresponding to each monitoring sub-model;

[0028] In the case that the model performance information does not meet the performance information requirement, the monitoring sub-model whose model performance information does not meet the performance information requirement is updated to obtain an updated monitoring sub-model.

[0029] According to a second aspect of an embodiment of the present application, there is provided an account monitoring device, including:

[0030] A set acquisition unit, used to acquire a full life cycle monitoring data set corresponding to the account set from an encrypted database when the account set is being monitored and the current monitoring data meets the monitoring conditions;

[0031] The set acquisition unit is further used to decrypt the monitoring data set using the received key closest to the current time to obtain the decrypted monitoring data set, wherein the key is generated by the key management server based on the monitoring data set corresponding to the preset risk level;

[0032] a score acquisition unit, configured to use at least one monitoring sub-model in the monitoring model to perform risk identification on a monitoring data subset corresponding to each account in the account set, and acquire at least one risk score corresponding to each account, wherein the monitoring data subset is a data set corresponding to each account and each monitoring sub-model in the decrypted monitoring data set;

[0033] an account monitoring unit, configured to obtain a risk level corresponding to each account according to the at least one risk score;

[0034] The account monitoring unit is further used to obtain the account type corresponding to each account and execute transaction control measures on each account, wherein the transaction control measures correspond to the risk level and the account type.

[0035] According to a third aspect of an embodiment of the present application, there is provided an electronic device, including:

[0036] processor;

[0037] a memory for storing instructions executable by the processor;

[0038] The processor is configured to execute the instructions to implement the account monitoring method described in any one of the aforementioned aspects.

[0039] According to a fourth aspect of an embodiment of the present application, a storage medium is provided. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the account monitoring method described in any one of the preceding aspects.

[0040] According to a fifth aspect of an embodiment of the present application, a computer program product is provided, including a computer program, wherein the computer program implements any one of the methods described in the preceding aspects when executed by a processor.

[0041] The technical solution provided by the embodiments of the present application brings at least the following beneficial effects:

[0042] In some or related embodiments, during the process of monitoring an account set and when the current monitoring data meets the monitoring conditions, a full life cycle monitoring data set corresponding to the account set is obtained from an encrypted database; the monitoring data set is decrypted using the received key closest to the current time to obtain the decrypted monitoring data set, wherein the key is generated by the key management server based on the monitoring data set corresponding to the preset risk level; at least one monitoring sub-model in the monitoring model is used to identify risks of a monitoring data subset corresponding to each account in the account set, and at least one risk score corresponding to each account is obtained, wherein the monitoring data subset is a data set corresponding to each account and each monitoring sub-model in the decrypted monitoring data set; according to the at least one risk score, the risk level corresponding to each account is obtained; the account type corresponding to each account is obtained, and transaction control measures are executed on each account, wherein the transaction control measures correspond to the risk level and the account type. Therefore, an account monitoring mechanism can be provided, which can obtain data from an encrypted database, directly read data from the encrypted database, reduce the time for monitoring data acquisition, and use dynamically updated keys to decrypt data, which can improve the security and efficiency of data acquisition, improve monitoring efficiency and reduce maintenance costs, and can use at least one monitoring sub-model for monitoring, which can improve the matching of the monitoring sub-model and the account, and can monitor an account throughout its life cycle to reduce inaccurate account management. It can increase the monitoring scope of account management and reduce the time to discover problems when there are problems with an account. It can also perform transaction control based on account type and risk level, reduce the situation where multiple different accounts use the same transaction control measures based solely on risk level, improve the accuracy of transaction control, improve monitoring efficiency and reduce problem handling time, and improve account service satisfaction.

[0043] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application, and do not constitute an improper limitation on the present application.

[0045] Figure 1 is a flow chart showing an account monitoring method according to an exemplary embodiment;

[0046] Figure 2 is a flow chart showing an account monitoring method according to an exemplary embodiment;

[0047] Figure 3 is a schematic diagram showing an example of a key management server according to an exemplary embodiment;

[0048] Figure 4 It is a block diagram of a certificate chain structure for remote authentication of an encrypted database according to an exemplary embodiment;

[0049] Figure 5 is a flowchart of a key management server according to an exemplary embodiment;

[0050] Figure 6 is a schematic diagram showing an example of remote authentication of an encrypted database according to an exemplary embodiment;

[0051] Figure 7 is a schematic diagram showing an example of a monitoring model according to an exemplary embodiment;

[0052] Figure 8 is a block diagram of an account monitoring device according to an exemplary embodiment;

[0053] Fig. 9 It is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0054] In order to enable ordinary persons in the art to better understand the technical solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0055] The embodiments of the present application propose an account monitoring method, device, electronic device and storage medium. In some embodiments, the terms such as account monitoring method, information processing method, communication method, etc. can be replaced with each other, the terms such as account monitoring device, information processing device, communication device, etc. can be replaced with each other, and the terms such as information processing system, communication system, etc. can be replaced with each other.

[0056] The embodiments of the present application are not exhaustive, but are only illustrative of some embodiments, and are not intended to be a specific limitation on the scope of protection of the present application. In the absence of contradiction, each step in a certain embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, in a certain embodiment, the solution after removing some steps can also be implemented as an independent embodiment, and the order of the steps in a certain embodiment can be arbitrarily exchanged. In addition, the optional implementations in a certain embodiment can be arbitrarily combined; in addition, the embodiments can be arbitrarily combined, for example, some or all of the steps of different embodiments can be arbitrarily combined, and a certain embodiment can be arbitrarily combined with the optional implementations of other embodiments.

[0057] In each embodiment of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between the embodiments are consistent and can be referenced to each other. The technical features in different embodiments can be combined to form a new embodiment based on their internal logical relationships.

[0058] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application.

[0059] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions. In the embodiments of this application, some existing solutions such as certain software, components, models, etc. may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the content.

[0060] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0061] Figure 1 is a flow chart of an account monitoring method according to an exemplary embodiment. Figure 1 As shown, the following steps are included:

[0062] In step S11, in the process of monitoring the account set, if the current monitoring data meets the monitoring conditions, the full life cycle monitoring data set corresponding to the account set is obtained from the encrypted database;

[0063] According to some embodiments, the execution subject of the embodiments of the present application may be, for example, an electronic device. The name of the electronic device is not limited, and the electronic device may also be called, for example, a terminal, a user terminal, etc. The application scenario of the embodiments of the present application may be, for example, applied to the full life cycle management of an account. The full life cycle management of an account may be, for example, the management of the entire process from the generation to the extinction of an account.

[0064] In some embodiments, the account set may be, for example, a collection of at least one account. At least one account included in the account set may be, for example, an account that has been registered with the same application, or may be, for example, a terminal registration account corresponding to at least one terminal. The present application embodiment does not limit this. The account set may also be, for example, all accounts from the opening to the demise of a certain bank. The account set does not specifically refer to a fixed set. For example, when the number of accounts corresponding to the account set changes, the account set may also change accordingly. For example, when a certain account in the account set changes, the account set may also change accordingly.

[0065] In some embodiments, the current monitoring data may refer to, for example, the monitoring data acquired at the current moment when the account set is monitored. The current monitoring data does not specifically refer to a fixed data. For example, when the monitoring time point changes, the current monitoring data may also change accordingly. For example, when the monitoring conditions change, the current monitoring data may also change accordingly.

[0066] According to some embodiments, the monitoring condition may refer to a condition for determining whether to enable the use of a model for scoring. The monitoring condition does not specifically refer to a fixed condition. For example, when a modification instruction for the monitoring condition is received, the monitoring condition may also change accordingly.

[0067] In some embodiments, the encrypted database may be, for example, a storage area for storing data in the form of encrypted files. The encrypted database does not specifically refer to a fixed database. For example, when the data included in the encrypted database changes, the encrypted database may also change accordingly. The data included in the encrypted database may include, for example, the status of a bank settlement account and data for full-process statistics of transaction behavior.

[0068] According to some embodiments, the full life cycle can be used to indicate the entire time period from the creation to the extinction of an account. The full life cycle does not specifically refer to a fixed period. For example, when an account changes, the full life cycle of the account may also change accordingly.

[0069] According to some embodiments, the monitoring data set may be, for example, a collection of at least one monitoring data. The monitoring data set may include, for example, multiple monitoring data subsets. Among them, one account may correspond to, for example, one monitoring data subset, or may correspond to multiple monitoring data subsets. The embodiments of the present application do not limit this.

[0070] In some embodiments, for example, during the process of monitoring an account set, when the current monitoring data meets the monitoring conditions, a full life cycle monitoring data set corresponding to the account set can be obtained from the encrypted database.

[0071] In step S12, the monitoring data set is decrypted using the received key closest to the current time to obtain the decrypted monitoring data set, wherein the key is generated by the key management server based on the monitoring data set corresponding to the preset risk level;

[0072] In some embodiments, the key received that is closest to the current time can be dynamically updated by a key management server, for example. The electronic device executing the embodiment of the present application can, for example, receive multiple keys and use the key closest to the current time when decrypting the detection data set.

[0073] The preset risk level may be, for example, the level indicating the lowest risk among the set risk levels. The preset risk level does not specifically refer to a fixed level. For example, when the setting method of the risk level changes, the preset risk level may also change accordingly.

[0074] According to some embodiments, when a monitoring data set is obtained, the monitoring data set can be decrypted using the key pair received that is closest to the current time to obtain a decrypted monitoring data set. The decrypted monitoring data set can be, for example, a collection of at least one decrypted data. The decrypted monitoring data set can be, for example, at least one single data, and can also include, for example, at least one monitoring data subset. The embodiments of the present application are not limited to this.

[0075] In step S13, at least one monitoring sub-model in the monitoring model is used to perform risk identification on a monitoring data subset corresponding to each account in the account set, and at least one risk score corresponding to each account is obtained, wherein the monitoring data subset is a data set corresponding to each account and each monitoring sub-model in the decrypted monitoring data set;

[0076] According to some embodiments, the monitoring model may be, for example, a model that has been trained and used to monitor an account. The monitoring model does not specifically refer to a fixed model. For example, when the number of monitoring sub-models included in the monitoring model changes, the monitoring model may also change accordingly. For example, when the model parameters of any monitoring sub-model in the monitoring model change, the monitoring model may also change accordingly.

[0077] In some embodiments, the monitoring sub-model may be, for example, a model corresponding to a certain monitoring scenario. The monitoring scenario includes, but is not limited to, an account behavior monitoring scenario, a fund inflow and outflow monitoring scenario, an account suspicious monitoring scenario, a blacklist monitoring scenario, etc. The monitoring sub-model does not specifically refer to a certain fixed model. For example, when the model parameters in the monitoring sub-model change, the monitoring sub-model may also change accordingly.

[0078] According to some embodiments, the monitoring data subset may be, for example, a data set corresponding to a certain account in the monitoring data set. The monitoring data subset does not specifically refer to a certain fixed set. For example, when the data included in the monitoring data subset changes, the monitoring data subset may also change accordingly. For example, when the monitoring time point changes, the monitoring data subset may also change accordingly.

[0079] Optionally, the risk score may be, for example, a score obtained by a monitoring sub-model for risk identification of a subset of monitoring data of a certain account. The risk score does not specifically refer to a fixed score. For example, when the monitoring sub-model changes, the risk score may also change accordingly. Among them, the subset of monitoring data identified by a certain monitoring sub-model may be, for example, a data set corresponding to the monitoring sub-model.

[0080] According to some embodiments, at least one monitoring sub-model in the monitoring model may be used to perform risk identification on a subset of monitoring data corresponding to each account in the account set to obtain at least one risk score corresponding to each account.

[0081] In step S14, the risk level corresponding to each account is obtained according to at least one risk score;

[0082] According to some embodiments, the risk level may be used to indicate the level of risk of a certain account. The risk level does not specifically refer to a fixed level. For example, when an account changes, the risk level may also change accordingly. For example, when a monitoring submodel or a monitoring data subset changes, the risk level may also change accordingly.

[0083] In some embodiments, when at least one risk score is obtained, the risk level corresponding to each account can be obtained according to the at least one risk score.

[0084] In step S15, the account type corresponding to each account is obtained, and transaction control measures are executed on each account, wherein the transaction control measures correspond to the risk level and the account type.

[0085] The account type may include, for example, a basic deposit account type, a general deposit account type, a special deposit account type, a temporary deposit account type, etc. This embodiment of the present application does not limit this.

[0086] In some embodiments, the transaction control measure may be, for example, a measure corresponding to the risk level and the account type, that is, the transaction control measure is determined based on a combination of the risk level and the account type, rather than one of them.

[0087] In some embodiments, the execution order of obtaining the account type corresponding to each account may not be limited, and may be performed before executing the transaction control measures on each account. For example, the step of obtaining the account type corresponding to each account may be performed before step 14.

[0088] According to some embodiments, when the account type and risk level are obtained, transaction control measures corresponding to both the account type and the risk level may be executed on each account.

[0089] In some or related embodiments, during the process of monitoring the account set, and when the current monitoring data meets the monitoring conditions, a full life cycle monitoring data set corresponding to the account set is obtained from an encrypted database; the monitoring data set is decrypted using the received key closest to the current time to obtain the decrypted monitoring data set, wherein the key is generated by the key management server based on the monitoring data set corresponding to the preset risk level; at least one monitoring sub-model in the monitoring model is used to identify risks of the monitoring data subset corresponding to each account in the account set, and at least one risk score corresponding to each account is obtained, wherein the monitoring data subset is the data set corresponding to each account and each monitoring sub-model in the decrypted monitoring data set; according to at least one risk score, the risk level corresponding to each account is obtained; the account type corresponding to each account is obtained, and transaction control measures are executed on each account, wherein the transaction control measures correspond to the risk level and the account type. Therefore, an account monitoring mechanism can be provided, which can obtain data from an encrypted database, directly read data from the encrypted database, reduce the time for monitoring data acquisition, and use dynamically updated keys to decrypt data, which can improve the security and efficiency of data acquisition, improve monitoring efficiency and reduce maintenance costs, and can use at least one monitoring sub-model for monitoring, which can improve the matching of the monitoring sub-model and the account, and can monitor an account throughout its life cycle to reduce inaccurate account management. It can increase the monitoring scope of account management and reduce the time to discover problems when there are problems with an account. It can also perform transaction control based on account type and risk level, reduce the situation where multiple different accounts use the same transaction control measures based solely on risk level, improve the accuracy of transaction control, improve monitoring efficiency and reduce problem handling time, and improve account service satisfaction.

[0090] Figure 2 is a flow chart of an account monitoring method according to an exemplary embodiment. Figure 2 As shown, the following steps are included:

[0091] In step S21, in the process of monitoring the account set, if the current monitoring data meets the monitoring conditions, the full life cycle monitoring data set corresponding to the account set is obtained from the encrypted database;

[0092] Among them, the technical solution of the embodiment of the present application can be used, for example, in the information security management scenario of the bank's account status, which specifically belongs to the technical field of financial management systems in the computer field.

[0093] The account set of the embodiment of the present application may be, for example, a bank account. The bank account may be, for example, a carrier of capital flow. The essence of account management may be, for example, ensuring the safe and efficient circulation of funds, thereby serving the production and operation of the enterprise, which is a continuous and systematic project.

[0094] According to some embodiments, for example, from a business perspective, the full life cycle management of an account in an embodiment of the present application can manage the entire process from the creation of a new account by an employee upon joining the company to the archiving of the account when the employee leaves the company.

[0095] Among them, when opening a bank account, for example, foreground data monitoring and background data monitoring can be performed, which can include, for example, qualification review before account opening, material review during account opening, and account monitoring after account opening.

[0096] Before opening an account, risk prevention and control can be carried out, for example, including verification of field inspection images, inquiry of customer registration information, verification of retrieved materials, remote verification, system data matching, etc., wherein the staff can also verify the original, for example, the original document and the photocopy can be checked. Verification of field inspection images can be, for example, when obtaining images obtained by field inspection, judging the office space according to the images, and determining that the office space meets the office requirements. Specifically, for example, it can include judging the authenticity of office space, business premises, personnel distribution, business facilities and the existence of enterprises. When querying customer registration information, for example, the account opening documents can be compared and whether the customer has registered for taxation. Verification of retrieved materials can be, for example, based on the image of the issuing agency of the enterprise certification document and the image of the acquired data. Remote verification can be, for example, when authorizing others to open an account, verifying the identity of the person in charge remotely. System data matching can be, for example, comparing the certification document image and the associated person information with the information in the information database.

[0097] Among them, the account opening process may include, for example, compliance review of customer information. Specific examples may include information review, due diligence review, online verification, whether the business operation process meets the requirements, whether the time of reporting to the People's Bank of China is within the preset time, whether the contact information is authentic, etc. Among them, the information review may include, for example, whether the image of the account opening certificate is stamped with the "verified consistent with the original" stamp, and whether the company name and legal person's age are abnormal. Among them, due diligence review may include, for example, reviewing whether the content of the due diligence video material is operated in accordance with the requirements, whether it is clear, and whether there is a true expression of the intention to open an account. Among them, online verification may include, for example, verifying the authenticity of the identity of the unit legal person (person in charge) and the authorized agent. Among them, business operations may include, for example, whether the counter operation is carried out according to the account opening operation process. Among them, whether the People's Bank of China is reported within the specified time. Among them, contact verification may include, for example, whether the reserved mobile phone number is authentic.

[0098] For example, the operation process before opening an account can be set to facilitate the operation management of operators, and hierarchical management can be carried out according to the management authority of different personnel such as tellers, account managers, and customer service managers to avoid problems such as management absence, poor implementation of systems, and service delays, thereby improving account supervision service efficiency and customer satisfaction.

[0099] After opening an account, a monitoring model can be established to monitor account transactions. For example, monitoring items may include: small-amount exploratory transactions; fast inflow and outflow of funds; the amount of transaction funds not matching the size of the enterprise; frequent transactions at night, etc. This embodiment of the application does not limit this.

[0100] In step S22, the monitoring data set is decrypted using the received key closest to the current time to obtain the decrypted monitoring data set, wherein the key is generated by the key management server based on the monitoring data set corresponding to the preset risk level;

[0101] The specific process is as described above and will not be repeated here.

[0102] In some embodiments, the encrypted database may include, for example, a plurality of encrypted data.

[0103] According to some embodiments, the method further comprises:

[0104] After obtaining the risk level corresponding to each account and the risk level meets the level requirements, a key update request is sent to the key management server;

[0105] Receive the key sent by the key management server, wherein the key is generated by the key management server in response to the key update request sent by the database server or the client, based on the monitoring data set corresponding to each account, wherein the monitoring data set corresponding to each account is the monitoring data set within the most recent period from the current time. Therefore, the security of data storage, the security of data acquisition, and the accuracy of account monitoring can be improved.

[0106] In some embodiments, the account lifecycle management server can use SQLCipher database and MySQL database to implement the entire system. Among them, the external sharing of encrypted database is defined in two forms: the first is to deploy the database server on a trusted machine and access it through a remote connection; the second is that the database is stored in the local machine in the form of an encrypted file, and the whole or part of the encrypted database file is shared when sharing. Among them, the whole or part of the encrypted database file shared when sharing can be determined, for example, based on the certificate authentication result of the access object. Among them, the access object of the embodiment of the present application can be, for example, the execution subject of the embodiment of the present application.

[0107] In some embodiments, Figure 3 is a schematic diagram showing an example of a key management server according to an exemplary embodiment. Figure 3 As shown, the Key Manager Server (KMS) service is used to store and manage the Secret Key. Through remote authentication, it configures the Secret Key for the target application APP and provides an interface for the maintenance, upgrade, and reset of the Key. The Key Management Server KMS receives a Secret Key request from a client or database server, and sends the Secret Key to a client or database server that is authenticated as legitimate. The client can be, for example, an electronic device, and the database server can be, for example, a database server.

[0108] Among them, the certificate chain structure diagram of the remote authentication of the encrypted database is as follows Figure 4 The workflow of the key management server can be as follows, for example: Figure 5 The specific working steps of the key management server are as follows:

[0109] (1) The client or database server generates a key pair and submits the public key to the KMS through the console page.

[0110] (2) KMS generates a client certificate based on the uploaded public key. The client or database server downloads the certificate and the server certificate at the same time.

[0111] (3) Import the server certificate and client certificate to the client or database server.

[0112] (4) The client or database server (through an authorized administrator) requests KMS on the console page to generate a token, which is issued by KMS and used for further verification and access control.

[0113] (5) Import the Token to the client or database server.

[0114] (6) Start the client or database server and initiate an HTTPS request to the KMS in the initial stage. Both parties verify each other's certificate (bidirectional verification).

[0115] (7) After the verification in step 6 is successful, KMS verifies the Token and sends the Secret Key to the client or database server.

[0116] Among them, the account monitoring system model is as follows Figure 6 As shown, the system may be composed of two entities (data provider and data user), three parts (encrypted SQL, key management server (Key Manager Server, KMS), and machine (SGX Worker) model definition with SGX function), and the system operation may include:

[0117] The first step is to run the encrypted database in the Enclave.

[0118] The second step is to allow applications running in the Enclave to access the encrypted database.

[0119] According to some embodiments, when the electronic device obtains the risk level of each account, it can determine whether the risk level meets the level requirement. The level requirement can be, for example, the lowest risk level among the set risk levels. When the electronic device determines that the risk level meets the level requirement, it can send a key update request to the key management server. The key update request does not specifically refer to a fixed request. For example, when the sending time point corresponding to the key update request changes, the key update request can also change accordingly.

[0120] According to some embodiments, the key management server can receive the key update request and generate a key update request based on the monitoring data set corresponding to each account in response to the key update request sent by the database server or client, wherein the monitoring data set corresponding to each account is a monitoring data set within the period closest to the current time.

[0121] In step S23, the account opening information corresponding to each account is obtained, and the field extraction rules corresponding to each account are obtained according to the account opening information;

[0122] The specific process is as described above and will not be repeated here.

[0123] In some embodiments, the account opening information does not specifically refer to a fixed information. For example, the account opening information may include the transaction types that the account is allowed to conduct transactions with when the account is opened, and may also include the transaction types that are additionally enabled after the account is opened. The embodiments of the present application are not limited to this.

[0124] In step S24, according to the field extraction rule, field extraction is performed on the monitoring data subset corresponding to each account in the account set to obtain field information in the monitoring data subset;

[0125] The specific process is as described above and will not be repeated here.

[0126] According to some embodiments, the field extraction rule may be pre-set, for example, and the field extraction rule may correspond to the current monitoring scenario. The field extraction rule may be a rule corresponding to the current monitoring scenario extracted from a rule library, for example. The field extraction rule does not specifically refer to a fixed rule. For example, when a modification instruction for a field extraction rule is received, the field extraction rule may also change accordingly.

[0127] In some embodiments, field information may be extracted from a subset of monitoring data, for example, and used for the monitoring sub-model to identify and determine the account level. The field information does not specifically refer to a fixed information. For example, when the field extraction rule changes, the field information may also change accordingly. For example, when the subset of monitoring data changes, the field information may also change accordingly.

[0128] In some embodiments, for example, field extraction may be performed on a monitoring data subset corresponding to each account in an account set according to a field extraction rule to obtain field information in the monitoring data subset.

[0129] Among them, the field extraction rules for the entire life cycle of the account are set. The report extraction rules may, for example, include extracting the business license number, customer number, account number, account name, institution number, institution name, first-level bank institution number, second-level bank institution number, name of the second-level bank, identity document number, legal person name, number of established enterprises (when the value is ≥ the first-level branch parameter, all accounts are reflected in the table), number of opened accounts, number of days for legal person change (30 days) (when the value is ≥ the first-level branch parameter, all accounts are reflected in the table), number of days for legal person change (180 days) (when the value is ≥ the first-level branch parameter, all accounts are reflected in the table), number of days for legal person change (365 days) (when the value is ≥ the first-level branch parameter, all accounts are reflected in the table), accounts with expired certificates, accounts 30 days before the expiration of certificates, and accounts 180 days before the expiration of certificates.

[0130] Among them, the report extraction rules may also include, for example, the date of data extraction, the first-level branch institution number, the first-level branch name, the second-level branch institution number, the second-level branch name, the institution name, the institution number, the account number, the account name, the account control status, the account dormant status, the blacklist type, the blacklist type note, the blacklist import date, the account opening agent certificate number, the account opening agent certificate name, the same legal representative name, the same legal representative certificate number, the account name, the customer number, the original associated account account number, the affiliated second-level institution, the second-level institution name, the account opening institution, the account opening institution name, the account opening date, the account nature, the reverse check of the account control status, the account control date, the reverse check of the account dormant status, the account transfer dormant date, the reverse check of the account active status, the active account freezing date, the account cancellation date, the legal person ID number, the legal representative name, the actual controller name, the actual controller certificate number, the beneficiary name, the beneficiary certificate number, etc. The embodiment of the present application does not limit this.

[0131] In step S25, at least one monitoring sub-model in the monitoring model is used to identify risks of field information in the monitoring data subset to obtain at least one risk score;

[0132] The specific process is as described above and will not be repeated here.

[0133] According to some embodiments, the method further comprises:

[0134] According to the account opening information and transaction authority information of each account in the account set, obtain the model number set corresponding to each account;

[0135] According to the model number set, at least one monitoring sub-model corresponding to each account in the monitoring model is obtained;

[0136] Using at least one monitoring sub-model to identify risks on a subset of monitoring data corresponding to each account, and obtaining at least one risk score corresponding to each account;

[0137] At least one monitoring sub-model is used to identify the risk of the monitoring data subset corresponding to each account, and at least one risk score corresponding to each account is obtained. Therefore, the monitoring sub-model can be obtained according to the model number, which can improve the accuracy of the monitoring sub-model acquisition, improve the accuracy of the risk score acquisition, and improve the accuracy and comprehensiveness of account monitoring. In addition, the monitoring sub-model can be determined according to the account opening information and transaction authority information, which can improve the accuracy of the monitoring sub-model acquisition, improve the accuracy of a certain account monitoring, and do not need to monitor all matters for the account, which can improve the monitoring efficiency.

[0138] According to some embodiments, the monitoring data subset is a data set corresponding to each account and each monitoring sub-model in the decrypted monitoring data set.

[0139] In some embodiments, an example schematic diagram of a monitoring model may be as follows: Figure 7 As shown. The at least one monitoring sub-model included in the monitoring model may include, for example, an account behavior monitoring sub-model, a fund inflow and outflow monitoring sub-model, an account suspicious monitoring sub-model, and a blacklist monitoring sub-model, wherein a monitoring sub-model may include, for example, multiple monitoring model rules, wherein the time and data in the monitoring model rules are examples and do not specifically refer to a fixed data, wherein each monitoring sub-model may specifically be, for example:

[0140] First, account behavior monitoring model:

[0141] 1. Model number JH1, model name: Account pre-opening has not been processed for a long time;

[0142] For example, the monitoring model rule may be: Generate account data for accounts that meet the following conditions at the same time:

[0143] (1) The contract information for corporate demand deposit is a RMB account or a RMB and foreign currency unified account;

[0144] (2) The nature of the account is basic, general, temporary or special;

[0145] (3) The approval status is not approved;

[0146] (4) If the case has not been processed for more than three months and the increment is one month, avoid repeated warnings;

[0147] (5) Corporate demand deposit contract: the account closing date is blank;

[0148] (6) Corporate demand deposit contract: the chain opening time <= the same day and the chain closing time > the same day;

[0149] (7) Currency information of the corporate demand deposit contract: Opening time <same day and closing time >same day.

[0150] 2. Model number JH2, model name: Account cancellation overdue filing for more than 2 days;

[0151] For example, a model rule may be: Account data is generated for accounts that meet the following conditions at the same time:

[0152] (1) The contract information for corporate demand deposit is a RMB account or a RMB and foreign currency unified account;

[0153] (2) The PBOC account status is cancelled;

[0154] (3) The status of the corporate demand deposit contract is terminated;

[0155] (4) The nature of the account is basic, general, temporary or special;

[0156] (5) The contract currency of the corporate demand deposit is RMB;

[0157] (6) (PBOC account closing date - corporate deposit contract account closing date) >= 2 days; (Note: PBOC account closing date is the current day)

[0158] (7) The opening time of the public demand deposit contract is less than or equal to the same day and the closing time is equal to or equal to the same day.

[0159] 3. Model number JH3, model name: opening interbank accounts beyond authority;

[0160] For example, a model rule may be: Account data is generated for accounts that meet the following conditions at the same time:

[0161] (1) The contract information for corporate demand deposit is a RMB account or a RMB and foreign currency unified account;

[0162] (2) The names of the marketable products are: Overseas Interbank Demand Deposits, Interbank Demand Deposits, Interbank Demand Deposits (Trustee Accounts), Interbank Demand Deposits (Free Trade Zone Edition), Overseas Interbank Demand Deposits (Free Trade Zone Edition);

[0163] (3) The purpose of funds is: domestic bank deposits, credit union deposits, overseas bank deposits, special overseas bank deposits;

[0164] (4) The account status is normal;

[0165] (5) The code value of the institution level is branch or outlet;

[0166] (6) The contract currency of the corporate demand deposit is RMB;

[0167] (7) Corporate demand deposit contracts. The customer account name is not securities, funds, insurance, or futures;

[0168] (8) The account cancellation date of the corporate demand deposit contract is blank;

[0169] (9) The opening time of the public demand deposit contract is less than or equal to the current day and the opening time is greater than the current day - 30 days and the associated time is greater than the current day - 30 days;

[0170] (10) The currency information of the corporate demand deposit contract is opened on the same day and the opening time is between the same day and 30 days and the associated time is between the same day and 30 days.

[0171] 4. Model number JH4, model name: The account has been cancelled by the People's Bank of China but not by the Construction Bank;

[0172] For example, a model rule may be: Account data is generated for accounts that meet the following conditions at the same time:

[0173] (1) The contract information for corporate demand deposit is a RMB account or a RMB and foreign currency unified account;

[0174] (2) The PBOC account status is cancelled;

[0175] (3) The status of the corporate demand deposit contract is signed;

[0176] (4) The nature of the account is basic, general, temporary or special;

[0177] (5) The contract currency of the corporate demand deposit is RMB;

[0178] (6) (PBOC account closing date - public deposit contract opening date) >= 2 days;

[0179] (7) The opening time of the public demand deposit contract is less than or equal to the same day and the closing time is equal to 29991231.

[0180] Second, the capital inflow and outflow monitoring model:

[0181] 1. Model number FXQ1, model name: long-term unused account, suddenly activated with huge trading volume;

[0182] For example, a model rule may be: Account data is generated for accounts that meet the following conditions at the same time:

[0183] (1) The account has no transaction details (excluding interest settlement) during the T-180 period;

[0184] (2) After the account is reopened with a non-counter ID, one of the following conditions must be met:

[0185] The monthly cumulative number of transactions (period T+30 days) exceeds 500;

[0186] The monthly cumulative (period T+30 days) transaction amount (loan and borrowing amount) exceeds RMB 10 million.

[0187] 2. Model number FXQ2, model name: The account has frequent or large transactions after a small trial transaction;

[0188] The model rules may be, for example: for accounts that satisfy (1)(2) or (1)(3) or (1)(2)(3), generate account data:

[0189] (1) There are no transaction details (excluding interest accrual) on day T-180 of the account cycle, or after a new account is opened (less than 30 days), there are sporadic small transactions on day T-3 of the cycle (the number of transactions is greater than or equal to 3, and the amount of each transaction is greater than or equal to RMB 1 and less than or equal to RMB 10);

[0190] (2) Large transactions occur on the same day, with the cumulative amount being greater than or equal to 1 million;

[0191] (3) Frequent transactions occur on the same day, with the number of transactions on the same day being greater than or equal to 30.

[0192] 3. Model number FXQ3, model name: The account suddenly stops being used after frequent or large transactions in a short period of time;

[0193] The model rule may be, for example: for accounts that satisfy (1)(3) or (2)(3) or (1)(2)(3), generate account data:

[0194] (1) The account has had a single transaction with a capital of ≥ N (first-tier branch parameter, with a default value of RMB 1 million) on the T-7th day of the period;

[0195] (2) The number of transactions in the period T-7 days is greater than or equal to 70;

[0196] (3) The number of transactions and the transaction amount in the T+7-day period are both 0.

[0197] 4. Model number FXQ4, model name: Sleeping accounts frequently switch between "normal" and "sleeping";

[0198] The model rule may be, for example: the account status field changes from "waiting for sleep" to "sleeping", and the periodic period changes to normal within T+30 days.

[0199] Third, the account suspicious monitoring model is mainly aimed at monitoring suspicious accounts involved in gambling and fraud.

[0200] 1. Model number CT1, model name: Most of the counterparties of fund transactions are individuals and the loan ratio is abnormal;

[0201] For example, the model rules can be: from period T to period T-30, the existing accounts (excluding institutional customers and large and medium-sized enterprises; the account control status is normal, and the branch will no longer monitor on the second day after performing account control) have a debit cumulative transaction amount / credit cumulative transaction amount > 0.99 (the loan ratio is greater than 99%) and the individual counterparty exceeds E (parameter setting, the default parameter E=30) to generate data.

[0202] 2. Model number CA1, model name: the account has no balance or the balance is low relative to the transaction amount;

[0203] For example, the model rule may be: Generate account data if the following conditions are met at the same time:

[0204] (1) The account has transactions and the account balance = 0;

[0205] (2) The account has transactions, and the daily balance ÷ the daily transaction amount is ≤ N (a first-level branch parameter, the default value is 1)%, and the cumulative number of days in a month exceeds M (a first-level branch parameter, the default value is 10 days).

[0206] 3. Model number CA2, model name: The number of account transactions increased significantly in a short period of time;

[0207] For example, the model rule can be: if the existing accounts (excluding institutional customers and large and medium-sized enterprises; the account control status is normal, and the branch does not monitor the account on the second day after the account control) meet the condition that the number of account transactions this month ÷ the number of account transactions last month ≥ N (first-level branch parameter, the default value is 100), the account data is generated. If the number of account transactions last month is 0, the system automatically sets it to 1.

[0208] Fourth, blacklist monitoring model:

[0209] Model rules: filter the bank's customer level, non-bank customer level, and bank account level customers imported into the blacklist to generate data. The blacklist types are divided into four types: suspicious list, case list, anti-money laundering banned list, and custom. Blacklist customers can be managed accordingly. The management and control rules include: list query, account opening warning, inventory warning, account opening refusal, sealing, only receiving but not paying, suspension of non-counter, and expansion investigation.

[0210] Account opening warning and account opening rejection are mutually exclusive, and only one can be selected. The control takes effect in real time. The three rules of sealing, receiving but not paying, and suspending non-counter transactions are mutually exclusive, and only one can be selected at the same time. The control period takes effect on T+2 days.

[0211] In some embodiments, when the account set is a bank account set, the account opening information may include, for example, a credit card account or a savings card account, etc., and the account opening information may also include, for example, account level information. This embodiment of the application is not limited to this.

[0212] In some embodiments, the transaction authority information may include, for example, transaction operation types and transaction amount limit information.

[0213] In step S26, the risk level corresponding to each account is obtained according to at least one risk score;

[0214] The specific process is as described above and will not be repeated here.

[0215] In step S27, the account type corresponding to each account is obtained, and transaction control measures are executed on each account, wherein the transaction control measures correspond to the risk level and the account type.

[0216] The specific process is as described above and will not be repeated here.

[0217] According to some embodiments, obtaining a risk level corresponding to each account according to at least one risk score includes:

[0218] Obtaining weight information corresponding to each risk score in at least one risk score according to the account information of each account and the model information of the monitoring sub-model;

[0219] The risk level corresponding to each account is obtained according to the weight information and at least one risk score. Therefore, by judging the risk level in combination with the weight information and the risk score, the accuracy of determining the account risk level can be improved.

[0220] For example, when multiple monitoring sub-models are triggered, at least one risk score may be directly accumulated, and the risk level may be determined according to the accumulated risk score. This embodiment of the present application does not limit this.

[0221] In some embodiments, when multiple monitoring sub-models are triggered, the corresponding relationship between the risk score and the risk level obtained by accumulating the scores may be as follows, for example:

[0222] 0-20 points correspond to low-risk accounts;

[0223] 20 (inclusive) - 40 points correspond to medium-low risk accounts;

[0224] 40 (inclusive) - 60 points correspond to medium-risk accounts;

[0225] 60 (inclusive) - 80 points correspond to medium-high risk accounts;

[0226] A score greater than 80 (inclusive) corresponds to a high-risk account. The risk scores in each range are given as examples and do not refer to a specific fixed risk score.

[0227] In some embodiments, different risk levels may use different risk measures for transaction control. For example, the risk measures corresponding to medium-risk accounts are attention-type risk measures, the risk measures corresponding to medium-high-risk accounts are suspicious-type risk measures, and the risk measures corresponding to high-risk accounts are prohibited-type risk measures.

[0228] According to some embodiments, transaction control is performed on each account according to the risk level, including:

[0229] Get the account type of each account;

[0230] Risk control measures are used to control transactions of each account, where the risk control measures correspond to the account type and risk level. Therefore, different transaction controls can be performed on different account types and different risk levels, which can improve the accuracy of transaction control. Among them, account types can include basic deposit account types, general deposit account types, special stock account types, temporary deposit account types, etc.

[0231] According to some embodiments, risk control measures may include, for example, revocation of business license, listing on a list of serious illegal and dishonest persons, and the same phone being used by multiple users. Among them:

[0232] First, risk control measures for business license revocation:

[0233] When the account type is a stock account type, for example: (1) Using the unified social credit code as an index, for the "business status" column that is "cancelled" or "revokated", a report is generated, and the stock account range is the current deposit account data (excluding the deposit account, that is, the current deposit account is deducted when its account nature or fund purpose is a deposit). (2) The electronic device can automatically perform "receiving but not paying" processing, and the reason is set to "the account should be cancelled due to cancellation but was not cancelled". After 30 days, the system will automatically convert it to a dormant account. (3) For accounts with normal control status, the employee channel application APP information can be sent to the account manager. (4) When the account logs in to the corporate online banking, a pop-up screen prompts "The business license has been revoked. Please apply to the opening bank for account cancellation within 5 working days. For details, please contact the account opening branch."

[0234] When the account type is an incremental account type, for example, it can be: opening of a new generation of current deposit accounts and comprehensive contract account opening transactions. When entering the unified social credit code of the business license, if the "operating status" column is "cancelled" or "revokated", the account is controlled not to be opened.

[0235] Second, risk control measures for serious violations of law and trust:

[0236] When the account type is an existing account type, for example: (1) Using the unified social credit code as an index, a report is generated for those listed in the "Severely Illegal and Untrustworthy Enterprises" list; a list of normal settlement accounts of seriously illegal and untrustworthy enterprises of the affiliated institutions as of the current day is displayed. (2) "Only receive but not pay" processing can be automatically performed. (3) The employee channel application APP message pushes the account to the account manager for prompting. (4) When the account logs in to the online banking, a pop-up message will appear on the screen saying "Dear customer, your company has been included in the list of seriously illegal and untrustworthy enterprises. Our bank has taken control measures on its accounts. Please go to the account opening branch as soon as possible to complete the account closure procedures."

[0237] When the account type is an incremental account type, for example, it can be: when opening a new generation of current deposit accounts and handling comprehensive contract account opening transactions, the system controls that the account cannot be opened, and the prompt reason is "Your organization has been included in the list of serious illegal and dishonest enterprises, and the account cannot be opened."

[0238] Second, risk control measures for the same phone being used by multiple customers:

[0239] When the account type is a stock account type, for example, it can be: (1) Match corporate customers with corporate contact numbers. When the number of corporate customers is greater than N (first-level branch parameter, the default value is 3; Note: N refers to the number of companies), generate a report to display the list of normal settlement accounts opened by the company with the same contact number used by more than N companies as of the current day. (2) The employee channel APP pushes a message to the account manager to remind him of the account ownership.

[0240] When the account type is an incremental account type, for example, in the opening of a new generation current deposit account and a comprehensive contract account opening transaction, the warning prompt is as follows: "The contact number is used by multiple accounts, please verify." After the teller clicks to confirm, manual processing is performed to determine whether to continue the transaction or refuse to open the account.

[0241] In some embodiments, the method further comprises:

[0242] Obtain the update time information corresponding to each monitoring sub-model in the monitoring model;

[0243] According to the update time information, each monitoring sub-model is tested for deviation and scoring accuracy, and the model performance information corresponding to each monitoring sub-model is obtained;

[0244] When the model performance information does not meet the performance information requirements, the monitoring sub-model whose model performance information does not meet the performance information requirements is updated to obtain an updated monitoring sub-model. Therefore, the differences between different accounts can be reduced, the unfairness of the model when monitoring different accounts can be reduced, the accuracy of scoring acquisition can be improved, and the accuracy of account monitoring can be improved.

[0245] In some embodiments, for example, a historical monitoring data set of each account may be obtained, and data in the historical monitoring data set that does not meet the data requirements may be removed. The data requirements may include, for example, removing the permission level information of the account. This embodiment of the application is not limited to this.

[0246] In some embodiments, the score accuracy detection may be determined, for example, based on the annotation information of each score, or based on the feedback information of the execution of the transaction control measure. The embodiments of the present disclosure are not limited to this.

[0247] In some or related embodiments, field extraction is performed on a monitoring data subset corresponding to each account in an account set according to a field extraction rule to obtain field information in the monitoring data subset; at least one monitoring sub-model in the monitoring model is used to perform risk identification on the field information in the monitoring data subset to obtain at least one risk score. Therefore, risk identification can be performed through field information, which can improve the accuracy of risk identification, improve the accuracy of risk score acquisition, improve the accuracy of transaction control, and improve the accuracy of service.

[0248] Figure 8 FIG. 1 is a block diagram of an account monitoring device according to an exemplary embodiment. Figure 8 , the account monitoring device 800 comprises:

[0249] The set acquisition unit 801 is used to acquire the full life cycle monitoring data set corresponding to the account set from the encrypted database when the current monitoring data meets the monitoring conditions during the process of monitoring the account set;

[0250] The set acquisition unit 801 is further used to decrypt the monitoring data set using the received key closest to the current time to obtain the decrypted monitoring data set, wherein the key is generated by the key management server based on the monitoring data set corresponding to the preset risk level;

[0251] A score acquisition unit 802 is used to use at least one monitoring sub-model in the monitoring model to perform risk identification on a monitoring data subset corresponding to each account in the account set, and obtain at least one risk score corresponding to each account, wherein the monitoring data subset is a data set corresponding to each account and each monitoring sub-model in the decrypted monitoring data set;

[0252] An account monitoring unit 803 is used to obtain a risk level corresponding to each account according to at least one risk score;

[0253] The account monitoring unit 803 is further used to obtain the account type corresponding to each account and execute transaction control measures on each account, wherein the transaction control measures correspond to the risk level and the account type.

[0254] According to some embodiments, the score acquisition unit 802 is used to use at least one monitoring sub-model in the monitoring model to perform risk identification on a monitoring data subset corresponding to each account in the account set, and obtain at least one risk score corresponding to each account, including:

[0255] Get the account opening information corresponding to each account;

[0256] Obtain field extraction rules corresponding to each account based on account opening information;

[0257] According to the field extraction rules, perform field extraction on the monitoring data subset corresponding to each account in the account set to obtain the field information in the monitoring data subset;

[0258] At least one monitoring sub-model in the monitoring model is used to identify risks of field information in the monitoring data subset to obtain at least one risk score.

[0259] According to some embodiments, the account monitoring unit 803 is used to obtain the risk level corresponding to each account according to at least one risk score, specifically to:

[0260] Obtaining weight information corresponding to each risk score in at least one risk score according to the account information of each account and the model information of the monitoring sub-model;

[0261] According to the weight information and at least one risk score, a risk level corresponding to each account is obtained.

[0262] According to some embodiments, the set acquisition unit 801 is further specifically configured to:

[0263] After obtaining the risk level corresponding to each account and the risk level meets the level requirements, a key update request is sent to the key management server;

[0264] Receive the key sent by the key management server, wherein the key is generated by the key management server in response to the key update request sent by the database server or the client based on the monitoring data set corresponding to each account, wherein the monitoring data set corresponding to each account is the monitoring data set within the period most recent to the current time.

[0265] According to some embodiments, the score acquisition unit 802 is used to identify risks of the monitoring data subset corresponding to each account in the account set by using at least one monitoring sub-model in the monitoring model, and to obtain at least one risk score corresponding to each account, specifically for:

[0266] According to the account opening information and transaction authority information of each account in the account set, obtain the model number set corresponding to each account;

[0267] According to the model number set, at least one monitoring sub-model corresponding to each account in the monitoring model is obtained;

[0268] At least one monitoring sub-model is used to identify risks on a subset of monitoring data corresponding to each account, and at least one risk score corresponding to each account is obtained.

[0269] According to some embodiments, the score acquisition unit 802 is further configured to:

[0270] Obtain the update time information corresponding to each monitoring sub-model in the monitoring model;

[0271] According to the update time information, each monitoring sub-model is tested for deviation and scoring accuracy, and the model performance information corresponding to each monitoring sub-model is obtained;

[0272] In the case where the model performance information does not meet the performance information requirement, the monitoring sub-model whose model performance information does not meet the performance information requirement is updated to obtain an updated monitoring sub-model.

[0273] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0274] In some or related embodiments, a set acquisition unit is used to acquire a full life cycle monitoring data set corresponding to an account set from an encrypted database during monitoring of an account set and when the current monitoring data meets the monitoring conditions; the set acquisition unit is also used to decrypt the monitoring data set using the received key closest to the current time to acquire the decrypted monitoring data set, wherein the key is generated by a key management server based on a monitoring data set corresponding to a preset risk level; a score acquisition unit is used to identify risks of a monitoring data subset corresponding to each account in the account set using at least one monitoring sub-model in a monitoring model, and acquire at least one risk score corresponding to each account, wherein the monitoring data subset is a data set corresponding to each account and each monitoring sub-model in the decrypted monitoring data set; an account monitoring unit is used to acquire the risk level corresponding to each account based on at least one risk score; the account monitoring unit is also used to acquire the account type corresponding to each account, and execute transaction control measures on each account, wherein the transaction control measures correspond to the risk level and the account type. Therefore, an account monitoring mechanism can be provided, which can obtain data from an encrypted database, directly read data from the encrypted database, reduce the time for acquiring monitoring data, improve the security and efficiency of data acquisition, improve monitoring efficiency and reduce maintenance costs, and can use at least one monitoring sub-model for monitoring, improve the matching of the monitoring sub-model and the account, and monitor an account throughout its life cycle, reduce inaccurate account management, increase the monitoring scope of account management, reduce the time to discover problems when there are problems with the account, improve monitoring efficiency and reduce problem handling time, and improve account service satisfaction.

[0275] Fig. 9 1 is a block diagram of an electronic device UE900 provided by an embodiment of the present application. For example, UE900 may be a mobile phone, a computer, a digital broadcast electronic device, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0276] Reference Fig. 9 UE 900 may include at least one of the following components: a processing component 902 , a memory 904 , a power component 906 , a multimedia component 908 , an audio component 910 , an input / output (I / O) interface 912 , a sensor component 914 , and a communication component 916 .

[0277] The processing component 902 is generally used to control the overall operation of the UE 900, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 902 may include at least one processor 920 to execute instructions to complete all or part of the steps of the above method. In addition, the processing component 902 may include at least one module to facilitate the interaction between the processing component 902 and other components. For example, the processing component 902 may include a multimedia module to facilitate the interaction between the multimedia component 908 and the processing component 902.

[0278] The memory 904 is configured to store various types of data to support the operation of the UE 900. Examples of such data include instructions for any application or method operating on the UE 900, contact data, phone book data, messages, pictures, videos, etc. The memory 904 may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0279] The power component 906 provides power to various components of the UE 900. The power component 906 may include a power management system, at least one power supply, and other components associated with generating, managing, and distributing power for the UE 900.

[0280] The multimedia component 908 includes a screen that provides an output interface between the UE900 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes at least one touch sensor to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the wake-up time and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 908 includes a front camera and / or a rear camera. When the UE900 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0281] The audio component 910 is configured to output and / or input audio signals. For example, the audio component 910 includes a microphone (MIC), and when the UE 900 is in an operation mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 904 or sent via the communication component 916. In some embodiments, the audio component 910 also includes a speaker for outputting audio signals.

[0282] I / O interface 912 provides an interface between processing component 902 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0283] The sensor component 914 includes at least one sensor for providing various aspects of status assessment for the UE 900. For example, the sensor component 914 can detect the open / closed state of the UE 900, the relative positioning of the components, such as the display and keypad of the UE 900, and the sensor component 914 can also detect the position change of the UE 900 or a component of the UE 900, the presence or absence of contact between the user and the UE 900, the orientation or acceleration / deceleration of the UE 900, and the temperature change of the UE 900. The sensor component 914 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor component 914 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor component 914 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0284] The communication component 916 is configured to facilitate wired or wireless communication between the UE 900 and other devices. The UE 900 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 916 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 916 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0285] In an exemplary embodiment, UE900 may be implemented by at least one application-specific integrated circuit (ASIC), digital signal processor (DSP), digital signal processing device (DSPD), programmable logic device (PLD), field programmable gate array (FPGA), controller, microcontroller, microprocessor or other electronic component to perform the above method.

[0286] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0287] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0288] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0289] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0290] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0291] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0292] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution disclosed in this application can be achieved, and this document is not limited here.

[0293] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. An account monitoring method, characterized in that: include: In the process of monitoring the account set, if the current monitoring data meets the monitoring conditions, a full life cycle monitoring data set corresponding to the account set is obtained from the encrypted database; Decrypting the monitoring data set using the received key closest to the current time to obtain the decrypted monitoring data set, wherein the key is generated by the key management server based on the monitoring data set corresponding to the preset risk level; Using at least one monitoring sub-model in the monitoring model to perform risk identification on a monitoring data subset corresponding to each account in the account set, and obtaining at least one risk score corresponding to each account, wherein the monitoring data subset is a data set corresponding to each account and each monitoring sub-model in the decrypted monitoring data set; Obtaining a risk level corresponding to each of the accounts according to the at least one risk score; The account type corresponding to each of the accounts is obtained, and a transaction control measure is executed on each of the accounts, wherein the transaction control measure corresponds to the risk level and the account type.

2. The method according to claim 1, characterized in that: The using at least one monitoring sub-model in the monitoring model to perform risk identification on a monitoring data subset corresponding to each account in the account set to obtain at least one risk score corresponding to each account includes: Obtaining account opening information corresponding to each of the accounts; Acquire field extraction rules corresponding to each account according to the account opening information; According to the field extraction rule, field extraction is performed on the monitoring data subset corresponding to each account in the account set to obtain field information in the monitoring data subset; At least one monitoring sub-model in the monitoring model is used to perform risk identification on the field information in the monitoring data subset to obtain at least one risk score.

3. The method according to claim 1, characterized in that The obtaining, according to the at least one risk score, a risk level corresponding to each account includes: Obtaining weight information corresponding to each risk score in the at least one risk score according to the account information of each account and the model information of the monitoring sub-model; The risk level corresponding to each of the accounts is obtained according to the weight information and the at least one risk score.

4. The method according to claim 1, characterized in that: The method further comprises: When the risk level corresponding to each account is obtained and the risk level meets the level requirement, a key update request is sent to the key management server; Receive a key sent by the key management server, wherein the key is generated by the key management server in response to a key update request sent by a database server or a client based on a monitoring data set corresponding to each account, wherein the monitoring data set corresponding to each account is a monitoring data set within a period most recent to a current time.

5. The method according to claim 1, characterized in that: The using at least one monitoring sub-model in the monitoring model to perform risk identification on a monitoring data subset corresponding to each account in the account set to obtain at least one risk score corresponding to each account includes: According to the account opening information and transaction authority information of each account in the account set, obtaining a model number set corresponding to each account; Acquire, according to the model number set, at least one monitoring sub-model in the monitoring model corresponding to each of the accounts; The at least one monitoring sub-model is used to perform risk identification on the monitoring data subset corresponding to each account, and at least one risk score corresponding to each account is obtained.

6. The method according to claim 1, characterized in that The method further comprises: Obtaining update time information corresponding to each monitoring sub-model in the monitoring model; According to the update time information, deviation detection and scoring accuracy detection are performed on each monitoring sub-model to obtain model performance information corresponding to each monitoring sub-model; In the case that the model performance information does not meet the performance information requirement, the monitoring sub-model whose model performance information does not meet the performance information requirement is updated to obtain an updated monitoring sub-model.

7. An account monitoring device, characterized in that: include: A set acquisition unit, used to acquire a full life cycle monitoring data set corresponding to the account set from an encrypted database when the account set is being monitored and the current monitoring data meets the monitoring conditions; The set acquisition unit is further used to decrypt the monitoring data set using the received key closest to the current time to obtain the decrypted monitoring data set, wherein the key is generated by the key management server based on the monitoring data set corresponding to the preset risk level; a score acquisition unit, configured to use at least one monitoring sub-model in the monitoring model to perform risk identification on a monitoring data subset corresponding to each account in the account set, and acquire at least one risk score corresponding to each account, wherein the monitoring data subset is a data set corresponding to each account and each monitoring sub-model in the decrypted monitoring data set; an account monitoring unit, configured to obtain a risk level corresponding to each account according to the at least one risk score; The account monitoring unit is further used to obtain the account type corresponding to each account and execute transaction control measures on each account, wherein the transaction control measures correspond to the risk level and the account type.

8. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the account monitoring method according to any one of claims 1 to 6.

9. A storage medium, when instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the account monitoring method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the account monitoring method according to any one of claims 1 to 6.

Images