Risk control early warning method and system based on bank flow analysis

Abstract

The invention provides a risk control early warning method and system based on bank flow analysis, and relates to the technical field of computers, bank flow data of a target user in a bank system is collected, the collected bank flow data is fused with multi-source cross-domain data, and time sequence data of transaction behaviors is generated according to a time sequence; performing data feature extraction on the time sequence data to obtain transaction features; constructing a framework of a risk prediction model, and obtaining the risk prediction model through training and verification; real-time flow data of a target user in a bank system is monitored in real time, a trained risk prediction model is utilized to evaluate transaction behaviors of clients in real time, an anomaly detection result of an anomaly detection model is combined with output of the risk prediction model, a comprehensive risk score is formed to identify potential risks, and an early warning mechanism is triggered. Through deep analysis of bank flow data, real-time risk monitoring and early warning are realized, and potential financial risks can be effectively identified.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a risk control and early warning method and system based on bank transaction analysis. Background Art

[0002] In the modern financial system, banks face numerous risks, including credit risk, market risk, and operational risk. Bank transaction data, as a crucial record of customer transaction behavior, can provide a wealth of information for risk analysis. Traditional risk control methods primarily rely on historical default data and credit scoring models, but these methods suffer from issues such as poor timeliness and limited coverage. Therefore, a real-time risk control and early warning system based on bank transaction data is urgently needed to improve the accuracy and timeliness of risk control. Summary of the Invention

[0003] In view of this, the present invention proposes a risk control and early warning method and system based on bank transaction analysis. By conducting in-depth analysis of bank transaction data, real-time risk monitoring and early warning can be achieved, which can effectively identify potential financial risks and provide efficient risk management and decision support.

[0004] The present invention is achieved by adopting the following technical solutions: In a first aspect, the present invention provides a risk control and early warning method based on bank flow analysis, the method comprising the following steps: Collect bank transaction data of target users within the banking system, fuse the collected bank transaction data with multi-source cross-domain data, and generate time series data of transaction behavior in chronological order; Extract data features from time series data to obtain transaction features including transaction frequency, transaction amount, transaction type distribution, account balance fluctuations, and inter-account transfer patterns; Based on the extracted transaction features, a risk prediction model framework is constructed. The model is trained using historical bank transaction data, and model performance is optimized through cross-validation to obtain a trained and validated risk prediction model. Monitor the real-time transaction data of target users within the banking system in real time, use the trained risk prediction model to conduct real-time evaluation of customers' transaction behaviors, and combine the anomaly detection results of the anomaly detection model with the output of the risk prediction model to form a comprehensive risk score to identify potential risks and trigger an early warning mechanism.

[0005] As a further solution of the present invention, the target user's bank transaction data includes: Deposit records: including deposit time, deposit amount, and deposit method (cash deposit or transfer deposit); Withdrawal records: including withdrawal time, withdrawal amount, and withdrawal method (cash withdrawal or ATM withdrawal); Transfer records: including transfer time, transfer amount, transfer account (payee / payer), transfer method (bank transfer or electronic transfer); Consumption records: including consumption time, consumption amount, consumption location, and consumption category; Account balance changes: Record each change in the account balance.

[0006] As a further solution of the present invention, the multi-source cross-domain data includes: Credit card data: including credit card spending records, repayment records, and credit limit usage; Social media data: records of user activities on social media, such as consumer reviews and social interactions, used to assist in analyzing user behavior patterns; Third-party payment data: including transaction records of third-party payment platforms such as Alipay and WeChat Pay; E-commerce platform data: including users’ shopping records, transaction frequency, transaction amount, etc. on e-commerce platforms; Public record data: users’ public account records, credit records, judicial records, etc.

[0007] As a further solution of the present invention, the collected bank transaction data is integrated with multi-source cross-domain data to generate time series data of transaction behaviors in chronological order, including the following steps: Align bank transaction data with multi-source cross-domain data by timestamp to form a dataset containing timestamp, transaction type, transaction amount, and account balance information; Convert each data record in the dataset into a unified time format and sort all transaction records by timestamp; Define the time granularity for data aggregation, aggregate transaction records by time window, and generate time series data.

[0008] As a further solution of the present invention, when extracting transaction frequency, the number of transactions in each time window is counted according to the time window to calculate the transaction frequency; when extracting transaction amount, the sum of the transaction amounts in each time window is calculated to obtain the total transaction amount, and when calculating statistics, the average value, standard deviation, maximum value and minimum value are calculated based on the total transaction amount.

[0009] As a further solution of the present invention, the transaction type distribution is determined by counting the number of transactions and the amount of each type according to the classified transaction types; and the account balance change is calculated by recording the account balance after each transaction, and the account balance standard deviation and the maximum and minimum values ​​are calculated to determine the account amount fluctuation.

[0010] As a further solution of the present invention, when constructing the framework of the risk prediction model, the extracted transaction features are normalized, and the transaction features are screened using L1 regularization to obtain feature types; and a prediction model is constructed using logistic regression and training data based on the feature type and prediction task.

[0011] As a further solution of the present invention, when using L1 regularization to screen transaction features, the time series data containing the transaction features is cleaned, missing values ​​and outliers are processed, and the feature data is standardized so that the mean of the feature data is 0 and the variance is 1; the regularization parameters are set based on the Lasso regression model, wherein the strength of the L1 regularization is controlled by the regularization parameter λ; the Lasso regression model is trained using the standardized time series data, and after the training is completed, the coefficient value of each feature is obtained; feature screening is performed based on the value of the feature coefficient, and features with a coefficient value of 0 are excluded.

[0012] As a further embodiment of the present invention, the risk control and early warning method based on bank transaction analysis further includes using an isolation forest to establish an anomaly detection model to detect abnormal patterns in transaction data, judging abnormal behavior by the path length of isolated data points, and obtaining an anomaly detection result. The anomaly detection result of the anomaly detection model is combined with the output of the risk prediction model to form a comprehensive risk score, including: Anomaly detection scores were calculated for each transaction using Isolation Forest and normalized. Use the risk prediction model to calculate a risk score for each transaction, and take a weighted average of the standardized anomaly detection score and the risk prediction score to form a comprehensive risk score; Determine the threshold for the comprehensive risk score and identify potential risks based on the comprehensive risk score.

[0013] In a second aspect, the present invention further includes a risk control and early warning system based on bank transaction analysis, the system comprising: Data collection module, used to collect bank transaction data of target users in the banking system; The data fusion module is used to fuse the collected bank transaction data with multi-source cross-domain data to generate time series data of transaction behaviors in chronological order; The feature extraction module is used to extract data features from time series data to obtain transaction features including transaction frequency, transaction amount, transaction type distribution, account balance fluctuation, and inter-account transfer patterns; The model building module is used to build a risk prediction model framework based on the extracted transaction features, use historical bank transaction data for model training, and optimize model performance through cross-validation to obtain a trained and validated risk prediction model; The risk identification module is used to monitor the real-time transaction data of target users in the banking system in real time, use the trained risk prediction model to conduct real-time evaluation of customers' transaction behaviors, and combine the anomaly detection results of the anomaly detection model with the output of the risk prediction model to form a comprehensive risk score to identify potential risks and trigger an early warning mechanism.

[0014] As a further solution of the present invention, the risk control and early warning system based on bank flow analysis further includes: The anomaly identification module is used to build an anomaly detection model using the isolation forest to detect abnormal patterns in transaction data. The abnormal behavior is judged by the path length of isolated data points to obtain anomaly detection results. The threshold setting module is used to determine the threshold of the comprehensive risk score.

[0015] The present invention also includes a computer device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the risk control and early warning method based on bank transaction analysis.

[0016] The present invention also includes a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the risk control and early warning method based on bank flow analysis.

[0017] Compared with the existing technology, the risk control and early warning method and system based on bank flow analysis provided by the present invention has the following beneficial effects: 1. Comprehensive risk assessment is achieved: By integrating bank transaction data with multi-source cross-domain data, the present invention can comprehensively consider users' various financial activities, social behaviors, and third-party payment records. Multi-dimensional data integration helps to fully understand users' financial status and behavior patterns, and improve the accuracy of risk assessment.

[0018] 2. Enhanced anomaly detection capabilities: Using anomaly detection models such as Isolation Forest, it can promptly detect and identify abnormal patterns in transactions, helping to detect potential fraud or abnormal account activities in advance and reduce financial risks.

[0019] 3. Accurate risk prediction and dynamic real-time monitoring: This invention builds a risk prediction model based on extracted transaction features, enabling accurate predictions of future user behavior, enabling more effective risk assessment and management. It also monitors user transaction data in real time and evaluates it using a trained model. This allows for immediate risk scoring of transactions, enabling rapid response to potential risks and improving risk control efficiency.

[0020] 4. Realizes comprehensive risk scoring and adaptive early warning: The present invention forms a comprehensive risk score by weighted integration of anomaly detection scores and risk prediction scores. It can combine the advantages of different models to provide a more comprehensive risk assessment. The influence of the two models is adjusted through a weighting mechanism to ensure that the comprehensive score reflects the most realistic risk level. By setting thresholds and triggering early warning mechanisms based on the comprehensive risk scores, alerts can be issued to risk control personnel in a timely manner, effectively preventing the expansion of risk events and improving financial security.

[0021] In summary, the risk control and early warning method and system based on bank transaction analysis of the present invention can significantly improve the accuracy, timeliness and comprehensiveness of risk control, enabling financial institutions to more effectively identify, assess and manage potential risks, thereby enhancing the overall level of financial security.

[0022] These and other aspects of the present invention will become more readily apparent in the following description of the embodiments. It should be understood that the above general description and the following detailed description are merely exemplary and explanatory and are not intended to limit the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the following briefly introduces the drawings required for the exemplary embodiments or related technology descriptions. The drawings are used to provide a further understanding of the present invention and constitute part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the drawings: Figure 1 This is a flow chart of a risk control and early warning method based on bank transaction analysis according to an embodiment of the present invention.

[0024] Figure 2 This is a flowchart of generating time series data in a risk control and early warning method based on bank transaction analysis in an embodiment of the present invention.

[0025] Figure 3 The present invention provides a flowchart for forming a comprehensive risk score in a risk control and early warning method based on bank transaction analysis according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0027] In some of the processes described in the specification and claims of the present invention and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or may be executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., and do not represent the order of precedence, nor do they limit "first" and "second" to be different types.

[0028] The following will clearly and completely describe the technical solutions in the exemplary embodiments of the present invention in conjunction with the accompanying drawings of the exemplary embodiments of the present invention. Obviously, the exemplary embodiments described are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0029] Since traditional risk control methods mainly rely on historical default data and credit scoring models, these methods have problems such as poor timeliness and narrow coverage. The present invention provides a risk control and early warning method and system based on bank transaction analysis. By conducting in-depth analysis of bank transaction data, it can achieve real-time risk monitoring and early warning, effectively identify potential financial risks, and provide efficient risk management and decision support.

[0030] The technical solution of the present invention is further described below with reference to specific embodiments: See Figure 1 As shown, Figure 1 A flow chart of a risk control and early warning method based on bank flow analysis provided by the present invention. A risk control and early warning method based on bank flow analysis provided in one embodiment of the present invention includes the following steps: Step S10: collecting bank transaction data of the target user in the banking system, and fusing the collected bank transaction data with multi-source cross-domain data to generate time series data of transaction behavior in chronological order; Step S20: extract data features from the time series data to obtain transaction features including transaction frequency, transaction amount, transaction type distribution, account balance fluctuation, and inter-account transfer mode; Step S30: Based on the extracted transaction features, a risk prediction model framework is constructed, the model is trained using historical bank transaction data, and the model performance is optimized through cross-validation to obtain a trained and validated risk prediction model. Step S40: monitor the real-time transaction data of the target user in the banking system in real time, use the trained risk prediction model to conduct real-time evaluation of the customer's transaction behavior, and combine the anomaly detection results of the anomaly detection model with the output of the risk prediction model to form a comprehensive risk score to identify potential risks and trigger an early warning mechanism.

[0031] In this embodiment, the target user's bank transaction data includes: Deposit records: including deposit time, deposit amount, and deposit method (cash deposit or transfer deposit); Withdrawal records: including withdrawal time, withdrawal amount, and withdrawal method (cash withdrawal or ATM withdrawal); Transfer records: including transfer time, transfer amount, transfer account (payee / payer), transfer method (bank transfer or electronic transfer); Consumption records: including consumption time, consumption amount, consumption location, and consumption category; Account balance changes: Record each change in the account balance.

[0032] The multi-source cross-domain data includes: Credit card data: including credit card spending records, repayment records, and credit limit usage; Social media data: records of user activities on social media, such as consumer reviews and social interactions, used to assist in analyzing user behavior patterns; Third-party payment data: including transaction records of third-party payment platforms such as Alipay and WeChat Pay; E-commerce platform data: including users’ shopping records, transaction frequency, transaction amount, etc. on e-commerce platforms; Public record data: users’ public account records, credit records, judicial records, etc.

[0033] When the risk control and early warning method based on bank flow analysis of this embodiment performs data collection and fusion, the bank flow data of the target user is collected, including deposits, withdrawals, transfers, consumption records, and changes in account balances. Multi-source cross-domain data is collected, including credit card consumption records, social media activities, third-party payment records, e-commerce platform data, and public record data. These data are fused in chronological order to generate time series data of transaction behavior. When performing feature extraction, transaction features are extracted from the fused time series data, such as transaction frequency, transaction amount, transaction type distribution, account amount fluctuations, and inter-account transfer patterns. Statistics of each feature are calculated, such as the sum, mean, standard deviation, maximum and minimum values ​​of the transaction amount, changes in account balances, etc. When constructing a risk prediction model, a risk prediction model framework is constructed based on the extracted features, historical data is used for training, and cross-validation technology is applied to optimize model performance to ensure the accuracy and stability of the model. During the real-time monitoring and early warning stage, the target user's bank transaction data is monitored in real time, and the transaction behavior is evaluated using the trained risk prediction model. The results of the anomaly detection model (isolation forest) and the output of the risk prediction model are combined to calculate the comprehensive risk score. The early warning mechanism is triggered based on the comprehensive score to identify potential risks and take corresponding measures.

[0034] For example, assuming that the bank statements of target user A are analyzed to determine risk control, the steps are as follows: (1) Data collection: Bank transaction data and multi-source data. Specifically, we collected user A's deposit, withdrawal, transfer, and spending records over the past 30 days, as well as changes in account balances. Credit card spending records reveal user A's high-frequency spending behavior, social media comments reveal his spending habits, third-party payment records reveal his transaction records on Alipay and WeChat, e-commerce platform data indicates his high shopping expenditures, and public records indicate his good credit record.

[0035] (2) Feature extraction: Trading frequency: The average number of trades per week.

[0036] Transaction amount: total transaction amount and average transaction amount per month.

[0037] Transaction type distribution: the proportion of deposits, withdrawals, transfers, and consumption.

[0038] Account Balance Fluctuation: Calculate the standard deviation of the account balance.

[0039] Transfer pattern: the frequency and amount distribution of transfers between accounts.

[0040] (3) Construct a logistic regression model, use the above features for training, and optimize the model through cross-validation to ensure that it has a high prediction accuracy for user A's transaction behavior.

[0041] (4) Obtain new transaction data of user A in real time and apply the trained model to evaluate it; use the isolation forest model to detect abnormal behavior and calculate the anomaly score of each transaction; combine the anomaly score and risk prediction score to form a comprehensive risk score for user A. When the comprehensive risk score exceeds the set threshold, the system triggers an early warning to notify risk control personnel and recommends further investigation of user A's account activities.

[0042] The risk control and early warning method based on bank transaction analysis, provided by this invention, establishes a comprehensive risk assessment framework through the integration and feature extraction of multi-source data. During implementation, the model training process not only utilizes historical data but also integrates real-time data and anomaly detection technology to form a comprehensive risk score. This method can effectively identify potential financial risks, enhance the timeliness and accuracy of risk control systems, and improve financial security. By integrating various data and models, this method demonstrates strong practicality and effectiveness in handling complex financial transactions and providing early warning of potential risks.

[0043] In this embodiment, see Figure 2 As shown in the figure, the collected bank transaction data is integrated with multi-source cross-domain data to generate time series data of transaction behavior in chronological order, including the following steps: Step S101: Align bank transaction data with multi-source cross-domain data by timestamp to form a data set containing timestamp, transaction type, transaction amount and account balance information.

[0044] For example, the datasets of collected bank transaction data and multi-source data alignment are as follows:

[0045] Step S102: Convert each data record in the data set into a unified time format, and sort all transaction records according to timestamps.

[0046] Step S103: Define the time granularity for data aggregation, aggregate transaction records by time window, and generate time series data.

[0047] For example, the ISO 8601 format is used, with a time window of 1 hour, and the transaction records aggregated within each window are as follows: Time window: 2024-09-01 08:00 ▪ 09:00 ▪Transaction frequency: 3 times; Total transaction amount: 1200; Transaction amount statistics: mean = 400, standard deviation = 400, maximum = 1000, minimum = 200; Transaction type distribution: deposit = 1, purchase = 1, transfer = 1; Account balance fluctuation: Standard deviation = 100, maximum = 5000, minimum = 4800.

[0048] When extracting transaction frequency, the number of transactions within each time window is counted according to the time window to calculate the transaction frequency. When extracting transaction amount, the total transaction amount is obtained by summing up the transaction amounts within each time window. When calculating statistics, the average, standard deviation, maximum, and minimum values ​​are calculated based on the total transaction amount.

[0049] Based on the classified transaction types, the number of transactions and amount of each type are counted to determine the transaction type distribution; and the account balance change is calculated by recording the account balance after each transaction, and the standard deviation and maximum and minimum values ​​of the account balance are calculated to determine the account amount fluctuation.

[0050] In this embodiment, when constructing the framework of the risk prediction model, the extracted transaction features are normalized and the transaction features are screened using L1 regularization to obtain feature types; and a prediction model is constructed using logistic regression and training data based on the feature types and prediction tasks.

[0051] When using L1 regularization to screen transaction features, the time series data containing transaction features is cleaned, missing values ​​and outliers are processed, and the feature data is standardized so that the mean of the feature data is 0 and the variance is 1; the regularization parameters are set based on the Lasso regression model, where the strength of L1 regularization is controlled by the regularization parameter λ; the Lasso regression model is trained using the standardized time series data, and after training, the coefficient value of each feature is obtained; feature screening is performed based on the value of the feature coefficient, and features with a coefficient value of 0 are excluded.

[0052] For example, the normalized feature data is:

[0053] Lasso regression model parameter λ = 0.1; After training is completed, the characteristic coefficients are: transaction amount coefficient = 0.5; transaction frequency coefficient = 0; balance fluctuation coefficient = -0.3; Retained features: transaction amount and balance fluctuation.

[0054] In this embodiment, the risk control and early warning method based on bank flow analysis also includes using an isolation forest to establish an anomaly detection model to detect abnormal patterns in transaction data, and judging abnormal behavior by the path length of isolated data points to obtain an anomaly detection result; wherein, see Figure 3As shown, the anomaly detection results of the anomaly detection model are combined with the output of the risk prediction model to form a comprehensive risk score, including: Step S201: Use Isolation Forest to calculate anomaly scores for each transaction and standardize the anomaly detection scores.

[0055] In this step, an isolation score is calculated for each transaction and normalized to a range between 0 and 1. A higher score indicates a greater likelihood of an anomaly. For example: Transaction A: Isolation score = 0.85; Transaction B: Orphan Score = 0.15.

[0056] Step S202: Calculate the risk score for each transaction using the risk prediction model, and perform a weighted average of the standardized anomaly detection score and the risk prediction score to form a comprehensive risk score.

[0057] In this step, the anomaly score calculated by the isolation forest is normalized to a mean of 0 and a variance of 1. The normalized anomaly score and the risk prediction score are weighted averaged to form a comprehensive risk score. The weighting coefficient can be adjusted according to specific needs, for example: Comprehensive risk score = α × standardized abnormality score + (1-α) × risk score; Where α is a weighting coefficient (between 0 and 1), which is selected according to the actual situation, for example, 0.5.

[0058] Step S203: Determine a threshold for the comprehensive risk score, and identify potential risks based on the comprehensive risk score.

[0059] In this step, a threshold for the comprehensive risk score is determined based on historical data. For example, a comprehensive risk score exceeding 0.7 is considered high risk. High-risk transactions are identified by comparing the comprehensive risk score with the threshold and triggering an early warning mechanism.

[0060] For example, if there are the following transaction records and model output data:

[0061] Then, the calculated anomaly score is: Transaction A: Orphan score = 0.85 (normalized value may be between 0 and 1, e.g. 0.9); Transaction B: Orphan score = 0.15 (normalized value may be between 0 and 1, e.g. 0.1); Transaction C: Orphan score = 0.50 (after normalization the value may be between 0 and 1, e.g. 0.5).

[0062] Assuming the weighting coefficient α = 0.5, the comprehensive risk score is: Transaction A: Comprehensive risk score = 0.5 × 0.9 + 0.5 × 0.20 = 0.55; Transaction B: Comprehensive risk score = 0.5 × 0.1 + 0.5 × 0.40 = 0.25; Transaction C: Comprehensive risk score = 0.5 × 0.5 + 0.5 × 0.60 = 0.55.

[0063] Since the threshold is set to 0.5, the result of risk identification is: Transaction A: Comprehensive risk score = 0.55 > 0.5, identified as high risk.

[0064] Transaction B: Comprehensive risk score = 0.25 < 0.5, identified as low risk.

[0065] Transaction C: Comprehensive risk score = 0.55 > 0.5, identified as high risk.

[0066] This paper uses the Isolation Forest algorithm to detect abnormal patterns in bank transaction data. It then combines these anomaly detection results with the output of a risk prediction model, using a weighted average to form a comprehensive risk score. Through standardized processing, weighted calculations, and threshold judgment, this method effectively identifies potential financial risks and provides real-time risk control warnings for financial institutions.

[0067] It should be understood that, although the above is described in a certain order, these steps are not necessarily performed in sequence according to the above order. Unless there is clear explanation in this article, the execution of these steps does not have strict order restriction, and these steps can be performed in other orders. Moreover, a part of the steps of the present embodiment may include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be performed in turn or alternately with at least a portion of the steps or stages in other steps or other steps.

[0068] In one embodiment, the present invention provides a risk control and early warning system based on bank transaction analysis, which is used to implement the above-mentioned risk control and early warning method based on bank transaction analysis. The system includes: Data collection module, used to collect bank transaction data of target users in the banking system; The data fusion module is used to fuse the collected bank transaction data with multi-source cross-domain data to generate time series data of transaction behaviors in chronological order; The feature extraction module is used to extract data features from time series data to obtain transaction features including transaction frequency, transaction amount, transaction type distribution, account balance fluctuation, and inter-account transfer patterns; The model building module is used to build a risk prediction model framework based on the extracted transaction features, use historical bank transaction data for model training, and optimize model performance through cross-validation to obtain a trained and validated risk prediction model; The risk identification module is used to monitor the real-time transaction data of target users in the banking system in real time, use the trained risk prediction model to conduct real-time evaluation of customers' transaction behaviors, and combine the anomaly detection results of the anomaly detection model with the output of the risk prediction model to form a comprehensive risk score to identify potential risks and trigger an early warning mechanism.

[0069] In this embodiment, the risk control and early warning system based on bank transaction analysis also includes: The anomaly identification module is used to build an anomaly detection model using the isolation forest to detect abnormal patterns in transaction data. The abnormal behavior is judged by the path length of isolated data points to obtain anomaly detection results. The threshold setting module is used to determine the threshold of the comprehensive risk score.

[0070] In this embodiment, the risk control and early warning system based on bank flow analysis of the present invention adopts the steps of the risk control and early warning method based on bank flow analysis as described above during execution. Therefore, the operation process of the risk control and early warning system based on bank flow analysis will not be introduced in detail in this embodiment.

[0071] In summary, the bank transaction analysis-based risk control and early warning method and system of the present invention, by integrating bank transaction data with multi-source cross-domain data, comprehensively considers a user's various financial activities, social behaviors, and third-party payment records. This multi-dimensional data integration facilitates a comprehensive understanding of a user's financial status and behavioral patterns, improving the accuracy of risk assessment. Utilizing anomaly detection models such as isolation forests, it is possible to promptly detect and identify abnormal patterns in transactions, helping to proactively identify potential fraud or unusual account activity and mitigate financial risk.

[0072] This invention builds a risk prediction model based on extracted transaction features, enabling accurate predictions of future user behavior, leading to more effective risk assessment and management. It also monitors user transaction data in real time and evaluates it using a trained model, enabling instant risk scoring of transactions, enabling rapid response to potential risks and improving risk control efficiency.

[0073] The present invention forms a comprehensive risk score by weightedly integrating the anomaly detection score and the risk prediction score. It can combine the advantages of different models to provide a more comprehensive risk assessment. The influence of the two models is adjusted through a weighting mechanism to ensure that the comprehensive score reflects the most realistic risk level. By setting thresholds and triggering an early warning mechanism based on the comprehensive risk score, alarms can be issued to risk control personnel in a timely manner, effectively preventing the expansion of risk events and improving financial security.

[0074] In summary, the risk control and early warning method and system based on bank transaction analysis of the present invention can significantly improve the accuracy, timeliness and comprehensiveness of risk control, enabling financial institutions to more effectively identify, assess and manage potential risks, thereby enhancing the overall level of financial security.

[0075] In one embodiment, a computer device is also provided in an embodiment of the present invention, comprising at least one processor and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the steps of the risk control and early warning method based on bank transaction analysis.

[0076] In one embodiment, the present invention further provides a computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute the steps of the risk control and early warning method based on bank transaction analysis.

[0077] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program represented by computer instructions. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above-mentioned methods. In addition, any reference to memory, storage, database, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory.

[0078] Non-volatile memory may include read-only memory, magnetic tape, floppy disk, flash memory, or optical storage. Volatile memory may include random access memory or external cache memory. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory or dynamic random access memory.

[0079] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A risk control early warning method based on bank flow analysis, characterized in that: The method comprises the following steps: Collect bank transaction data of target users in the banking system, and fuse the collected bank transaction data with multi-source cross-domain data to generate time series data of transaction behavior in chronological order; Extract data features from time series data to obtain transaction features including transaction frequency, transaction amount, transaction type distribution, account amount fluctuation, and inter-account transfer mode; Based on the extracted transaction features, the framework of the risk prediction model is constructed, the historical bank flow data is used for model training, and the model performance is optimized through cross-validation to obtain a trained and verified risk prediction model; Monitor the real-time transaction data of target users in the banking system in real time, use the trained risk prediction model to conduct real-time evaluation of customers' transaction behaviors, and combine the anomaly detection results of the anomaly detection model with the output of the risk prediction model to form a comprehensive risk score to identify potential risks and trigger an early warning mechanism.

2. The risk control and early warning method based on bank flow analysis as claimed in claim 1, characterized in that: The target user's bank transaction data includes deposit records, withdrawal records, transfer records, consumption records and account balance changes.

3. The risk control and early warning method based on bank flow analysis as claimed in claim 2, characterized in that: The multi-source cross-domain data includes credit card data, social media data, third-party payment data, e-commerce platform data and public record data.

4. The risk control and early warning method based on bank flow analysis as claimed in claim 3, characterized in that: When extracting transaction frequency, the number of transactions in each time window is counted according to the time window to calculate the transaction frequency; when extracting transaction amount, the sum of the transaction amount in each time window is calculated to obtain the total transaction amount. When calculating statistics, the average, standard deviation, maximum and minimum values ​​are calculated based on the total transaction amount.

5. The risk control and early warning method based on bank flow analysis as claimed in claim 4, characterized in that: According to the classified transaction types, the number of transactions and amount of each type are counted to determine the transaction type distribution; and the account balance change is calculated by recording the account balance after each transaction, and the standard deviation and maximum and minimum values ​​of the account balance are calculated to determine the account amount fluctuation.

6. The risk control and early warning method based on bank flow analysis as claimed in claim 5, characterized in that: When constructing the framework of the risk prediction model, the extracted transaction features are normalized and the transaction features are screened using L1 regularization to obtain the feature types; Build a prediction model using logistic regression and training data based on the feature type and prediction task.

7. The risk control and early warning method based on bank flow analysis as claimed in claim 6, characterized in that: When using L1 regularization to screen transaction features, the time series data containing transaction features is cleaned, missing values ​​and outliers are processed, and the feature data is standardized so that the mean of the feature data is 0 and the variance is 1; the regularization parameters are set based on the Lasso regression model, where the strength of L1 regularization is controlled by the regularization parameter λ; the Lasso regression model is trained using the standardized time series data, and after the training is completed, the coefficient value of each feature is obtained; feature screening is performed based on the value of the feature coefficient, and features with a coefficient value of 0 are excluded.

8. The risk control and early warning method based on bank flow analysis as claimed in claim 1, characterized in that: The risk control and early warning method based on bank flow analysis also includes using an isolation forest to establish an anomaly detection model to detect abnormal patterns in transaction data, judging abnormal behavior by the path length of isolated data points, and obtaining anomaly detection results; wherein, the anomaly detection results based on the anomaly detection model are combined with the output of the risk prediction model to form a comprehensive risk score, including: Anomaly detection scores were normalized by calculating anomaly scores for each transaction using Isolation Forest. Use the risk prediction model to calculate the risk score for each transaction, and take the weighted average of the standardized anomaly detection score and the risk prediction score to form a comprehensive risk score; Determine the threshold of the comprehensive risk score and identify potential risks based on the comprehensive risk score.

9. A risk control early warning system based on bank flow analysis, characterized in that: The system is used to execute the steps of the risk control early warning method based on bank flow analysis as described in any one of claims 1 to 8, and the system includes: Data collection module, used to collect bank transaction data of target users in the banking system; The data fusion module is used to fuse the collected bank flow data with multi-source cross-domain data to generate time series data of transaction behavior in chronological order; The feature extraction module is used to extract data features from time series data to obtain transaction features including transaction frequency, transaction amount, transaction type distribution, account amount fluctuation, and inter-account transfer mode; The model building module is used to build the risk prediction model framework based on the extracted transaction features, use the historical bank flow data to train the model, and optimize the model performance through cross-validation to obtain a trained and verified risk prediction model; The risk identification module is used to monitor the real-time transaction data of target users in the banking system in real time, use the trained risk prediction model to conduct real-time evaluation of the customer's transaction behavior, and combine the anomaly detection results of the anomaly detection model with the output of the risk prediction model to form a comprehensive risk score to identify potential risks and trigger an early warning mechanism.

10. The risk control and early warning system based on bank flow analysis as claimed in claim 9, characterized in that: The risk control and early warning system based on bank flow analysis also includes: The anomaly identification module is used to establish an anomaly detection model using the isolation forest to detect abnormal patterns in transaction data, and to determine abnormal behavior through the path length of isolated data points to obtain anomaly detection results; The threshold setting module is used to determine the threshold of the comprehensive risk score.

Images