Transaction early warning processing method and device and electronic equipment

Abstract

The invention discloses a transaction early warning processing method, a transaction early warning processing device and electronic equipment. Relates to the technical field of electronic information. Determining a target transaction rule hit by the target transaction data from the plurality of transaction rules, and determining a target transaction feature and a target score threshold corresponding to the target transaction rule; extracting target feature data corresponding to the target transaction features from the target transaction data; based on the target feature data, calculating an early warning score corresponding to the target transaction data; and determining a transaction early warning result of the target transaction data according to the early warning score corresponding to the target transaction data and the target score threshold. The technical problems that transaction early warning methods in related technologies mainly comprise a rule-based abnormal transaction recognition method and a model prediction-based abnormal transaction recognition method, but the rule-based abnormal transaction recognition method is low in accuracy and the model prediction-based abnormal transaction recognition method is high in resource consumption are solved.

Description

Technical Field

[0001] The present invention relates to the field of electronic information technology, and in particular to a transaction early warning processing method, device and electronic equipment. Background Art

[0002] When conducting risk assessments for transaction businesses (such as payment businesses), related technologies are mainly divided into two methods: one is that risk control strategy personnel will set many attribute-based statistical indicators or 0-1 indicators, and then combine them to form multiple policy rules. These rules that are deployed to the real-time layer using a union will warn of a large number of real-time transactions, which poses a challenge to the accuracy and recall rate of rule warnings. The other is model-based risk assessment of payment businesses. From a model perspective, the types of abnormal transactions in payment businesses have dynamic characteristics. Using a single model for prediction will make the results too mediocre, and distinguishing different types of abnormal transactions and deploying multiple real-time models will pose a great challenge to operating resources.

[0003] It can be seen that the transaction warning methods in the relevant technology mainly include rule-based abnormal transaction identification methods and model prediction-based abnormal transaction identification methods. However, the rule-based abnormal transaction identification method has low accuracy, and the model prediction-based abnormal transaction identification method consumes a lot of resources.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a transaction warning processing method, device and electronic device to at least solve the technical problems that the transaction warning method in the related art mainly includes a rule-based abnormal transaction identification method and a model prediction-based abnormal transaction identification method, but the rule-based abnormal transaction identification method has low accuracy and the model prediction-based abnormal transaction identification method has high resource consumption.

[0006] According to one aspect of an embodiment of the present invention, a transaction warning processing method is provided, comprising: acquiring target transaction data; determining a target transaction rule hit by the target transaction data from multiple transaction rules, and determining a target transaction feature corresponding to the target transaction rule, and a target scoring threshold corresponding to the target transaction rule, wherein the multiple transaction rules correspond to different transaction features and scoring thresholds; extracting target feature data corresponding to the target transaction feature from the target transaction data; calculating a warning score corresponding to the target transaction data based on the target feature data; determining a transaction warning result of the target transaction data according to the warning score corresponding to the target transaction data and the target scoring threshold, wherein the transaction warning result is at least used to indicate whether the target transaction data has an abnormality.

[0007] According to another aspect of an embodiment of the present invention, a transaction warning processing device is also provided, including: a data acquisition module, used to acquire target transaction data; a rule determination module, used to determine the target transaction rule hit by the target transaction data from multiple transaction rules, and determine the target transaction feature corresponding to the target transaction rule, and the target scoring threshold corresponding to the target transaction rule, wherein the multiple transaction rules correspond to different transaction features and scoring thresholds; a feature extraction module, used to extract target feature data corresponding to the target transaction feature from the target transaction data; a scoring module, used to calculate the warning score corresponding to the target transaction data based on the target feature data; an abnormality identification module, used to determine the transaction warning result of the target transaction data according to the warning score corresponding to the target transaction data and the target scoring threshold, wherein the transaction warning result is at least used to indicate whether the target transaction data has an abnormality.

[0008] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the transaction warning processing methods described.

[0009] In an embodiment of the present invention, target transaction data is obtained; a target transaction rule hit by the target transaction data is determined from multiple transaction rules, and a target transaction feature corresponding to the target transaction rule and a target scoring threshold corresponding to the target transaction rule are determined, wherein the multiple transaction rules correspond to different transaction features and scoring thresholds; target feature data corresponding to the target transaction feature is extracted from the target transaction data; a warning score corresponding to the target transaction data is calculated based on the target feature data; a transaction warning result of the target transaction data is determined according to the warning score corresponding to the target transaction data and the target scoring threshold, wherein the transaction warning result is at least used to indicate whether the target transaction data is abnormal, thereby achieving the purpose of setting corresponding transaction features and scoring thresholds for multiple transaction rules respectively, and determining whether the transaction data is abnormal in a targeted manner with a smaller number of indicators, thereby achieving the technical effect of improving the accuracy and efficiency of abnormal transaction identification while reducing resource consumption, thereby solving the technical problem that the transaction warning method in the related art mainly includes a rule-based abnormal transaction identification method and a model-prediction-based abnormal transaction identification method, but the rule-based abnormal transaction identification method has low accuracy and the model-prediction-based abnormal transaction identification method has high resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0011] Figure 1 is a flow chart of a transaction warning processing method according to an embodiment of the present invention;

[0012] Figure 2 It is a schematic diagram of a transaction warning processing device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0013] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0014] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0015] According to an embodiment of the present invention, a method embodiment of transaction warning processing is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0016] Figure 1 is a flow chart of a transaction warning processing method according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0017] Step S102, obtaining target transaction data;

[0018] Optionally, the target transaction data may be relevant data obtained by executing a transaction business through an account, wherein the transaction business may be, but is not limited to, a payment business. The target transaction data includes feature values ​​corresponding to a plurality of initial features associated with the transaction business. The target transaction data may be one or more pieces.

[0019] Step S104, determining a target transaction rule hit by the target transaction data from the multiple transaction rules, and determining a target transaction feature corresponding to the target transaction rule, and a target scoring threshold corresponding to the target transaction rule, wherein the multiple transaction rules correspond to different transaction features and scoring thresholds;

[0020] Optionally, since there are usually multiple types of transaction businesses, the transaction rules applicable to different transaction business types may be different. Based on this, multiple transaction rules can be set according to different transaction types, thereby improving the applicability of transaction rules. In addition, considering that different transaction rules have different transaction characteristics, and the high computational pressure of using full data to identify transaction data anomalies, the initial features with a high correlation with the transaction rules are pre-screened from multiple initial features associated with the transaction business as the transaction features corresponding to each transaction rule, thereby reducing the computational pressure of transaction data anomaly identification and improving the efficiency of transaction data anomaly identification.

[0021] In an optional embodiment, before determining the target transaction rule hit by the target transaction data from multiple transaction rules, and determining the target transaction feature corresponding to the target transaction rule, and the target scoring threshold corresponding to the target transaction rule, the method further includes: obtaining the transaction feature corresponding to any transaction rule among the multiple transaction rules in the following manner: obtaining multiple initial transaction data corresponding to any transaction rule, and transaction tags corresponding to the multiple initial transaction data, each of the multiple initial transaction data includes feature values ​​corresponding to multiple initial features, and the transaction tag is used to indicate whether the corresponding initial transaction data has an abnormality; based on the multiple initial transaction data and the transaction tags corresponding to the multiple initial transaction data, using an extreme gradient boosting method to determine the scoring values ​​corresponding to the multiple initial features, wherein the scoring value is used to indicate the importance of the corresponding initial feature; sorting the multiple initial features in descending order according to the scoring value to obtain a sorting result; based on the sorting result, determining the initial feature ranked in the front predetermined digit among the multiple initial features as the transaction feature corresponding to any transaction rule; using the method of obtaining the transaction feature corresponding to any transaction rule to obtain the transaction features corresponding to the multiple transaction rules.

[0022] Optionally, before executing step S104, it is necessary to determine the transaction features and scoring thresholds corresponding to multiple transaction rules. For each of the multiple transaction rules, obtain multiple initial transaction data and corresponding transaction labels that hit the transaction rule; use the extreme gradient boosting method to model and train the initial transaction data, determine the scoring value corresponding to each initial feature, and use it to indicate the importance of the feature; further sort the initial features in descending order according to the scoring value, and determine the initial features ranked in the first predetermined digit as the transaction features corresponding to the transaction rule to help identify abnormal transactions. In the above manner, determining the transaction features corresponding to each transaction rule by the initial features ranked in the first predetermined digit helps to understand which features are the most critical, so as to better identify abnormal transactions; by obtaining the transaction features corresponding to each transaction rule, it can help to identify and understand abnormal transactions in transaction data, and improve the accuracy and efficiency of anomaly detection; through the scoring value and sorting results, it is possible to understand the importance of each feature and obtain the transaction feature with the greatest correlation with the corresponding transaction rule. While reducing the amount of data usage and calculation in identifying transaction anomalies, the transaction rule features are retained.

[0023] Optionally, the data before and after the warning of the transaction rules and the label data can be obtained, the corresponding detailed data can be obtained, and a data wide table can be constructed. Further, the data wide table can be preprocessed to develop full features and construct a feature wide table. Among them, the data before and after the warning refers to the relevant transaction data collected before and after the triggering of the rule warning, such as user behavior data, transaction data, etc. Label data refers to the label corresponding to each data sample, such as whether there is a transaction anomaly. When constructing a data wide table, the data before and after the rule warning and the label data need to be integrated. The feature wide table refers to a data table containing multiple feature columns generated after the original data is preprocessed and feature engineering is processed. In the process of preprocessing the data wide table, the original data can be cleaned, missing value processing, feature extraction, feature encoding and other operations can be performed, and finally a data table containing various features can be constructed. The transaction data included in the feature wide table is further divided according to multiple transaction rules to obtain transaction data sets corresponding to the multiple transaction data, wherein the transaction data set includes multiple initial transaction data that hit the corresponding transaction rules.

[0024] In an optional embodiment, before determining the initial features ranked in the front of a predetermined number of places among the multiple initial features as the transaction features corresponding to any transaction rule based on the sorting result, the method further includes: determining the target screening condition as:

[0025]

[0026] Among them, fa represents the scoring value corresponding to the initial feature ranked at the a-th position in the sorting result; fb represents the scoring value corresponding to the initial feature ranked at the b-th position in the sorting result, where a < b and both a and b are positive integers; fb-1 represents the scoring value corresponding to the initial feature ranked at the (b - 1)-th position in the sorting result; the value b - 1 under the condition of meeting the target screening condition is determined as the predetermined position number.

[0027] In the above method, the target screening condition is determined as fb / fa > 2*(fb-1) / fb. Through this condition, features that meet specific conditions in the scoring value sorting result can be screened out, that is, the scoring value corresponding to feature fb has a certain increase relative to feature fa; based on the target screening condition, the predetermined position number b - 1 is determined. That is, the feature at a specific position in the sorting result can help identify features with faster-growing scoring values and improve the effect of feature screening. Through the target screening condition, features with faster-growing scoring values in the sorting result can be screened out. These features may have an important impact on the prediction ability and interpretability of abnormal transactions, and further optimize the feature selection process. Determining the predetermined position number b - 1 can help determine a specific position in the sorting result, thereby better understanding the importance and impact of features and providing more information for model interpretation and feature analysis.

[0028] In an alternative embodiment, before determining the target transaction rule hit by the target transaction data from multiple transaction rules, determining the target transaction features corresponding to the target transaction rule, and the target scoring threshold corresponding to the target transaction rule, the method further includes: obtaining the scoring threshold corresponding to any one of the multiple transaction rules in the following manner: extracting transaction data that matches the transaction features corresponding to any one of the multiple transaction rules from multiple initial features to obtain multiple first transaction data; based on the multiple first transaction data, constructing the empirical cumulative distribution function of the transaction features corresponding to any one of the transaction rules, where the empirical cumulative distribution function is used to indicate the eigenvalue distribution of the transaction features corresponding to any one of the transaction rules, and the transaction features corresponding to any one of the transaction rules are multiple; based on the multiple first transaction data and the empirical cumulative distribution function of the transaction features corresponding to any one of the transaction rules, determining the early warning scores corresponding to the multiple first transaction data respectively; based on the early warning scores corresponding to the multiple first transaction data respectively, determining the scoring threshold corresponding to any one of the transaction rules; using the method of obtaining the scoring threshold corresponding to any one of the transaction rules to obtain the scoring thresholds corresponding to the multiple transaction rules respectively.

[0029] It can be understood that by extracting transaction data that matches the transaction features corresponding to each transaction rule, transaction feature data with a high correlation with the transaction rules can be obtained, which helps to reduce the data demand in the abnormal transaction identification process, thereby reducing the data processing pressure. Constructing the empirical cumulative distribution function of the transaction features corresponding to each transaction rule can help understand the distribution of the feature value and provide a basis for setting the scoring threshold. Determine the early warning score corresponding to each first transaction data, and based on the empirical cumulative distribution function and the actual transaction data, calculate the early warning score value to evaluate the abnormality of the transaction data. Determine the scoring threshold corresponding to each transaction rule, and determine the scoring threshold through the early warning score to determine whether the transaction data is abnormal. In the above method, by calculating the early warning score and setting the scoring threshold, the scoring threshold corresponding to each transaction rule can be determined to determine whether the transaction data complies with the rule. After obtaining the scoring thresholds corresponding to multiple transaction rules, they can be applied to the actual transaction data to help identify abnormal transactions and formulate early warning strategies. By constructing the empirical cumulative distribution function and calculating the early warning score, an early warning model for each transaction rule can be established to improve the accuracy and efficiency of anomaly detection.

[0030] In an optional embodiment, the empirical cumulative distribution function includes a left-tail empirical cumulative distribution function and a right-tail empirical cumulative distribution function, and based on multiple first transaction data and the empirical cumulative distribution function of the transaction feature corresponding to any transaction rule, the warning scores corresponding to the multiple first transaction data are determined, including: determining the skewness coefficient corresponding to the transaction feature corresponding to any transaction rule, wherein the skewness coefficient is used to indicate the degree of deviation of the characteristic value of the corresponding transaction feature; based on the multiple first transaction data, the skewness coefficient of the transaction feature corresponding to any transaction rule, the left-tail empirical cumulative distribution function and the right-tail empirical cumulative distribution function, the warning scores corresponding to the multiple first transaction data are determined.

[0031] Optionally, the skewness coefficient of the transaction feature corresponding to each transaction rule is determined to measure the degree of deviation of the distribution of the feature value and help understand the distribution of the feature data. Based on multiple first transaction data, the skewness coefficient, left-tail empirical cumulative distribution function and right-tail empirical cumulative distribution function of the transaction feature corresponding to each transaction rule are calculated to determine the early warning score corresponding to each transaction data. In the above method, the degree of deviation of the transaction feature is determined by the skewness coefficient, which helps to understand the distribution of the feature data, identify the skewness of the data, and provide a reference for subsequent data analysis and modeling. The early warning score is calculated based on the skewness coefficient and the empirical cumulative distribution function. Each transaction data can be scored according to the degree of deviation and distribution of the feature, which is used to identify abnormal transactions and formulate early warning strategies. Through the above operations, the degree of deviation and distribution of the transaction features can be comprehensively considered to calculate the early warning score of each transaction data, which helps to identify and monitor abnormal transactions and improve the effectiveness and accuracy of transaction risk management.

[0032] In an optional embodiment, based on the plurality of first transaction data, the skewness coefficient, the left-tail empirical cumulative distribution function, and the right-tail empirical cumulative distribution function of the transaction characteristics corresponding to any transaction rule, determining the early warning scores respectively corresponding to the plurality of first transaction data includes: obtaining the early warning score of any one of the plurality of first transaction data by:

[0033]

[0034] Among them, O all (x i ) represents the early warning score of any transaction data; j = 1, 2, ..., d represents any one of the multiple transaction features corresponding to any transaction rule; d represents the total number of multiple transaction features corresponding to any transaction rule; γ j It represents the skewness coefficient corresponding to the jth transaction feature among multiple transaction features corresponding to any transaction rule; represents the left-tail empirical cumulative distribution function corresponding to the j-th transaction feature, represents the right-tailed empirical cumulative distribution function corresponding to the j-th transaction feature, represents the feature value corresponding to the jth transaction feature in any transaction data; I{γ j <0} means γ j <0, the value is 1, otherwise it is 0; I{γ j ≥0} means γ j When ≥0, the value is 1, otherwise it is 0; the warning scores corresponding to the multiple first transaction data are obtained by obtaining the warning score of any transaction data.

[0035] By calculating the early warning score formula, a warning score can be assigned to each transaction data to evaluate the abnormality of the transaction data; the above early warning score formula takes into account the skewness coefficient and the left and right tail empirical cumulative distribution functions of the transaction characteristics, and comprehensively analyzes the distribution and offset of the transaction characteristics to help determine the risk level of the transaction data. According to the given abnormal formula, combined with the skewness coefficient and the empirical cumulative distribution function of the transaction characteristics, the early warning score of each transaction data is calculated to evaluate the abnormality of the transaction data. By comprehensively considering the skewness and distribution of transaction characteristics, the early warning score can more comprehensively evaluate the abnormality of transaction data and improve the accuracy of identifying abnormal transactions. Through the above operations, a warning score can be assigned to each transaction data. According to the scoring results, abnormal transactions can be identified and monitored, which helps to improve the effectiveness and accuracy of transaction risk management.

[0036] In an optional embodiment, based on the warning scores corresponding to multiple first transaction data, respectively, determining the score threshold corresponding to any transaction rule includes: dividing the warning scores corresponding to the multiple first transaction data into K parts to obtain K test sets, and training sets corresponding to the K test sets, respectively, wherein the training set includes the warning scores corresponding to the multiple first transaction data, and the warning scores corresponding to other transaction data except the corresponding test sets; based on the K test sets and the training sets corresponding to the K test sets, a K-fold cross-validation method is used to obtain the score threshold corresponding to any transaction rule.

[0037] Optionally, the warning scores of multiple first transaction data are divided into K parts for cross-validation, and the data is divided into a training set and a test set to verify the generalization ability and stability of the model. Based on the K-fold cross-validation method, using K training sets and corresponding test sets, by repeatedly training the model and evaluating the performance, the scoring threshold corresponding to each transaction rule is obtained, which is used to judge the abnormal situation of the transaction data. In the above method, the scoring threshold corresponding to each transaction rule can be obtained through the K-fold cross-validation method, so that the performance of the model on different data sets is more stable and reliable. Through cross-validation, the performance of the model on unseen data can be effectively evaluated, and the generalization ability and prediction accuracy of the model can be improved. Through the above operations, the K-fold cross-validation method can be used to determine the scoring threshold corresponding to each transaction rule, so as to more accurately identify and monitor abnormal transactions and improve the effectiveness and reliability of transaction risk management.

[0038] Step S106, extracting target feature data corresponding to the target transaction feature from the target transaction data;

[0039] It can be understood that the target transaction data includes characteristic values ​​corresponding to multiple initial features, and the data volume is large. Based on this, the target feature data corresponding to the target transaction features are extracted from the target transaction data to participate in the subsequent anomaly identification of the target transaction data, thereby simplifying the data demand and improving the efficiency of transaction anomaly identification.

[0040] Step S108, calculating the warning score corresponding to the target transaction data based on the target feature data;

[0041] Optionally, the warning score of the target transaction data may be obtained by obtaining the warning score of any one of the multiple first transaction data. The specific calculation method will not be described in detail here.

[0042] Step S110, determining a transaction warning result of the target transaction data according to the warning score corresponding to the target transaction data and the target score threshold, wherein the transaction warning result is at least used to indicate whether the target transaction data has an abnormality.

[0043] Optionally, whether the target transaction data is abnormal can be determined by comparing the warning score corresponding to the target transaction data with the numerical value of the target score threshold.

[0044] In an optional embodiment, a transaction warning result of the target transaction data is determined based on the warning score corresponding to the target transaction data and the target score threshold, including: detecting whether the warning score corresponding to the target transaction data is greater than the target score threshold; when the warning score corresponding to the target transaction data is greater than the target score threshold, determining that the transaction warning result is that there is an abnormality in the target transaction data; when the warning score corresponding to the target transaction data is less than or equal to the target score threshold, determining that the transaction warning result is that there is no abnormality in the target transaction data.

[0045] Optionally, the warning score is proportional to the degree of transaction risk. The larger the warning score, the more likely the transaction is abnormal; otherwise, the possibility of abnormality is small. The target score threshold is the transaction warning threshold under the target transaction rule. If the warning score corresponding to the target transaction data is greater than the target score threshold, it indicates that the warning score corresponding to the target transaction data exceeds the transaction warning threshold, and there is a risk of abnormal transaction; otherwise, it indicates that the warning score corresponding to the target transaction data does not exceed the transaction warning threshold, and there is no risk of abnormal transaction.

[0046] Through the above steps S102 to S110, the purpose of setting corresponding transaction features and scoring thresholds for multiple transaction rules can be achieved, and whether there are abnormalities in the transaction data can be determined in a targeted manner with fewer indicators, thereby achieving the technical effect of improving the accuracy and efficiency of abnormal transaction identification while reducing resource consumption, thereby solving the technical problems that the transaction warning methods in the related technologies mainly include rule-based abnormal transaction identification methods and model prediction-based abnormal transaction identification methods, but the rule-based abnormal transaction identification methods have low accuracy and the model prediction-based abnormal transaction identification methods have high resource consumption.

[0047] Based on the above embodiment and optional embodiment, the present invention proposes an optional implementation of a transaction warning processing method, the method comprising:

[0048] S1: Obtain the data before and after the rule warning and the label data, obtain the corresponding detailed data, and build a data wide table, including:

[0049] S1.1: Obtain label data before and after rule warning from business personnel, match label data from multiple business data tables, and create a data wide table, in which whether the transaction data is abnormal can be used as a data label. The constructed data wide table includes N original transaction data (N is an integer greater than 1), and the data labels corresponding to the N original transaction data.

[0050] S1.2: Transfer the data wide table to the target server.

[0051] S2: Preprocess the wide table of data in step S1, develop full features, and construct a feature wide table. The feature wide table refers to a data table containing multiple feature columns generated after preprocessing and feature engineering the original transaction data, including:

[0052] S2.1: Preprocess the data wide table in step S1, fill in null values, and remove duplicates.

[0053] S2.2: Develop features according to the unique primary key at the transaction level (such as the transaction number), build a feature wide table, and finally attach the rule number and warning time fields. The feature wide table contains the feature values ​​corresponding to the multiple initial features extracted from each piece of original transaction data. Feature development includes feature development based on the Hive cluster and feature development based on the server Python environment.

[0054] S3: For the feature wide table in step S2, the data set is divided according to different rules. Feature selection is performed on black and white samples under different rules, where black samples refer to abnormal samples, i.e. abnormal transaction data; and white samples refer to normal samples, i.e. normal transaction data, including:

[0055] S3.1: Assume that the rule set includes multiple transaction rules: {Rule1, Rule2, ..., Rule n}, distinguish the feature width table according to the rule number, and get the following:

[0056] [Rule1, train1, test1]; [Rule2, train2, test2]……[Rule n , train n , test n ].

[0057] Where n represents the total number of rules included in the rule set. k (k=1,2,…,n) represents any trading rule in the rule set; train k (k=1,2,…,n) represents the training set corresponding to any trading rule, test k (k=1,2,…,n) represents the test set corresponding to any transaction rule.

[0058] S3.2: The total feature dimension is m. Use the Extreme Gradient Boosting (XGBoost) method to select important features for each rule and set the parameter parmas = {

[0059] Booster = gbtree

[0060] Objective=binary:logistic

[0061] Num_class=2

[0062] Gamma = 0

[0063] Max_depth=6

[0064] Lambda=

[0065] Subsample = 0.62

[0066] colsample_bytree=0.54

[0067] Silent=0

[0068] eta=0.09

[0069] Seed = 128};

[0070] Among them, Booster is used to specify the boosting method used, which is set to gbtree here, indicating the use of a tree-based boosting method; Objective is used to specify the type of optimization problem, which is set to binary:logistic here, indicating logistic regression for a binary classification problem; Num_class is used to specify the number of categories for classification, which is set to 2 here, indicating a binary classification problem; Gamma is used to control the minimum loss function drop value required when a node is split, and the default value is 0, indicating no splitting; Max_depth represents the maximum depth of each tree, which is set to 6 here to limit the growth of the tree; Lambda represents the weight of the L2 regularization term, which is used to control the complexity of the model; Subsample is used to determine the proportion of subsamples used when training each tree to avoid overfitting; Colsample_bytree is used to determine the proportion of features used when training each tree to avoid overfitting; Silent is used to indicate whether to print information about the training process, and 0 indicates printing; eta represents the learning rate, which is used to control the step size of each iteration; Seed represents the random seed, which is used to control randomness and ensure the reproducibility of the experimental results.

[0071] Use the training function xgb.train and prediction function xgb.predict based on the extreme gradient boosting XGBoost model, as well as the accuracy determination function accuary_score to train n rules. Take the top x features under each rule, where x is defined as follows:

[0072] 1. Arrange the features in descending order of importance;

[0073] 2. The ratio of the second feature to the first feature: And so on;

[0074] 3. Until Select the features before b-1, recorded as x;

[0075] Then the set in step S3.1 is recorded as:

[0076] [Rule1, train1, test1, feature x1 ]; [Rule2, train2, test2, feature x2 ]……[Rule n , train n , test n , feature xn ]. Among them, feature xk (k=1,2,…,n) represents the topxk features extracted from any transaction rule in the rule set.

[0077] S4: Calculate the empirical cumulative distribution function (ECDF), calculate the left-tail ECDF and right-tail ECDF, calculate the skewness, and finally summarize the final score value, including:

[0078] S4.1: Construct an empirical distribution function (ECDF) for each transaction feature dimension, assuming that one dimension of the feature is: X = {X m}∈R m×d , then its empirical distribution function is:

[0079]

[0080] Where X represents the feature matrix corresponding to any transaction rule in the rule set, where each row represents a sample (i.e., a transaction data), and each column represents a transaction feature; X = {X m}∈R m×d represents a feature matrix containing m samples and d transaction features, where d represents the feature dimension of any transaction rule; X i represents the value of the i-th sample in the feature matrix; I{X i ≤x} represents an exponential function, when X i The value is 1 when ≤x, otherwise it is 0; F m (x) represents the proportion of observations less than or equal to x, which is the probability distribution function estimated using sample data.

[0081] For each trading rule in the rule set, we can get the empirical distribution function that characterizes all their trading characteristics, as follows:

[0082]

[0083] The left-tail empirical cumulative distribution function left-ECDF and the right-tail empirical cumulative distribution function right-ECDF are calculated for each feature dimension of j∈x as follows:

[0084]

[0085]

[0086] The skewness coefficient is calculated for each feature dimension of j∈x as follows:

[0087]

[0088] Among them, γ j Represents the skewness coefficient on the jth dimension, which is used to describe the degree of skewness of the data distribution on this dimension; Represents the value of the i-th sample in the feature matrix in the j-th dimension; Represents the mean of all sample values ​​in the j-th dimension of the feature matrix.

[0089] S4.2: Summarize the tail probabilities of each rule data set in step S4.1, where the tail probability corresponding to each rule is O all (x i ) is obtained as follows:

[0090]

[0091] S4.3: O in step S4.2 all (x i ) is the final score value of each sample, i.e., each transaction data.

[0092] S5: Used for ECDF tuning to maximize accuracy. Deployed to real-time links, including:

[0093] S5.1: After processing in step S4, the score value of the sample under each transaction rule is obtained as follows:

[0094] Rule 1: [O all (x 11 ), O all (x 21 ), ..., O all (x i1 )];

[0095] Rule 2: [O all (x 12 ), O all (x 22 ), ..., O all (x i2 )];

[0096] …

[0097] Rule n :[O all (x 1n ), O all (x 2n ), ..., O all (x in )].

[0098] Set the fractional stage function table as shown in Table 1 below:

[0099] Table 1 Truncated relations

[0100] direction Number of black samples Number of white samples Score <= gap1 B1 W1 Score <= gap2 B2 W2 Score <= gap3 B3 W3 …… score <= gap_min Bn W

[0101] gap1, gap1,…, gap_min in Table 1 represent different score thresholds for observation by strategists.

[0102] S5.2: Set the score stage strategy: Perform K-fold cross validation, re-divide the data set for each rule, and find the best threshold gap so that the number of black samples above the gap is the minimum and the number of white samples is the maximum. Define the objective function Obj as follows:

[0103] Obj=best_gap(if O>=gap,get min(label0)and get max(label))

[0104] Among them, Obj represents the objective function, that is, the goal to be optimized, by adjusting the threshold gap to minimize the number of black samples and maximize the number of white samples; best_gap represents the best threshold, that is, the threshold above the gap with the least number of black samples and the most number of white samples; O represents the metric, that is, the model evaluation metric or other measurement metric used to evaluate the performance of the data set; gap represents the threshold, which is an adjustment parameter used to divide the data set into two parts; label0 represents the set of samples with label 0, that is, white samples; label1 represents the set of samples with label 1, that is, black samples.

[0105] Among them: the black sample accuracy is set globally >= 0.9. After multiple rounds of verification, the best O value is obtained and recorded as the final threshold. The thresholds under the final n rules are:

[0106] Rule 1: [O best (x1)];

[0107] Rule 2: [O best (x2)];

[0108] …

[0109] Rule n :[O best (x n )].

[0110] O best (x k )(k=1,2,…,n) represents the optimal scoring threshold of any transaction rule in the rule set.

[0111] S5.3: Encapsulate the calculation logic in step S4 into a Predictive Model Markup Language (PMML) file and hand it over to the technical staff to configure the real-time link threshold, and use the final threshold of step S5.2 as the actual usage score threshold for each rule. The specific plan is as follows:

[0112] 1) Calculate the score value for each transaction data entered in real time;

[0113] 2) Real-time warning of transactions for each trading rule;

[0114] 3) Match the transaction in step 2) with the corresponding score in step 1) using the predetermined threshold. If the score is less than the threshold, it will be pushed into the warning pool for verification by the strategy personnel.

[0115] It should be noted that this embodiment, as a supplement to real-time rule warning, uses copula to fit the score of each transaction of the rule warning, filters normal transactions, reduces the total amount of warnings, and can improve the accuracy of warnings. The existing optimization methods of rule warnings are all optimized in the direction of factor configuration. It does not involve parameter optimization and model training stages, and can directly fit the scores of transactions, shorten the running time of the entire process, and save training resources. The threshold setting in this embodiment filters normal transactions and can reduce the cost of manual verification. It also has practical significance and promotion and application value for subsequent feature engineering based on statistical methods.

[0116] Based on the above embodiment and optional embodiment, the present invention proposes an optional implementation of a transaction warning processing method, the method comprising:

[0117] S21: The real-time rules used by the strategists total 53 groups. All the data that were warned in the predetermined historical period were selected, totaling 60,000 transaction data. The strategists provided labels, of which 52% of the transactions were abnormal transactions, marked as 1, and the rest were marked as 0. Then the transaction dimension detailed data was obtained from the business data.

[0118] S22: Preprocess and clean the data in step S21, develop a total of 117 features, and construct a feature wide table, the main body of which is the transaction number of the transaction dimension. The set is (transaction number, feature, rule number, label).

[0119] S23: Divide the data set into 53 parts according to 53 groups of rules, and split each data set into a training set and a test set at a ratio of 1:1. Then perform 53 feature selections, using the methods of the above steps S3.2 and S3.3 to obtain 53 groups of features.

[0120] S24: Calculate the empirical distribution function value for each set of training sets of rules respectively; then calculate the left-ECDF, right-ECDF and skewness of each dimension feature. Then use the method in the above step S4.2 to accumulate the empirical value of each dimension of each transaction number. Obtain the score value of each transaction.

[0121] S25: Then build a phase relationship table for the test set, set the score phase strategy and optimal goal, and get the score value of each group of rules. Example: In rule number 1, after testing, among the samples with a score <= -103.21, the accuracy of black samples reached 0.87, and the overall number was 24% of the original test set. Finally, the score values ​​of 53 groups of rules were determined. The above process was packaged into a PMML file and provided to technicians to configure a real-time link. Then transfer to the production link test and push the data to the strategy personnel for inspection.

[0122] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set up between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0123] In this embodiment, a transaction early warning processing device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the terms "module" and "device" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0124] According to an embodiment of the present invention, there is also provided an embodiment of a device for implementing the above transaction warning processing method. Figure 2 is a structural diagram of a transaction warning processing device according to an embodiment of the present invention. Figure 2 As shown, the transaction warning processing device includes: a data acquisition module 300, a rule determination module 302, a feature extraction module 304, a scoring module 306, and an anomaly identification module 308, wherein:

[0125] A data acquisition module 300 is used to acquire target transaction data;

[0126] A rule determination module 302, connected to the data acquisition module 300, is used to determine a target transaction rule hit by the target transaction data from the multiple transaction rules, and determine a target transaction feature corresponding to the target transaction rule, and a target scoring threshold corresponding to the target transaction rule, wherein the multiple transaction rules correspond to different transaction features and scoring thresholds;

[0127] The feature extraction module 304 is connected to the rule determination module 302 and is used to extract target feature data corresponding to the target transaction feature from the target transaction data;

[0128] The scoring module 306 is connected to the feature extraction module 304 and is used to calculate the warning score corresponding to the target transaction data based on the target feature data;

[0129] The anomaly identification module 308 is connected to the scoring module 306 and is used to determine the transaction warning result of the target transaction data according to the warning score corresponding to the target transaction data and the target score threshold, wherein the transaction warning result is at least used to indicate whether there is an anomaly in the target transaction data.

[0130] In the embodiment of the present invention, a data acquisition module 300 is provided to acquire target transaction data; a rule determination module 302 is connected to the data acquisition module 300 to determine a target transaction rule hit by the target transaction data from a plurality of transaction rules, and to determine a target transaction feature corresponding to the target transaction rule, and a target scoring threshold corresponding to the target transaction rule, wherein the plurality of transaction rules correspond to different transaction features and scoring thresholds; a feature extraction module 304 is connected to the rule determination module 302 to extract target feature data corresponding to the target transaction feature from the target transaction data; a scoring module 306 is connected to the feature extraction module 304 to calculate a warning score corresponding to the target transaction data based on the target feature data; an anomaly identification module 308 is connected to the scoring module 308 to calculate a warning score corresponding to the target transaction data; and 06, is used to determine the transaction warning result of the target transaction data according to the warning score corresponding to the target transaction data and the target score threshold, wherein the transaction warning result is at least used to indicate whether the target transaction data has an abnormality, thereby achieving the purpose of setting corresponding transaction characteristics and scoring thresholds for multiple transaction rules respectively, and determining whether the transaction data has an abnormality in a targeted manner with a smaller number of indicators, thereby achieving the technical effect of improving the accuracy and efficiency of abnormal transaction identification while reducing resource consumption, and further solving the technical problem that the transaction warning method in the related technology mainly includes a rule-based abnormal transaction identification method and a model prediction-based abnormal transaction identification method, but the rule-based abnormal transaction identification method has low accuracy and the model prediction-based abnormal transaction identification method has high resource consumption.

[0131] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0132] It should be noted that the above data acquisition module 300, rule determination module 302, feature extraction module 304, scoring module 306, and abnormality identification module 308 correspond to steps S102 to S110 in the embodiment, and the examples and application scenarios implemented by the above modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments. It should be noted that the above modules can be run in a computer terminal as part of the device.

[0133] It should be noted that the optional or preferred implementation of this embodiment can refer to the relevant description in the embodiment, which will not be repeated here.

[0134] The above-mentioned transaction warning processing device may also include a processor and a memory. The above-mentioned data acquisition module 300, rule determination module 302, feature extraction module 304, scoring module 306, anomaly identification module 308, etc. are all stored in the memory as program modules, and the processor executes the above-mentioned program modules stored in the memory to realize corresponding functions.

[0135] The processor includes a kernel, which retrieves the corresponding program module from the memory. The kernel may be one or more. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. The memory includes at least one memory chip.

[0136] According to an embodiment of the present application, an embodiment of a non-volatile storage medium is also provided. Optionally, in this embodiment, the non-volatile storage medium includes a stored program, wherein when the program is executed, the device where the non-volatile storage medium is located is controlled to execute any one of the transaction warning processing methods.

[0137] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group, and the non-volatile storage medium includes a stored program.

[0138] Optionally, when the program is running, the device where the non-volatile storage medium is located is controlled to perform the following functions: obtain target transaction data; determine the target transaction rule hit by the target transaction data from multiple transaction rules, and determine the target transaction feature corresponding to the target transaction rule, and the target scoring threshold corresponding to the target transaction rule, wherein multiple transaction rules correspond to different transaction features and scoring thresholds; extract target feature data corresponding to the target transaction feature from the target transaction data; based on the target feature data, calculate the warning score corresponding to the target transaction data; determine the transaction warning result of the target transaction data according to the warning score corresponding to the target transaction data, and the target scoring threshold, wherein the transaction warning result is at least used to indicate whether there is an abnormality in the target transaction data.

[0139] According to an embodiment of the present application, an embodiment of a processor is also provided. Optionally, in this embodiment, the processor is used to run a program, wherein when the program is run, any one of the transaction warning processing methods is executed.

[0140] According to an embodiment of the present application, an embodiment of a computer program product is also provided, which, when executed on a data processing device, is suitable for executing a program that initializes any one of the steps of the transaction warning processing method described above.

[0141] Optionally, the above-mentioned computer program product, when executed on a data processing device, is suitable for executing a program initialized with the following method steps: obtaining target transaction data; determining the target transaction rule hit by the target transaction data from multiple transaction rules, and determining the target transaction feature corresponding to the target transaction rule, and the target scoring threshold corresponding to the target transaction rule, wherein multiple transaction rules correspond to different transaction features and scoring thresholds; extracting target feature data corresponding to the target transaction feature from the target transaction data; calculating the warning score corresponding to the target transaction data based on the target feature data; determining the transaction warning result of the target transaction data according to the warning score corresponding to the target transaction data, and the target scoring threshold, wherein the transaction warning result is at least used to indicate whether there is an abnormality in the target transaction data.

[0142] An embodiment of the present invention provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the program: acquiring target transaction data; determining a target transaction rule hit by the target transaction data from multiple transaction rules, and determining a target transaction feature corresponding to the target transaction rule, and a target scoring threshold corresponding to the target transaction rule, wherein the multiple transaction rules correspond to different transaction features and scoring thresholds; extracting target feature data corresponding to the target transaction feature from the target transaction data; calculating a warning score corresponding to the target transaction data based on the target feature data; determining a transaction warning result of the target transaction data according to the warning score corresponding to the target transaction data, and the target scoring threshold, wherein the transaction warning result is at least used to indicate whether the target transaction data is abnormal.

[0143] The above sequence of the embodiments of the present invention is for description only and does not represent the superiority or inferiority of the embodiments.

[0144] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0145] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the above modules can be a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, modules or indirect coupling or communication connection of modules, which can be electrical or other forms.

[0146] The modules described above as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0147] In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0148] If the above-mentioned integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable non-volatile storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a non-volatile storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the various embodiments of the present invention. The aforementioned non-volatile storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0149] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A transaction warning processing method, characterized in that: Including: Obtain target transaction data; Determine the target transaction rule hit by the target transaction data from multiple transaction rules, and determine the target transaction feature corresponding to the target transaction rule, as well as the target score threshold corresponding to the target transaction rule, where the multiple transaction rules correspond to different transaction features and score thresholds; Extract target feature data corresponding to the target transaction feature from the target transaction data; Calculate the warning score corresponding to the target transaction data based on the target feature data; Determine the transaction warning result of the target transaction data according to the warning score corresponding to the target transaction data and the target score threshold, where the transaction warning result is at least used to indicate whether the target transaction data is abnormal.

2. The method according to claim 1, characterized in that Before determining the target transaction rule hit by the target transaction data from multiple transaction rules, and determining the target transaction feature corresponding to the target transaction rule, and the target score threshold corresponding to the target transaction rule, the method further includes: Obtain the transaction feature corresponding to any one of the multiple transaction rules in the following manner: Obtain multiple pieces of initial transaction data corresponding to the any one transaction rule, and the transaction labels respectively corresponding to the multiple pieces of initial transaction data. Each piece of initial transaction data in the multiple pieces of initial transaction data includes feature values corresponding to multiple initial features, and the transaction label is used to indicate whether the corresponding initial transaction data is abnormal; Based on the multiple pieces of initial transaction data and the transaction labels respectively corresponding to the multiple pieces of initial transaction data, adopt the extreme gradient boosting method to determine the score values corresponding to the multiple initial features, where the score value is used to indicate the importance degree of the corresponding initial feature; Perform a descending order sorting process on the multiple initial features according to the score values to obtain a sorting result; Based on the sorting result, determine the initial features ranked in the top predetermined number among the multiple initial features as the transaction feature corresponding to the any one transaction rule; Adopt the way of obtaining the transaction feature corresponding to the any one transaction rule to obtain the transaction features corresponding to the multiple transaction rules respectively.

3. The method according to claim 2, characterized in that Before determining the initial features ranked in the top predetermined number among the multiple initial features as the transaction feature corresponding to the any one transaction rule based on the sorting result, the method further includes: Determine the target screening condition as: Wherein, fa represents the score value corresponding to the initial feature ranked at the a-th position in the sorting result; fb represents the score value corresponding to the initial feature ranked at the b-th position in the sorting result, a < b and both a and b are positive integers; fb - 1 represents the score value corresponding to the initial feature ranked at the (b - 1)-th position in the sorting result; Determine the value b - 1 under the condition of satisfying the target screening condition as the predetermined number.

4. The method according to claim 2, characterized in that: Before determining the target transaction rule hit by the target transaction data from multiple transaction rules, and determining the target transaction feature corresponding to the target transaction rule, and the target score threshold corresponding to the target transaction rule, the method further includes: The scoring threshold corresponding to any one of the multiple transaction rules is obtained in the following manner: Extracting transaction data matching a transaction feature corresponding to any one of the transaction rules from the multiple initial features to obtain multiple pieces of first transaction data; Based on the multiple pieces of first transaction data, construct an empirical cumulative distribution function of the transaction feature corresponding to any one of the transaction rules, wherein the empirical cumulative distribution function is used to indicate the distribution of feature values ​​of the transaction feature corresponding to any one of the transaction rules, and there are multiple transaction features corresponding to any one of the transaction rules; Determine, based on the plurality of first transaction data and an empirical cumulative distribution function of a transaction feature corresponding to any one of the transaction rules, early warning scores corresponding to the plurality of first transaction data respectively; Determining a score threshold corresponding to any one of the transaction rules based on the early warning scores respectively corresponding to the plurality of first transaction data; The scoring thresholds corresponding to the plurality of trading rules are obtained by obtaining the scoring threshold corresponding to any one of the trading rules.

5. The method according to claim 4, characterized in that The empirical cumulative distribution function includes a left-tail empirical cumulative distribution function and a right-tail empirical cumulative distribution function, and the determining of early warning scores corresponding to the plurality of first transaction data respectively based on the plurality of first transaction data and the empirical cumulative distribution function of the transaction feature corresponding to any one of the transaction rules includes: Determine a skewness coefficient corresponding to a transaction feature corresponding to any one of the transaction rules, wherein the skewness coefficient is used to indicate a degree of deviation of a characteristic value of the corresponding transaction feature; Based on the multiple pieces of first transaction data, the skewness coefficient of the transaction feature corresponding to any one of the transaction rules, the left-tail empirical cumulative distribution function, and the right-tail empirical cumulative distribution function, early warning scores corresponding to the multiple pieces of first transaction data are determined.

6. The method according to claim 5, characterized in that The determining, based on the plurality of first transaction data, the skewness coefficient of the transaction feature corresponding to any one of the transaction rules, the left-tail empirical cumulative distribution function, and the right-tail empirical cumulative distribution function, respectively corresponding to the plurality of first transaction data, comprises: The early warning score of any one of the plurality of first transaction data is obtained by: Among them, O all (x i ) represents the early warning score of any transaction data; j=1, 2, ..., d represents any one of the multiple transaction features corresponding to any transaction rule; d represents the total number of multiple transaction features corresponding to any transaction rule; γ j represents the skewness coefficient corresponding to the jth transaction feature among the multiple transaction features corresponding to any one of the transaction rules; represents the left-tail empirical cumulative distribution function corresponding to the j-th transaction feature, represents the right-tailed empirical cumulative distribution function corresponding to the j-th transaction feature, represents the feature value corresponding to the j-th transaction feature in any one of the transaction data; I{γ j <0} means γ j <0, the value is 1, otherwise it is 0; I{γ j ≥0} means γ j The value is 1 when ≥0, otherwise it is 0; The warning scores respectively corresponding to the plurality of first transaction data are obtained by adopting a method of obtaining the warning score of any one of the transaction data.

7. The method according to claim 6, characterized in that The determining, based on the early warning scores respectively corresponding to the plurality of first transaction data, a score threshold corresponding to any one of the transaction rules comprises: Divide the early warning scores corresponding to the plurality of first transaction data into K parts to obtain K test sets and training sets corresponding to the K test sets, wherein the training sets include the early warning scores corresponding to the plurality of first transaction data, and the early warning scores corresponding to other transaction data except the corresponding test sets; Based on the K test sets and the training sets corresponding to the K test sets respectively, a K-fold cross-validation method is adopted to obtain a scoring threshold corresponding to any transaction rule.

8. The method according to any one of claims 1 to 7, characterized in that The determining, according to the warning score corresponding to the target transaction data and the target score threshold, a transaction warning result of the target transaction data comprises: Detecting whether the warning score corresponding to the target transaction data is greater than the target score threshold; When the warning score corresponding to the target transaction data is greater than the target score threshold, determining that the transaction warning result is that the target transaction data is abnormal; When the warning score corresponding to the target transaction data is less than or equal to the target score threshold, it is determined that the transaction warning result is that there is no abnormality in the target transaction data.

9. A transaction warning processing device, characterized in that: include: A data acquisition module, used to acquire target transaction data; A rule determination module, configured to determine a target transaction rule hit by the target transaction data from a plurality of transaction rules, and determine a target transaction feature corresponding to the target transaction rule, and a target scoring threshold corresponding to the target transaction rule, wherein the plurality of transaction rules correspond to different transaction features and scoring thresholds; A feature extraction module, used to extract target feature data corresponding to the target transaction feature from the target transaction data; A scoring module, used to calculate a warning score corresponding to the target transaction data based on the target feature data; The anomaly identification module is used to determine the transaction warning result of the target transaction data according to the warning score corresponding to the target transaction data and the target score threshold, wherein the transaction warning result is at least used to indicate whether the target transaction data has an anomaly.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the transaction warning processing method described in any one of claims 1 to 8.

Images