Risk behavior identification method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of artificial intelligence and the field of financial science and technology, and discloses a risk behavior recognition method and device, computer equipment and a storage medium, and the method comprises the steps: collecting original data related to risk behavior recognition, carrying out the preprocessing of the original data, and obtaining an original data set; performing adversarial training on a generator and a discriminator in the GAN model by using the original data set, and generating a target GAN model when both the generator and the discriminator meet a preset first performance requirement; inputting the obtained random noise vector into a target GAN model to generate an abnormal data set; fusing the abnormal data set with the original data set to obtain a fused data set; training an initial model constructed based on an XGBoost algorithm by adopting the fusion data set, and when the initial model meets a preset second performance requirement, generating a risk behavior recognition model; performing risk identification on the target behavior based on a risk behavior identification model; therefore, the efficiency and accuracy of risk behavior identification can be effectively improved.

Description

Technical Field

[0001] The present invention relates to the fields of artificial intelligence technology and financial technology, and in particular to a risk behavior identification method, device, computer equipment and computer-readable storage medium. Background Art

[0002] At present, with the development of computer technology, more and more technologies are applied in the financial field. The traditional financial industry is gradually transforming to financial technology (Fintech), and risk behavior identification technology is no exception. For example, in the compliance review scenario of financial institutions (such as banks), risk behavior identification technology can be used to effectively identify the risks of various financial behaviors in the compliance review process, so as to reduce the financial risks of financial institutions and help them better cope with the complex and changing financial environment. However, due to the security and real-time requirements of the financial industry, higher requirements are also placed on risk behavior identification technology.

[0003] At present, financial statements are formal documents published by financial institutions to provide investors, creditors, regulators and other stakeholders with key information such as the financial status, operating results and cash flow of financial institutions. These statements include balance sheets, income statements, cash flow statements, etc., which are important bases for financial analysis and performance evaluation. However, due to the huge impact of financial statements on decision-making, some dishonest financial institutions may manipulate these statements through accounting means and mislead stakeholders by implementing related risky behaviors. These risky behaviors not only damage market integrity, but also distort the resource allocation efficiency of the capital market and cause damage to the social and economic order. At present, in order to combat these risky behaviors in financial statements, traditional risk behavior detection methods mainly rely on the professional knowledge and experience of auditors for analysis, but this manual method is inefficient and has a high error rate, and is easily affected by subjective factors.

[0004] Based on this, how to provide a risk behavior identification method, device, computer equipment and computer-readable storage medium that can effectively improve the efficiency and accuracy of risk behavior identification is a problem that urgently needs to be solved by technical personnel in this field. Summary of the invention

[0005] In view of the above-mentioned deficiencies in the prior art, an object of the present invention is to provide a risk behavior identification method, apparatus, computer equipment and computer-readable storage medium, aiming to solve the problem of how to effectively improve the efficiency and accuracy of risk behavior identification.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] In a first aspect, the present invention provides a risk behavior identification method, which includes:

[0008] Collecting raw data related to risk behavior identification, and preprocessing the raw data to obtain a raw data set;

[0009] Using the original data set to perform adversarial training on the generator and the discriminator in the GAN model, and when both the generator and the discriminator meet a preset first performance requirement, generating a target GAN model;

[0010] Inputting the obtained random noise vector into the target GAN model to generate an abnormal data set;

[0011] Fusing the abnormal data set with the original data set to obtain a fused data set;

[0012] The fused data set is used to train an initial model constructed based on the XGBoost algorithm, and when the initial model meets the preset second performance requirement, a risk behavior identification model is generated;

[0013] Based on the risk behavior identification model, risk identification is performed on the target behavior.

[0014] In a second aspect, the present invention provides a risk behavior identification device, which includes:

[0015] A collection module is used to collect raw data related to risk behavior identification and pre-process the raw data to obtain a raw data set;

[0016] A first training module is used to perform adversarial training on the generator and the discriminator in the GAN model using the original data set, and when both the generator and the discriminator meet the preset first performance requirement, generate a target GAN model;

[0017] An input module, used to input the acquired random noise vector into the target GAN model to generate an abnormal data set;

[0018] A fusion module, used for fusing the abnormal data set with the original data set to obtain a fused data set;

[0019] A second training module is used to train an initial model constructed based on the XGBoost algorithm using the fusion data set, and generate a risk behavior recognition model when the initial model meets a preset second performance requirement;

[0020] The risk identification module is used to identify the risks of the target behavior based on the risk behavior identification model.

[0021] In a third aspect, the present invention provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the risk behavior identification method as described above when executing the computer program.

[0022] In a fourth aspect, the present invention provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the risk behavior identification method as described above.

[0023] Compared with the prior art, the present invention provides a risk behavior identification method, device, computer equipment and computer-readable storage medium, wherein, by collecting original data related to risk behavior identification and preprocessing the original data, an original data set is obtained; the original data set is used to perform adversarial training on the generator and the discriminator in the GAN model, and when the generator and the discriminator both meet the preset first performance requirement, a target GAN model is generated; the acquired random noise vector is input into the target GAN model to generate an abnormal data set; the abnormal data set is fused with the original data set to obtain a fused data set; the fused data set is used to train the initial model constructed based on the XGBoost algorithm, and when the initial model meets the preset second performance requirement, a risk behavior identification model is generated; based on the risk behavior identification model, risk identification is performed on the target behavior; thus, the present invention can effectively improve the efficiency and accuracy of risk behavior identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A schematic diagram of an application environment of a risk behavior identification method provided by an embodiment of the present invention.

[0026] Figure 2 A flowchart of a risk behavior identification method provided by an embodiment of the present invention.

[0027] Figure 3 A schematic diagram of a program module of a risk behavior identification device provided by an embodiment of the present invention.

[0028] Figure 4 A schematic diagram of the structure of a computer device provided by an embodiment of the present invention.

[0029] Figure 5 Another structural schematic diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0032] It should also be understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0033] As used in the present specification and the appended claims, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0034] In addition, in the description of the present specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0035] References to "one embodiment" or "some embodiments" etc. described in the present specification mean that one or more embodiments of the present invention include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0036] It should be understood that the order of execution of the steps in the following embodiments does not imply a precedence of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0037] In order to illustrate the technical solution of the present invention, specific embodiments are provided below for illustration.

[0038] A risk behavior identification method provided by an embodiment of the present invention can be applied in Figure 1 In the application environment shown, the client and the server communicate through the network. The client includes but is not limited to PDAs, desktop computers, laptops, ultra-mobile personal computers (UMPCs), netbooks, cloud computing devices, personal digital assistants (PDAs) and other computer devices. The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0039] See also Figure 2 An embodiment of the present invention provides a method for identifying risky behaviors, wherein the method comprises the following steps:

[0040] S100, collecting original data related to risk behavior identification, and preprocessing the original data to obtain an original data set;

[0041] S200, using the original data set to perform adversarial training on the generator and the discriminator in the GAN model, and when both the generator and the discriminator meet a preset first performance requirement, generating a target GAN model;

[0042] S300, inputting the acquired random noise vector into the target GAN model to generate an abnormal data set;

[0043] S400, fusing the abnormal data set with the original data set to obtain a fused data set;

[0044] S500, using the fusion data set to train an initial model built based on the XGBoost algorithm, and when the initial model meets the preset second performance requirement, generating a risk behavior identification model;

[0045] S600: Based on the risk behavior identification model, perform risk identification on the target behavior.

[0046] In specific implementation, this embodiment achieves efficient and accurate identification of risky behaviors by combining the advantages of generative adversarial networks (GAN) and XGBoost algorithms. First, a clean original data set is obtained through preprocessing, laying a solid foundation for subsequent model training. Then, using the adversarial training mechanism of the GAN model, the generator generates realistic abnormal data, and the discriminator learns to distinguish abnormal and normal data. This process enhances the model's understanding and generalization ability of risky behavior characteristics. The generated abnormal data set is fused with the original data set to further expand and enrich the training samples, especially for rare risk samples, effectively solving the problem of sample imbalance. Then, the fused data set is used to train the XGBoost-based model. The XGBoost algorithm performs well in processing structured data and classification problems. By adjusting the preset performance requirements, it ensures that the model has high accuracy and efficiency in identifying risky behaviors. Finally, the risk behavior identification model obtained by training can accurately assess the risk of the target behavior, thereby improving the automation and intelligence level of risk management. The entire method of this embodiment not only improves the accuracy of risky behavior identification through the organic combination of each step, but also optimizes the efficiency of the identification process, and has important practical value and broad application prospects.

[0047] Furthermore, in one embodiment, the risk behavior identification method, wherein the step S100, collecting raw data related to risk behavior identification and preprocessing the raw data to obtain a raw data set, specifically comprises the steps of:

[0048] Collect raw data related to risk behavior identification from multiple data sources;

[0049] After data cleaning, data conversion, data integration and data normalization are performed on the original data, an original data set is obtained.

[0050] In specific implementation, this embodiment collects raw data related to risk behavior identification from multiple data sources and performs a series of standardized preprocessing operations on it, thereby ensuring the quality and consistency of the data and improving the reliability of the original data set; enhancing the accuracy and robustness of subsequent model training; and by integrating multiple data sources, increasing the breadth and depth of the data, making the characteristics of risk behavior more comprehensive, which helps to improve the generalization ability and prediction performance of the subsequent risk behavior identification model. In addition, data normalization processing helps to compare and weight different features, so that the model will not be biased due to different feature value ranges, thereby improving the efficiency of subsequent model training and recognition accuracy.

[0051] The specific implementation process of the steps in this embodiment is roughly as follows:

[0052] 1. Data Collection:

[0053] Identify data sources: Identify and select data sources relevant to risk behavior identification. These may include transaction records, user behavior logs, social media activities, public credit reports, etc.

[0054] Data extraction: Use API calls, database queries, web crawlers and other technical means to extract the required data from these data sources;

[0055] 2. Data cleaning:

[0056] Missing value processing: Identify missing values ​​in the data and choose to delete, fill (such as using mean, median, mode) or interpolate methods according to the situation;

[0057] Outlier detection: Identify outliers through statistical analysis methods or machine learning models and take corresponding measures, such as replacement or deletion;

[0058] 3. Data conversion:

[0059] Format standardization: converting data into a unified format, such as the format of date and time, the unit of value, etc.

[0060] Feature construction: Extract and construct features from raw data that are helpful for identifying risky behaviors, such as user behavior patterns, transaction frequencies, etc.

[0061] 4. Data Integration:

[0062] Merge data: Merge data from different data sources based on common identifiers (such as user ID, timestamp);

[0063] Entity recognition: Identify and standardize entities in the data, such as company names, product names, etc.

[0064] 5. Data normalization:

[0065] Normalization: Use normalization techniques such as Min-Max Scaling to scale the data to the [0,1] interval, or use Z-Score standardization to make the data have a mean of 0 and unit variance;

[0066] Verification of processing results: Check the results of normalization processing through statistical analysis or visualization methods to ensure that the distribution and characteristics of the data meet expectations;

[0067] Through the above process, this embodiment can construct a clean, consistent, uniformly formatted original data set with rich features, providing high-quality input data for subsequent model training.

[0068] Furthermore, in one embodiment, the risk behavior identification method, wherein the step S200, using the original data set to perform adversarial training on the generator and the discriminator in the GAN model, and when both the generator and the discriminator meet the preset first performance requirement, generating a target GAN model, specifically comprises the steps of:

[0069] Pre-constructing a GAN model; wherein the GAN model includes a generator and a discriminator;

[0070] The original data set is used to perform adversarial training on the generator and the discriminator, and random noise is introduced during the training process. When both the generator and the discriminator meet the preset first performance requirement, a target GAN model is generated.

[0071] In specific implementation, this embodiment can achieve the following technical effects by pre-building a GAN model including a generator and a discriminator, and using the original data set to perform adversarial training on it, while introducing random noise to increase the robustness of the model: the generator learns to generate abnormal data similar to real data, and the discriminator learns to accurately distinguish between generated data and real data. This process enhances the model's understanding of data distribution and improves its generation quality and identification ability. When the performance of both the generator and the discriminator reaches the preset standards, the trained target GAN model can generate high-quality abnormal data, which can be used to expand the original data set and help improve the training effect of the subsequent risk behavior identification model, especially when risk samples are scarce, effectively solving the sample imbalance problem and improving the accuracy and generalization ability of risk behavior identification.

[0072] The specific implementation process of the steps in this embodiment is roughly as follows:

[0073] 1. Build the GAN model:

[0074] Define the generator: Design a network structure of the generator that can receive random noise as input and generate data similar to the original dataset;

[0075] Define the discriminator: Design the discriminator’s network structure so that it can distinguish the data generated by the generator from the real data in the original dataset;

[0076] 2. Prepare training data:

[0077] That is the original data set mentioned above;

[0078] 3. Adversarial Training:

[0079] Generator training: The generator tries to generate more and more realistic data to deceive the discriminator;

[0080] Discriminator training: The discriminator tries to distinguish between fake data generated by the generator and real data in the original dataset;

[0081] Introducing noise: Introducing random noise into the input of the generator to increase the diversity of generated data;

[0082] 4. Performance evaluation and model optimization:

[0083] Set performance indicators: Set performance evaluation indicators for the generator and discriminator, such as the deception success rate of the generator and the classification accuracy of the discriminator;

[0084] Model evaluation: Regularly evaluate the performance of the generator and discriminator during training to ensure that they meet the preset performance requirements;

[0085] Model optimization: adjust model parameters and network structure according to the evaluation results to optimize model performance;

[0086] 5. Generate target GAN model:

[0087] Performance meets requirements: When the data generated by the generator is realistic enough and the classification accuracy of the discriminator reaches the predetermined standard, the model training is considered complete;

[0088] Save model: Save the trained generator and discriminator parameters to form the target GAN model for subsequent use;

[0089] Model validation: You may need to further validate the performance of the target GAN model on an independent validation set to ensure that it performs well on unseen data.

[0090] Through the above process, this embodiment can build and train a GAN model that can generate high-quality abnormal data, providing rich training samples for the risk behavior identification model.

[0091] Furthermore, in one embodiment, the risk behavior identification method, wherein the step S300, inputting the acquired random noise vector into the target GAN model to generate an abnormal data set, specifically comprises the steps of:

[0092] Use a random number generation method to sample a random noise vector from a uniform distribution;

[0093] Inputting the random noise vector into the generator of the target GAN model to generate abnormal data;

[0094] The abnormal data is post-processed to obtain an abnormal data set.

[0095] In specific implementation, this embodiment uses a random number generation method to sample a random noise vector from a uniform distribution, and inputs it into the generator of the target GAN model, thereby achieving the purpose of using a generative adversarial network to generate abnormal data similar to the real data distribution. The generated abnormal data undergoes post-processing, such as cleaning, formatting, and normalization, to ensure the quality and consistency of the data. The resulting abnormal data set can be used to expand the original data set, solving the problem of scarce risk samples and improving the diversity and comprehensiveness of subsequent initial model training, thereby enhancing the generalization ability and recognition accuracy of the risk behavior identification model. This process effectively improves the recognition performance of the risk behavior identification model for minority samples, especially in scenarios such as financial risk behavior detection, which is of great significance for improving the predictive performance and practicality of the risk behavior identification model.

[0096] The specific implementation process of the steps in this embodiment is roughly as follows:

[0097] 1. Generate a random noise vector:

[0098] Determine the noise dimension: Determine the dimension of the noise vector based on the generator input requirements of the target GAN model;

[0099] Sample Noise: Sample a random noise vector from a uniform distribution using a random number generator;

[0100] 2. Input the noise vector to the generator:

[0101] Load GAN model: load the trained target GAN model, especially its generator part;

[0102] Input noise: Input the generated random noise vector into the generator; the generator will generate new abnormal data based on the random noise vector;

[0103] 3. Generate abnormal data:

[0104] Data generation: The generator processes the input random noise vector through its deep network structure and outputs the generated abnormal data;

[0105] Collect data: Collect the generated abnormal data, which should be similar to the abnormal data in the real world in statistical characteristics;

[0106] 4. Post-processing abnormal data:

[0107] Data cleaning: Clean the generated abnormal data and remove unreasonable or abnormal values;

[0108] Data formatting: ensuring that the generated data meets specific format requirements, such as date format, value range, etc.;

[0109] Data normalization: Normalize the generated abnormal data to make it consistent with the statistical characteristics of the original data set;

[0110] 5. Forming anomaly data set:

[0111] Integrate the post-processed anomaly data to form a final anomaly data set;

[0112] Through the above process, this embodiment can effectively use the generator of the target GAN model to generate high-quality abnormal data, and form an abnormal data set after post-processing, providing richer data support for training risk behavior recognition models.

[0113] Furthermore, in one embodiment, the risk behavior identification method, wherein the step S400, fusing the abnormal data set with the original data set to obtain a fused data set, specifically comprises the steps of:

[0114] Determining a data fusion strategy according to the training requirements of the initial model;

[0115] Based on the data fusion strategy, the abnormal data set is fused with the original data set to form fused data;

[0116] After the fused data is shuffled, a fused data set is obtained.

[0117] In specific implementation, this embodiment determines the data fusion strategy according to the training requirements of the initial model, ensuring the effective integration of the abnormal data set and the original data set to form a unified fused data set. This process not only expands the diversity and coverage of the data, but also eliminates the possible order deviation in the fused data set through shuffling, enhances the randomness of the data, and thus improves the generalization ability of subsequent initial model training. The generation of the fused data set provides a solid data foundation for building a risk behavior identification model with strong robustness and high accuracy, which helps to improve the prediction performance and reliability of the risk behavior identification model in practical applications.

[0118] The specific implementation process of the steps in this embodiment is roughly as follows:

[0119] 1. Analyze the training requirements of the initial model:

[0120] Determine data features: Analyze which features the initial model needs for training and determine the data type and format of these features;

[0121] Evaluate data balance: Evaluate the distribution of the original dataset and the abnormal dataset on the target features to determine whether there is a class imbalance problem;

[0122] 2. Develop data fusion strategy:

[0123] Select fusion method: According to the needs of initial model training, select appropriate data fusion method, such as simple merging, stratified sampling or weighted fusion;

[0124] Dealing with class imbalance: If there is class imbalance, use oversampling, undersampling, or generating synthetic samples to deal with it;

[0125] 3. Perform data fusion:

[0126] Merge data sets: Merge the abnormal data set with the original data set to form a new fused data, ensuring that the merged fused data maintains consistent data format and features;

[0127] Feature alignment: ensuring that the features in the two datasets are properly aligned in terms of statistical distribution and data type;

[0128] 4. Disrupt the fusion data:

[0129] Random sampling: random sampling is used to disrupt the merged fusion data to ensure the randomness of the data and avoid deviations during initial model training;

[0130] Index shuffling: Randomly arrange the data by shuffling the indexes in the fused data;

[0131] 5. Generate fusion data set:

[0132] After shuffling the fused data, a fused data set is obtained;

[0133] Perform statistical analysis on the obtained fused data set to check whether the data distribution meets expectations and ensure the diversity and representativeness of the fused data set; and perform data quality checks to ensure that there are no duplicate records, wrong labels, or outliers;

[0134] Through the above process, this embodiment can ensure the quality and applicability of the fused data set, provide a solid data foundation for training the initial model, and thus improve the performance of the risk behavior identification model in practical applications.

[0135] Furthermore, in one embodiment, the risk behavior identification method, wherein the step S500, uses the fusion data set to train the initial model constructed based on the XGBoost algorithm, and when the initial model meets the preset second performance requirement, generates a risk behavior identification model, specifically includes the steps of:

[0136] Build an initial model based on the XGBoost algorithm in advance;

[0137] Dividing the fused data set into a training data set and a test data set;

[0138] Training the initial model according to the training data set, and verifying and evaluating the trained initial model according to the test data set;

[0139] A verification and evaluation result is obtained, and when it is detected that the verification and evaluation result meets a preset second performance requirement, a risk behavior identification model is generated.

[0140] In specific implementation, this embodiment realizes an efficient risk behavior identification model construction process by pre-building an initial model based on the XGBoost algorithm and using the fused data set for training and testing. The XGBoost algorithm is widely used due to its excellent classification performance and scalability. By dividing the fused data set into a training data set and a test data set, the generalization ability of the initial model on independent data is verified. After the initial model training is completed, the test data set is used for evaluation. This step can objectively reflect the performance of the initial model in practical applications. When the verification evaluation results of the initial model meet the preset performance requirements, it indicates that the initial model has good predictive ability and accuracy. At this time, it can be deployed as a risk behavior identification model for actual risk behavior detection and identification, thereby improving the automation and intelligence level of risk management in financial institutions and other related fields.

[0141] The specific implementation process of the steps in this embodiment is roughly as follows:

[0142] 1. Build the initial model:

[0143] Initialization: Create an instance of the initial model based on the XGBoost algorithm and set basic parameters such as learning rate, number of trees, maximum depth, etc.

[0144] Define features and target variables: Determine input features and target variables (labels) from the fused dataset;

[0145] 2. Divide the dataset:

[0146] Split: Use cross-validation or simple splitting methods to split the fused dataset into training and test datasets;

[0147] Verification: Ensure that the two data sets are consistent in statistical properties and there is no data leakage;

[0148] 3. Train the initial model:

[0149] Configure training parameters: set parameters during training, such as number of iterations, evaluation criteria, etc.

[0150] Model training: Use the training data set to train the initial model;

[0151] 4. Model validation evaluation:

[0152] Test set evaluation: Use the test data set to evaluate the trained initial model and obtain the performance indicators of the initial model, such as accuracy, recall, F1 score, etc.

[0153] Performance analysis: Analyze the performance of the initial model on the test data set to determine whether the initial model is good enough;

[0154] 5. Generate risk behavior identification model:

[0155] Performance meets the standard: If the validation evaluation results of the initial model meet the preset performance requirements, the initial model training is considered successful;

[0156] Model saving: Save the trained model parameters to form a risk behavior identification model for subsequent deployment and use;

[0157] 6. Model deployment (optional):

[0158] Deploy model: deploy the trained risk behavior identification model to the production environment;

[0159] Real-time prediction: The risk behavior identification model begins to predict and identify risk behaviors based on real-time data;

[0160] Through the above process, this embodiment can build and verify a risk behavior identification model based on the XGBoost algorithm, ensuring that the risk behavior identification model has good prediction performance and generalization ability in practical applications.

[0161] Furthermore, in one embodiment, the risk behavior identification method, wherein the step S600, based on the risk behavior identification model, performs risk identification on the target behavior, specifically comprises the steps of:

[0162] Determine the target behaviors for risk identification;

[0163] Inputting the target behavior into the risk behavior identification model to generate a risk identification result;

[0164] The risk identification result is output or displayed.

[0165] In specific implementation, this embodiment determines the target behaviors to be identified, analyzes and predicts these behaviors using the trained risk behavior identification model, generates risk identification results, and then outputs or displays these results, thereby realizing rapid, accurate identification and visualization of potential risk behaviors. This process not only improves the automation level of risk detection, but also enables decision makers to obtain key information in a timely manner, so that they can respond quickly and take preventive or intervention measures, effectively reducing financial risks and potential losses, and enhancing the risk management capabilities of financial institutions and other related organizations.

[0166] The specific implementation process of the steps in this embodiment is roughly as follows:

[0167] The implementation process of the above steps can be specifically described as the following steps:

[0168] 1. Identify the target behavior:

[0169] Define behavioral characteristics: clearly define the target behavior that needs to be identified and define its related characteristics and data fields;

[0170] Data collection: Collect data related to the target behavior, which may come from transaction records, user behavior logs, market data, etc.

[0171] 2. Input the target behavior into the model:

[0172] Data preprocessing: Preprocess the collected data to ensure that the data format is consistent with the data format used in risk behavior identification model training;

[0173] Feature extraction: extract features from the preprocessed data, which will serve as input to the risk behavior identification model;

[0174] 3. Model prediction:

[0175] Load model: load the risk behavior recognition model that has been trained;

[0176] Perform prediction: The extracted features are fed into the risk behavior identification model, which analyzes these features and generates risk identification results;

[0177] 4. Processing risk identification results:

[0178] Result interpretation: convert the risk identification results generated by the risk behavior identification model from their original format (such as probability distribution, score, etc.) into an easily understandable form;

[0179] Threshold determination: Set thresholds based on business needs and risk tolerance, and classify risk identification results into high risk, medium risk, or low risk;

[0180] 5. Output or display risk identification results:

[0181] Visualization: Design charts or dashboards to present risk identification results in a graphical way to facilitate user understanding and analysis;

[0182] Report generation: Generate risk assessment reports including key indicators, risk levels and possible action recommendations;

[0183] Of course, the risk identification results can also be output to a specified location according to actual needs, such as saving to a local file system, sending to a remote server or other device;

[0184] 6. Application of results:

[0185] Decision support: Providing risk identification results to decision makers to help them manage risks and formulate strategies;

[0186] Trigger warning: When high-risk behaviors are identified, the warning mechanism is automatically triggered to remind relevant personnel to take corresponding measures;

[0187] Through the above process, this embodiment can ensure that the target behavior is effectively identified, and the identification results can be presented to the user in a useful and actionable manner, thereby improving the efficiency and effectiveness of the entire risk management process.

[0188] It can be seen from the above method embodiments that the risk behavior identification method provided by the present invention includes: collecting raw data related to risk behavior identification, and preprocessing the raw data to obtain an original data set; using the original data set to conduct adversarial training on the generator and discriminator in the GAN model, and when both the generator and the discriminator meet the preset first performance requirement, generating a target GAN model; inputting the acquired random noise vector into the target GAN model to generate an abnormal data set; fusing the abnormal data set with the original data set to obtain a fused data set; using the fused data set to train the initial model constructed based on the XGBoost algorithm, and when the initial model meets the preset second performance requirement, generating a risk behavior identification model; based on the risk behavior identification model, performing risk identification on the target behavior. In this way, the efficiency and accuracy of risk behavior identification can be effectively improved by the method of the present invention.

[0189] It can be understood that the risk behavior identification method provided by the embodiment of the present invention can be applied to risk behavior identification scenarios related to the field of financial technology. Specifically, the risk behavior identification function can be integrated into the corresponding compliance review scenarios of financial institutions (such as banks). The risk behavior identification method provided by the embodiment of the present invention can be used to achieve effective risk identification of various financial behaviors in the compliance review process, thereby reducing the financial risks of financial institutions and helping financial institutions better cope with complex and changing financial environments.

[0190] Of course, it can be understood that the risk behavior identification method provided by the embodiment of the present invention can also be applied to the identification scenario of risk behaviors related to the financial statements of financial institutions, which can effectively identify and prevent risk behaviors in financial statements, improve the authenticity and transparency of financial data, and thus effectively maintain the healthy operation of the financial market and the social and economic order.

[0191] It should be understood that, although the present application provides method operation steps as described in the embodiments or flowcharts, more or less operation steps may be included based on conventional or non-creative labor, and these operation steps are not necessarily performed in sequence according to the embodiment or flowchart. The order of steps listed in the embodiment or flowchart is only one way of executing the order of many steps, and does not represent the only execution order. It should be noted that there is not necessarily a certain order between the above steps. A person of ordinary skill in the art can understand from the description of the embodiment of the present invention that in different embodiments, the above steps may have different execution orders, that is, they may be executed in parallel, or they may be executed in exchange, etc. Moreover, at least a part of the steps in the embodiment or flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but may be executed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but may be executed in turn, alternately or synchronously with other steps or at least a part of the sub-steps or stages of other steps.

[0192] Based on the above method embodiment, please refer to Figure 3 Another embodiment of the present invention further provides a risk behavior identification device, wherein the device comprises:

[0193] The collection module 11 is used to collect raw data related to risk behavior identification and pre-process the raw data to obtain a raw data set;

[0194] A first training module 12 is used to perform adversarial training on the generator and the discriminator in the GAN model using the original data set, and generate a target GAN model when both the generator and the discriminator meet a preset first performance requirement;

[0195] An input module 13, used to input the acquired random noise vector into the target GAN model to generate an abnormal data set;

[0196] A fusion module 14 is used to fuse the abnormal data set with the original data set to obtain a fused data set;

[0197] A second training module 15 is used to train the initial model constructed based on the XGBoost algorithm using the fusion data set, and generate a risk behavior recognition model when the initial model meets the preset second performance requirement;

[0198] The risk identification module 16 is used to identify the risk of the target behavior based on the risk behavior identification model.

[0199] Furthermore, in one embodiment, the risk behavior identification device, wherein the collection module 11 is specifically used for:

[0200] Collect raw data related to risk behavior identification from multiple data sources;

[0201] After data cleaning, data conversion, data integration and data normalization are performed on the original data, an original data set is obtained.

[0202] Furthermore, in one embodiment, the risk behavior identification device, wherein the first training module 12 is specifically used for:

[0203] Pre-constructing a GAN model; wherein the GAN model includes a generator and a discriminator;

[0204] The original data set is used to perform adversarial training on the generator and the discriminator, and random noise is introduced during the training process. When both the generator and the discriminator meet the preset first performance requirement, a target GAN model is generated.

[0205] Furthermore, in one embodiment, the risk behavior identification device, wherein the input module 13 is specifically used for:

[0206] Using a random number generator to sample a random noise vector from a uniform distribution;

[0207] Inputting the random noise vector into the generator of the target GAN model to generate abnormal data;

[0208] The abnormal data is post-processed to obtain an abnormal data set.

[0209] Furthermore, in one embodiment, the risk behavior identification device, wherein the fusion module 14 is specifically used for:

[0210] Determining a data fusion strategy according to the training requirements of the initial model;

[0211] Based on the data fusion strategy, the abnormal data set is fused with the original data set to form fused data;

[0212] After the fused data is shuffled, a fused data set is obtained.

[0213] Furthermore, in one embodiment, the risk behavior identification device, wherein the second training module 15 is specifically used for:

[0214] Build an initial model based on the XGBoost algorithm in advance;

[0215] Dividing the fused data set into a training data set and a test data set;

[0216] Training the initial model according to the training data set, and verifying and evaluating the trained initial model according to the test data set;

[0217] A verification and evaluation result is obtained, and when it is detected that the verification and evaluation result meets a preset second performance requirement, a risk behavior identification model is generated.

[0218] Furthermore, in one embodiment, the risk behavior identification device, wherein the risk identification module 16 is specifically used to:

[0219] Determine the target behaviors for risk identification;

[0220] Inputting the target behavior into the risk behavior identification model to generate a risk identification result;

[0221] The risk identification result is output or displayed.

[0222] It should be noted that in the embodiment of the device of the present invention, the information interaction, execution process and other contents between the above-mentioned modules are based on the same concept as the embodiment of the method of the present invention. Their specific functions and technical effects can be found in the aforementioned method embodiment part and will not be repeated here.

[0223] Based on the above method embodiment, another embodiment of the present invention further provides a computer device, which may be a server, and its internal structure diagram may be as follows: Figure 4As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the functions or steps on the service side of the risk behavior identification method in any of the above method embodiments are implemented.

[0224] Based on the above method embodiment, another embodiment of the present invention further provides a computer device, which may be a client, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the functions or steps of the client side of the risk behavior identification method in any of the above method embodiments are implemented.

[0225] Those skilled in the art will understand that Figure 4 and Figure 5 The structural schematic diagram shown in the figure is only a schematic diagram of a partial structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied. The specific computer device may include more components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0226] The processor may be a CPU, or other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, etc.

[0227] Among them, the memory includes a readable storage medium, an internal memory, etc., wherein the internal memory can be the memory of a computer device, and the internal memory provides an environment for the operation of an operating system and computer-readable instructions in the readable storage medium. The readable storage medium can be a hard disk of a computer device, and in other embodiments, it can also be an external storage device of a computer device, for example, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on a computer device. Further, the memory can also include both an internal storage unit of a computer device and an external storage device. The memory is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of a computer program, etc. The memory can also be used to temporarily store data that has been output or is to be output.

[0228] Based on the above method embodiments, another embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the risk behavior identification method in any of the above method embodiments is implemented. The computer-readable storage medium may be non-volatile or volatile.

[0229] It should be noted that the above-mentioned functions or steps that can be implemented by the computer-readable storage medium or computer device, and the technical effects brought about by the functions / steps, can be found in the relevant descriptions in the aforementioned method embodiments. To avoid repetition, they will not be described one by one here.

[0230] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM). The disclosed memory components or memories of the operating environments described herein are intended to comprise one or more of these and / or any other suitable types of memory.

[0231] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, in the embodiment of the device of the present invention, only the division of the above-mentioned functional units and modules is used as an example. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention. The specific working process of the units and modules in the above-mentioned device can refer to the corresponding process in the above-mentioned method embodiment, which will not be repeated here. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0232] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0233] In the embodiments provided by the present invention, it should be understood that the disclosed devices / computer equipment and methods can be implemented in other ways. For example, the device / computer equipment embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0234] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0235] It should be noted that if software tools or components other than those of the Company appear in the embodiments of the present application, they are only used for illustration and do not represent actual use. The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the above embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features thereof can be replaced by equivalents; and these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention.

Claims

1. A risk behavior identification method, characterized in that: include: Collecting raw data related to risk behavior identification, and preprocessing the raw data to obtain a raw data set; Using the original data set to perform adversarial training on the generator and the discriminator in the GAN model, and when both the generator and the discriminator meet a preset first performance requirement, generating a target GAN model; Inputting the obtained random noise vector into the target GAN model to generate an abnormal data set; Fusing the abnormal data set with the original data set to obtain a fused data set; The fused data set is used to train an initial model constructed based on the XGBoost algorithm, and when the initial model meets the preset second performance requirement, a risk behavior identification model is generated; Based on the risk behavior identification model, risk identification is performed on the target behavior.

2. The risk behavior identification method according to claim 1, characterized in that: The collecting of raw data related to risk behavior identification and preprocessing of the raw data to obtain a raw data set includes: Collect raw data related to risk behavior identification from multiple data sources; After data cleaning, data conversion, data integration and data normalization are performed on the original data, an original data set is obtained.

3. The risk behavior identification method according to claim 1, characterized in that: The method of using the original data set to perform adversarial training on the generator and the discriminator in the GAN model, and generating a target GAN model when both the generator and the discriminator meet a preset first performance requirement, includes: Pre-constructing a GAN model; wherein the GAN model includes a generator and a discriminator; The original data set is used to perform adversarial training on the generator and the discriminator, and random noise is introduced during the training process. When both the generator and the discriminator meet the preset first performance requirement, a target GAN model is generated.

4. The risk behavior identification method according to claim 1, characterized in that: The step of inputting the acquired random noise vector into the target GAN model to generate an abnormal data set includes: Use a random number generation method to sample a random noise vector from a uniform distribution; Inputting the random noise vector into the generator of the target GAN model to generate abnormal data; The abnormal data is post-processed to obtain an abnormal data set.

5. The risk behavior identification method according to claim 1, characterized in that: The step of fusing the abnormal data set with the original data set to obtain a fused data set includes: Determining a data fusion strategy according to the training requirements of the initial model; Based on the data fusion strategy, the abnormal data set is fused with the original data set to form fused data; After the fused data is shuffled, a fused data set is obtained.

6. The risk behavior identification method according to claim 1, characterized in that: The initial model constructed based on the XGBoost algorithm is trained using the fusion data set, and when the initial model meets the preset second performance requirement, a risk behavior identification model is generated, including: Build an initial model based on the XGBoost algorithm in advance; Dividing the fused data set into a training data set and a test data set; Training the initial model according to the training data set, and verifying and evaluating the trained initial model according to the test data set; A verification and evaluation result is obtained, and when it is detected that the verification and evaluation result meets a preset second performance requirement, a risk behavior identification model is generated.

7. The risk behavior identification method according to any one of claims 1 to 6, characterized in that: The step of performing risk identification on the target behavior based on the risk behavior identification model includes: Determine the target behaviors for risk identification; Inputting the target behavior into the risk behavior identification model to generate a risk identification result; The risk identification result is output or displayed.

8. A risk behavior identification device, characterized in that: include: A collection module is used to collect raw data related to risk behavior identification and pre-process the raw data to obtain a raw data set; A first training module is used to perform adversarial training on the generator and the discriminator in the GAN model using the original data set, and when both the generator and the discriminator meet the preset first performance requirement, generate a target GAN model; An input module, used to input the acquired random noise vector into the target GAN model to generate an abnormal data set; A fusion module, used for fusing the abnormal data set with the original data set to obtain a fused data set; A second training module is used to train an initial model constructed based on the XGBoost algorithm using the fusion data set, and generate a risk behavior recognition model when the initial model meets a preset second performance requirement; The risk identification module is used to identify the risks of the target behavior based on the risk behavior identification model.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the risk behavior identification method as described in any one of claims 1-7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the risk behavior identification method according to any one of claims 1 to 7 is implemented.

Images