Risk control behavior early warning prediction method and system based on Al identification

Abstract

The invention provides a risk control behavior early warning and prediction method based on Al identification, and the method comprises the steps: building a risk control behavior early warning and prediction model through risk control behavior reinforcement feature big data during risk control behavior supervision and early warning; and the risk control behavior early warning prediction model can perform feature enhancement prediction on the risk control behavior and output a corresponding enhanced decision strategy prediction result, so that the decision matching range and content of the user risk control behavior data are expanded, and the supervision early warning strength on the user risk control behavior is enriched and expanded. Based on feature labeling information of each dimension, performing combined retrieval with enhanced features, retrieving a plurality of corresponding risk control decision strategies from a decision library through a large language model according to a combined retrieval logic, and feeding back the risk control decision strategies to a front end, so as to enhance the early warning response strength to the risk control behavior of the user, enhance the striking strength and range to the risk control behavior, and improve the risk control performance of the user. And multi-dimensional early warning management and control are realized. The AI model and the large language model are combined, intelligent management of risk control behaviors is achieved, and the risk control management efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of risk control AI early warning technology, and in particular to a risk control behavior early warning prediction method based on AI recognition and a risk control behavior early warning prediction system based on AI recognition, an electronic device and a computer-readable storage medium. Background Art

[0002] Financial risk control activities mainly involve four aspects: risk identification, risk assessment, risk control and risk monitoring: ‌Risk identification‌: Identify the risks that financial institutions and investors may face through market research, data analysis and risk models; ‌Risk assessment‌: quantify and evaluate the identified risks to determine their potential losses and probability of occurrence. Common methods include financial analysis, risk measurement and stress testing; ‌Risk control‌: taking measures to reduce or avoid losses before or at the early stage of a risk, such as diversified investment, risk transfer, and reasonable asset allocation; ‌Risk monitoring‌: Track and evaluate the risk control measures that have been taken to ensure their effectiveness, including regular reporting, risk indicators and internal controls.

[0003] In existing transactions, banks will monitor risk control behaviors and prevent risks, such as taking the following measures: 1. Customer education and publicity Banks regularly carry out anti-financial risk behavior publicity activities, and popularize the forms, hazards and preventive measures of telecommunications financial risk behaviors to customers through brochures, posters, videos and other forms. At the same time, bank staff will also take the initiative to remind and explain the knowledge of anti-financial risk behaviors to customers when handling business, so as to improve customers' awareness of prevention; 2. Real-name Account System and Identity Verification Banks strictly implement the real-name system for accounts to ensure the authenticity of customer identity information. In important links such as account opening and transfer, banks will conduct strict identity verification to prevent people from using false identities to engage in financial risk behaviors; 3. Transaction Monitoring and Early Warning Banks use big data analysis, model monitoring and other means to monitor and warn of abnormal transactions in real time. Once suspicious transactions are discovered, banks will immediately intercept and notify customers to help them avoid financial losses. IV. Rapid Response and Emergency Disposal Once a telecom financial risk behavior is discovered, the bank will immediately activate the emergency plan, assist customers in recovering losses, and report the case to the public security organs. At the same time, the bank will strengthen communication and cooperation with the public security organs, share clues and information on telecom financial risk behaviors in a timely manner, and jointly combat telecom financial risk behavior crimes.

[0004] Although the above scheme can perform certain risk control early warning monitoring, it can often only use risk control rules to warn of these abnormal trading behaviors and issue transaction warning notifications. For example, the invention patent with publication number CN118887012A discloses a transaction supervision system based on a risk control rule engine, which receives and analyzes risk control data, extracts features, identifies risk control scenarios based on these features, and matches rules that meet the feature conditions in the corresponding strategy rule set, and determines the optimal gradient according to the preset strategy combination mode; the action engine is used to execute operations corresponding to the optimal gradient. These all use risk control rules to trigger the execution of trading behaviors. Although they can identify trading behaviors based on the rule engine and issue early warnings, they also have the following disadvantages: First, the rules configured in the rule engine are limited, which means that when the rules are triggered later, the support that the risk control rules can provide is limited, and it is impossible to provide a richer risk control strategy for the currently identified risk control behavior; Second, the traditional risk control rule matching model can only match rules in a way that matches the rules with the risk control behavior data characteristics. The dimensions of its matching rules are usually relatively simple. For example, the early warning alarm rules are triggered only based on the transaction behavior pattern (such as large transfers, high-frequency transfers). Therefore, the matching dimensions of risk control rules are relatively small, and it is impossible to conduct early warning and control of risk control behaviors from multiple dimensions. Third, the matching of existing risk control rules (or decisions) is mainly based on keyword matching by the rule engine, which lacks intelligent decision retrieval support and is not intelligent enough. Summary of the invention

[0005] In order to solve the technical problems existing in the prior art, the present invention provides the following technical solutions: On the one hand, a risk control behavior early warning prediction method based on AI identification is provided, the method is implemented by an electronic device, and the method includes: S1. Collect historical risk control behavior data, use machine learning algorithms to extract risk control decision-making behavior features from the historical risk control behavior data and form a feature set; S2. Performing feature segmentation enhancement processing on the decision-making behavior features in the feature set through the LLM large language model, and outputting the enhanced decision-making behavior features to obtain a feature enhancement set; S3. feature labeling the feature enhancement set, wherein the labeling information includes decision priority and at least one of the following information: risk level, risk type, risk source or user behavior pattern; S4. Based on the annotated feature enhancement set, model training and learning are performed to build a risk control behavior early warning prediction model, which is deployed and applied after verification; S5. Monitor the user's risk control behavior data and input it into the risk control behavior early warning prediction model, and the risk control behavior early warning prediction model predicts and outputs the corresponding strategy prediction result to the LLM large language model; S6. Analyze the strategy prediction results through the LLM large language model, search the database and output the corresponding risk control decision data set.

[0006] Preferably, the step S1, collecting historical risk control behavior data, and using a machine learning algorithm to extract decision-making behavior features related to risk control in the historical risk control behavior data and forming a feature set, includes: Construct risk control data retrieval keywords and retrieval logic; Combining the risk control data search keywords and the search logic, constructing a large language model search prompt word and inputting a preset LLM large language model; The LLM large language model is used to search the database, and based on the large language model search prompt words, the decision behavior logs S(i) of several different risk control behaviors C(i) are retrieved and collected from the database to form the historical risk control behavior data M: M={C(i), S(i)}, i≥500; Traverse each group of data in the historical risk control behavior data M, and use a supervised learning algorithm to mine and extract the behavior feature Ct(i) in the risk control behavior C(i) and the decision behavior feature St(i) related to the behavior feature Ct(i) in the decision behavior log S(i); wherein, if a number of decision behavior features St(i) are extracted, calculate the correlation between each decision behavior feature St(i) and the behavior feature Ct(i), and take the decision behavior feature St(i) with the maximum correlation as the final decision behavior feature of the behavior feature Ct(i); Based on the statistics of each group of mining results, the feature set Mt is formed: Mt={Ct(i),St(i)}.

[0007] Preferably, the step S2, performing feature segmentation enhancement processing on the decision-making behavior features in the feature set through the LLM large language model, and outputting the enhanced decision-making behavior features to obtain a feature enhancement set, comprises: Construct the reinforcement logic about the decision-making behavior characteristics and output the preset LLM large language model; The feature set Mt is traversed by the LLM large language model, and feature segmentation enhancement processing is performed on the decision behavior feature St(i) corresponding to the behavior feature Ct(i) in the feature set Mt based on the enhancement logic, including: Extracting feature description text in the decision behavior feature St(i); The word segmenter performs word segmentation processing on the feature description text to generate a feature sequence corresponding to the feature description text; Based on the reinforcement logic, feature weighting processing is performed on each feature segmentation in the feature sequence to adjust the weight value of each decision feature segmentation; Output the enhanced decision feature segmentations of the decision behavior feature St(i) to obtain M(S): M(S)={St1(i),St2(i),...,St n (i)}, Among them, St n (i) segmenting the decision feature; Count the M(S) corresponding to the behavior feature Ct(i) to obtain the feature enhancement set Mt T : Mt T ={Ct(i),M(S)}.

[0008] Preferably, the S4, based on the annotated feature enhancement set, performs model training and learning, builds a risk control behavior early warning prediction model, and deploys and applies it after verification, including: Dividing the feature enhancement set into a training set and a validation set according to a preset ratio; Input the training set into a preset random forest model, perform feature training and learning on the model, and generate the risk control behavior early warning prediction model; The recognition performance of the risk control behavior early warning prediction model is verified using the verification set: If the verification is successful, the risk control behavior early warning prediction model is deployed and applied on the background server; If the verification fails, steps S1-S4 are repeated.

[0009] Preferably, the step S5, monitoring the user risk control behavior data and inputting the risk control behavior early warning prediction model, and having the risk control behavior early warning prediction model predict and output the corresponding strategy prediction result to the LLM large language model, includes: The system automatically monitors and collects user risk control behavior data; Using a supervised learning algorithm to mine and extract behavioral features from the user risk control behavior data and output the risk control behavior early warning prediction model; Through the risk control behavior early warning prediction model, identify and judge whether the behavior characteristics trigger relevant reinforcement characteristics: If triggered, the enhanced feature M(S) and its annotation information matching the behavior feature are output, and the enhanced feature M(S) and its annotation information are input into the LLM large language model as the strategy prediction result; If not triggered, a warning message will be issued.

[0010] Preferably, the step S6, analyzing the strategy prediction results by using the LLM large language model, searching the database and outputting the corresponding risk control decision data set, includes: Receiving the strategy prediction result and constructing a combination retrieval logic between the enhanced feature M(S) and the annotation information; According to the combined search logic, construct the corresponding large language model prompt word and input the preset LLM large language model; The LLM large language model performs a database search based on the large language model prompt words, and retrieves a number of corresponding risk control decision strategies from the decision database; The risk control decision strategies are counted and formed into a risk control decision data set, and the risk control decision data set is fed back to the front end.

[0011] On the other hand, a risk control behavior early warning prediction system based on AI recognition is provided, and the risk control behavior early warning prediction system based on AI recognition is used to implement the risk control behavior early warning prediction method based on AI recognition described above, and the system includes: A feature set building module is used to collect historical risk control behavior data, use machine learning algorithms to extract decision-making behavior features related to risk control in the historical risk control behavior data, and form a feature set; A feature enhancement module, used for performing feature segmentation enhancement processing on the decision-making behavior features in the feature set through the LLM large language model, and outputting the enhanced decision-making behavior features to obtain a feature enhancement set; A feature annotation module, used to perform feature annotation on the feature enhancement set, wherein the annotation information includes decision priority and at least one of the following information: risk level, risk type, risk source or user behavior pattern; The risk control model management module is used to conduct model training and learning based on the annotated feature enhancement set, build a risk control behavior early warning prediction model, and deploy and apply it after verification; A risk control supervision module is used to monitor the user's risk control behavior data and input it into the risk control behavior early warning prediction model, and the risk control behavior early warning prediction model predicts and outputs the corresponding strategy prediction results to the LLM large language model; The decision module is used to analyze the strategy prediction results through the LLM large language model, search the database and output the corresponding risk control decision data set.

[0012] On the other hand, an electronic device is provided, comprising: a processor; a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, any one of the risk control behavior warning and prediction methods based on AI identification described above is implemented.

[0013] On the other hand, a computer-readable storage medium is provided, in which at least one instruction is stored, and the at least one instruction is loaded and executed by a processor to implement any one of the above-mentioned risk control behavior warning and prediction methods based on AI identification. The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least: When the present invention supervises and warns of risk control behaviors, it uses the big data of risk control behavior reinforcement features to construct a risk control behavior warning prediction model, so that the risk control behavior warning prediction model can perform feature reinforcement prediction on risk control behaviors and output the corresponding reinforced decision strategy prediction results, thereby expanding the decision matching scope and content of user risk control behavior data, enriching and expanding the supervision and warning strength of user risk control behaviors. In addition, the present invention can also perform combined retrieval based on the information of each dimension of feature annotation and the reinforcement features, and perform library retrieval according to the combined retrieval logic through the large language model, retrieve the corresponding risk control decision strategies from the decision library and feed them back to the front end, thereby strengthening the warning response strength of user risk control behaviors, strengthening the intensity and scope of the crackdown on risk control behaviors, and realizing multi-dimensional warning management and control.

[0014] The present invention combines AI models and large language models to greatly realize the intelligent management of risk control behaviors and improve the efficiency of risk control management. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 This is a flow chart of a risk control behavior early warning prediction method based on AI identification provided by an embodiment of the present invention; Figure 2 This is a schematic diagram of a front-end and back-end interaction process provided by an embodiment of the present invention; Figure 3 is a schematic diagram of an application of a large language model provided by an embodiment of the present invention; Figure 4 It is a schematic diagram of a training process of an AI model provided by an embodiment of the present invention; Figure 5It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0018] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0019] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0020] In the embodiments of the present invention, sometimes a subscript such as W1 may be mistakenly written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are consistent.

[0021] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0022] The present invention can be used in financial institutions, e-commerce platforms, etc. to perform risk control behavior identification and prediction and early warning.

[0023] The user risk control behavior data, for example, can be related to risk control behavior, such as abnormal transaction amount, abnormal transaction frequency, abnormal transaction location, abnormal user behavior pattern, such as high-value transactions, frequent transactions, and remote transactions. The risk control system (risk engine / rule engine, etc.) will match the corresponding risk control warning strategy or respond to and execute the corresponding decision-making behavior for different user risk control behaviors. These historical decisions will constitute historical risk control behavior data, which contains decision big data. Therefore, the present invention will use big data technology, based on the feature model training application and LLM auxiliary reinforcement, to use risk control behavior to strengthen feature big data to build a risk control behavior warning prediction model, so that the risk control behavior warning prediction model (or the warning model / AI model) can perform feature-enhanced prediction on the risk control behavior and output the corresponding enhanced decision strategy prediction results, so as to expand the decision matching scope and content of user risk control behavior data, and enrich and expand the supervision and warning of user risk control behavior.

[0024] The application principle of the present invention will be described in detail below.

[0025] The embodiment of the present invention provides a risk control behavior early warning prediction method based on AI identification, which can be implemented by an electronic device, which can be a terminal or a server. Figure 1 The flowchart of the risk control behavior early warning prediction method based on AI identification is shown, and the processing flow of the method may include the following steps: S1. Collect historical risk control behavior data, use machine learning algorithms to extract risk control decision-making behavior features from the historical risk control behavior data and form a feature set; S2. Performing feature segmentation enhancement processing on the decision-making behavior features in the feature set through the LLM large language model, and outputting the enhanced decision-making behavior features to obtain a feature enhancement set; S3. feature labeling the feature enhancement set, wherein the labeling information includes decision priority and at least one of the following information: risk level, risk type, risk source or user behavior pattern; S4. Based on the annotated feature enhancement set, model training and learning are performed to build a risk control behavior early warning prediction model, which is deployed and applied after verification; S5. Monitor the user's risk control behavior data and input it into the risk control behavior early warning prediction model, and the risk control behavior early warning prediction model predicts and outputs the corresponding strategy prediction result to the LLM large language model; S6. Analyze the strategy prediction results through the LLM large language model, search the database and output the corresponding risk control decision data set.

[0026] When the present invention supervises and warns of risk control behaviors, it uses the big data of risk control behavior reinforcement features to construct a risk control behavior warning prediction model, so that the risk control behavior warning prediction model can perform feature reinforcement prediction on risk control behaviors and output the corresponding reinforced decision strategy prediction results, thereby expanding the decision matching scope and content of user risk control behavior data, enriching and expanding the supervision and warning strength of user risk control behaviors. In addition, the present invention can also perform combined retrieval based on the information of each dimension of feature annotation and the reinforcement features, and perform library retrieval according to the combined retrieval logic through the large language model, retrieve the corresponding risk control decision strategies from the decision library and feed them back to the front end, thereby strengthening the warning response strength of user risk control behaviors, strengthening the intensity and scope of the crackdown on risk control behaviors, and realizing multi-dimensional warning management and control.

[0027] like Figure 2As shown, it is a schematic diagram of the interaction between the front-end and back-end of the present invention. The front-end can monitor the risk control behavior of the user, collect the corresponding user risk control behavior data and transmit it to the back-end, and the back-end uses the deployed "risk control behavior early warning prediction model" to perform decision-making reinforcement prediction and early warning on the user risk control behavior data, and then the LLM large language model analyzes the decision reinforcement prediction structure, that is, the strategy prediction result, and further searches the library to retrieve and output the corresponding risk control decision data set, so that the front-end can perform risk control management on the user risk control behavior data.

[0028] Preferably, the step S1, collecting historical risk control behavior data, and using a machine learning algorithm to extract decision-making behavior features related to risk control in the historical risk control behavior data and forming a feature set, includes: Construct risk control data retrieval keywords and retrieval logic; Combining the risk control data search keywords and the search logic, constructing a large language model search prompt word and inputting a preset LLM large language model; The LLM large language model is used to search the database, and based on the large language model search prompt words, the decision behavior logs S(i) of several different risk control behaviors C(i) are retrieved and collected from the database to form the historical risk control behavior data M: M={C(i), S(i)}, i≥500; Traverse each group of data in the historical risk control behavior data M, and use a supervised learning algorithm to mine and extract the behavior feature Ct(i) in the risk control behavior C(i) and the decision behavior feature St(i) related to the behavior feature Ct(i) in the decision behavior log S(i); wherein, if a number of decision behavior features St(i) are extracted, calculate the correlation between each decision behavior feature St(i) and the behavior feature Ct(i), and take the decision behavior feature St(i) with the maximum correlation as the final decision behavior feature of the behavior feature Ct(i); Based on the statistics of each group of mining results, the feature set Mt is formed: Mt={Ct(i),St(i)}.

[0029] Historical risk control behavior data, including but not limited to transaction records, user behavior logs, risk event reports, risk control warning behaviors such as high-value transactions, frequent transactions, and transactions in different places, and decision strategies (or rules) for system responses, that is, to retrieve several groups of risk control behaviors (behavior data that triggers risk control) and their decision behavior logs (risk control rules / decision data for system responses). Preprocessing after collection: ‌Data cleaning‌: Remove duplications, errors, missing values, etc. in the data to ensure data quality.

[0030] ‌Data standardization‌: Unify data types and formats to facilitate subsequent analysis.

[0031] ‌Data Desensitization‌: Desensitize sensitive data while protecting user privacy.

[0032] like Figure 3 As shown, the present invention uses the LLM large language model to retrieve historical risk control behavior data, including retrieving decision-making behavior logs corresponding to risk control behaviors. The LLM large language model can be trained by users, or a third-party model (such as Baidu Wenxin Yiyan) can be called through the background LLM interface. The administrator can construct risk control data retrieval keywords (such as keywords related to financial risk behavior such as "off-site transactions" and "false contracts") and retrieval logic (such as "completed transactions", "withdrawal of transactions after warning", "non-revocation of transactions after warning" and other retrieval logic, which can be configured by the administrator); combine the risk control data retrieval keywords and the retrieval logic to construct a large language model retrieval prompt word and input the preset LLM large language model.

[0033] In order to combine the risk control data retrieval keywords and retrieval logic to construct the search prompt words of the large language model (LLM) and input them into the preset LLM, you can refer to the following steps to design prompt words to ensure accuracy and effectiveness: 1. Determine the keywords for risk control data retrieval First, according to the needs of risk control business, determine a set of keywords related to risk identification, assessment, monitoring, etc. These keywords may include "credit risk", "transaction abnormality", etc., depending on the objectives and scope of the risk control system.

[0034] 2. Design search logic Next, design a set of search logic to guide how to use these keywords for searching. The search logic may include Boolean logic operators (such as AND, OR, NOT) to combine keywords, or sort based on the weight and relevance of keywords. In addition, you can also consider using advanced search techniques such as regular expressions and fuzzy matching to improve the flexibility and accuracy of the search.

[0035] 3. Construct search hint words Based on the determined keywords and search logic, construct the search prompt words of the large language model. The prompt words should clearly and concisely express the search intention and guide the LLM to generate text or answers related to risk control. For example, the prompt words can be: "Please search and generate text related to risk control based on the following keywords and logic: Logic = keyword 1 AND keyword 2." 4. Input LLM large language model Input the constructed search prompt words into the preset LLM large language model. LLM will generate text or answers related to risk control based on the prompt words.

[0036] 5. Processing and interpreting the output The output generated by LLM may be a piece of text, an answer, or multiple candidate results. The output needs to be processed and interpreted to extract key information related to risk control. This may include tasks such as text summarization, keyword extraction, and sentiment analysis. At the same time, the quality and accuracy of the output also need to be evaluated to ensure that it meets the needs of the risk control system.

[0037] The LLM large language model searches the database (background policy database / decision database, etc., where a large number of rule decisions are configured for LLM database search and retrieval, and can also interact with the decision engine to complete the search) and retrieves and collects decision behavior logs S(i) of several different risk control behaviors C(i) from the database based on the large language model search prompt words to form the historical risk control behavior data M: M={C(i), S(i)}, i≥500; Through retrieval, several groups of historical risk control behavior data consisting of different risk control behaviors C(i) and corresponding decision behavior logs S(i) can be obtained and form a set M.

[0038] Next, feature engineering is performed to extract the corresponding features and their correlations in each set of data: Traverse each group of data in the historical risk control behavior data M, and use a supervised learning algorithm to mine and extract the behavior feature Ct(i) in the risk control behavior C(i) and the decision behavior feature St(i) related to the behavior feature Ct(i) in the decision behavior log S(i); wherein, if a number of decision behavior features St(i) are extracted, calculate the correlation between each decision behavior feature St(i) and the behavior feature Ct(i), and take the decision behavior feature St(i) with the maximum correlation as the final decision behavior feature of the behavior feature Ct(i); Based on the statistics of each group of mining results, the feature set Mt is formed: Mt={Ct(i),St(i)}.

[0039] Feature extraction: Extract useful features from raw data using statistical methods, machine learning algorithms, etc.

[0040] ‌Feature transformation‌: Perform necessary transformations on features, such as discretization and normalization, to improve the performance of the model.

[0041] The behavioral characteristics in financial risk behavior data mainly include transaction behavior characteristics, account characteristics, relationship characteristics and other related characteristics.

[0042] 1. Transaction behavior characteristics: including transaction amount, transaction frequency, transaction time and transaction location, etc.

[0043] Extraction method: Through statistical analysis of transaction records, abnormal transaction behaviors can be identified, such as high-value transactions, frequent transactions, and transactions in different locations. 2. Account characteristics: including account type, account balance, account activity, account historical transaction records, etc.

[0044] Extraction method: Analyze the basic information and historical transaction data of the account to identify fake or abnormal accounts. 3. Relationship characteristics: mainly describe the relationship network between accounts, such as transaction relationships, contact relationships and joint accounts.

[0045] Extraction method: By analyzing the transaction records and related information between accounts, a relationship network is constructed and abnormal relationships are identified. 4. Other related features: such as text features (finding clues by analyzing text data such as transaction records and account registration information) and image features (determining the authenticity of an account by analyzing image data such as user portraits and ID cards). 5. When extracting these features, machine learning and data mining algorithms can be used to automatically extract key features from large amounts of data. Commonly used feature extraction methods include principal component analysis (PCA), factor analysis (FA), independent component analysis (ICA), etc. The present invention uses a supervised learning algorithm to mine and extract the behavior feature Ct(i) in the risk control behavior C(i) and the decision behavior feature St(i) related to the behavior feature Ct(i) in the decision behavior log S(i). The supervised learning algorithm is as follows: ‌Logistic Regression‌: Applicable to binary classification problems, it can mine features that have a significant impact on the classification results through feature importance analysis; ‌Support Vector Machine (SVM): It performs well in processing high-dimensional data and can find the optimal hyperplane to distinguish different categories of data; Decision Tree: A tree structure is constructed by recursively splitting the data set. Each node represents a judgment on a feature and can be used to extract important behavioral features. ‌Random Forest‌: It consists of multiple decision trees and uses ensemble learning to improve the stability and accuracy of the model while being able to evaluate the importance of features.

[0046] For example, the steps of using decision trees to mine and extract behavioral features from risk control behavior data and decision-making behavioral features related to behavioral features can be referred to as follows: 1. Data Preparation ‌Data Collection‌: Traverse each set of data in the historical risk control behavior data M and collect the original data set containing behavior data from the risk control system. These data may include user transaction records, login behavior, device information, geographic location, etc.

[0047] ‌Data cleaning‌: Preprocess the raw data, including removing duplicate data, processing missing values, detecting and processing outliers, etc., to ensure data quality.

[0048] ‌Data conversion‌: Convert the original data into a format suitable for decision tree algorithm processing, such as converting categorical data into numerical data (such as using one-hot encoding), standardizing or normalizing continuous data, etc.

[0049] 2. Feature Selection ‌Preliminary feature screening‌: Based on business understanding and experience, preliminary screening of behavioral features that may be related to risk control.

[0050] ‌Feature importance assessment‌: Use decision tree algorithms or other feature selection methods (such as random forest, LASSO, etc.) to evaluate the importance of each feature and select features that have a significant impact on risk control decisions.

[0051] 3. Build a decision tree model ‌Select a decision tree algorithm‌: Select an appropriate decision tree algorithm (such as CART, ID3, C4.5, etc.) based on data characteristics and risk control requirements.

[0052] ‌Set parameters‌: According to the algorithm requirements and the size of the data set, set the decision tree depth, splitting criteria (such as Gini impurity, information gain, etc.), minimum number of samples and other parameters.

[0053] ‌Training model‌: Use the prepared data set to train the decision tree model to obtain a decision tree that contains behavioral features and decision paths.

[0054] 4. Extract behavioral features ‌Traverse the decision tree‌: Traverse each node and branch of the decision tree, and record the behavioral characteristics represented by each node and its splitting conditions.

[0055] Feature encoding: Encode the behavioral features in the decision tree for subsequent processing and analysis.

[0056] 5. Extract decision-making behavior features Decision Path Analysis: Analyze each decision path from the root node to the leaf node to understand how different behavioral characteristics combine to affect risk control decisions.

[0057] Decision rule extraction: Based on the decision path, easy-to-understand and explain risk control decision rules are extracted, such as "if the transaction amount is greater than X and the transaction location is Y, then mark it as a high-risk transaction."

[0058] 6. Model evaluation and optimization ‌Model Evaluation‌: Use metrics such as cross validation, accuracy, recall, and F1 score to evaluate the performance of the decision tree model.

[0059] ‌Model optimization‌: Based on the evaluation results, adjust the parameters of the decision tree, add or delete features, improve data preprocessing, etc. to optimize the model performance.

[0060] Through the above steps, the decision tree algorithm can be used to effectively mine and extract behavioral features in risk control behavior data and decision-making behavior features related to behavioral features, providing strong support for risk control decisions.

[0061] The decision behavior feature St(i) related to the behavior feature Ct(i) is mined; based on the statistics of each group of mining results, the feature set Mt is formed: Mt={Ct(i), St(i)}.

[0062] Among them, if several decision-making behavior features St(i) are extracted, the correlation between each decision-making behavior feature St(i) and the behavior feature Ct(i) is calculated, and the decision-making behavior feature St(i) with the maximum correlation is taken as the final decision-making behavior feature of the behavior feature Ct(i). For a certain behavior, multiple risk control decisions may appear. Therefore, if multiple decision-making behavior features are extracted, the correlation between each decision-making behavior feature and the behavior feature is calculated, and the decision-making behavior feature with the maximum correlation is found as the final decision-making behavior feature corresponding to the behavior feature to avoid feature correlation redundancy. The correlation calculation can be used, for example: ‌Chi-Square Test‌: Mainly used for correlation analysis between categorical variables. : Determine whether two variables are independent by comparing the difference between the actual observed value and the expected observed value.

[0063] ‌Mutual Information‌: It is used to measure the amount of shared information between two variables, not limited to linear relationships. It calculates the information gain between two variables based on probability density function or probability distribution.

[0064] ‌Cosine Similarity‌: Commonly used for feature similarity calculation in text data or high-dimensional sparse data. The feature vectors are regarded as points in the vector space, and the cosine angle between them is calculated to measure the similarity.

[0065] Preferably, the step S2, performing feature segmentation enhancement processing on the decision-making behavior features in the feature set through the LLM large language model, and outputting the enhanced decision-making behavior features to obtain a feature enhancement set, comprises: Construct the reinforcement logic about the decision-making behavior characteristics and output the preset LLM large language model; The feature set Mt is traversed by the LLM large language model, and feature segmentation enhancement processing is performed on the decision behavior feature St(i) corresponding to the behavior feature Ct(i) in the feature set Mt based on the enhancement logic, including: Extracting the feature description text (that is, the text composed of several feature keywords) in the decision-making behavior feature St(i); The word segmenter performs word segmentation processing on the feature description text to generate a feature sequence corresponding to the feature description text; Based on the reinforcement logic, feature weighting processing is performed on each feature segmentation in the feature sequence to adjust the weight value of each decision feature segmentation; Output the enhanced decision feature segmentations of the decision behavior feature St(i) to obtain M(S): M(S)={St1(i),St2(i),...,St n (i)}, Among them, St n (i) segmenting the decision feature; Count the M(S) corresponding to the behavior feature Ct(i) to obtain the feature enhancement set Mt T : Mt T ={Ct(i),M(S)}.

[0066] The present invention utilizes a large language model to automatically perform feature enhancement processing on the decision-making behavior features of the corresponding behavior features. The large language model is used to perform feature word segmentation processing on the decision-making behavior features, thereby performing word segmentation and enhancement processing on the features in the decision-making behavior features to generate a corresponding feature sequence, which contains a number of extended texts that are similar or close to the feature words in the decision-making behavior features, so as to enrich and expand the decision-making behavior features for the behavior features. The feature content of the decision-making behavior features corresponding to the behavior features is enriched and enhanced, and subsequently, based on the identified behavior features, the model can recommend and output richer decision strategies (according to the enhanced recommended decisions / rules). A more extensive and powerful decision control is performed on the behavior risk control behavior.

[0067] Administrators can determine the reinforcement logic of the decision-making behavior features of the corresponding behavior features. Administrators can set the feature word reinforcement logic of the decision-making behavior features, such as from which dimensions or from the word segmentation reinforcement processing logic (word segmentation vector, word segmentation range, word segmentation weight configuration rules, etc.) to perform feature reinforcement, build the corresponding reinforcement logic and input it into the model. Let the model perform word segmentation reinforcement processing based on the input prompt words containing reinforcement logic, so as to generate feature reinforcement word segmentation text information of the decision-making behavior features of the corresponding behavior features. This can be understood in conjunction with the prompt word generation and retrieval process of the above LLM.

[0068] The LLM large language model traverses each decision behavior feature St(i) corresponding to the behavior feature Ct(i) in the feature set Mt and performs reinforcement processing, which can refer to the following steps: 1. Word segmentation Word segmentation is one of the basic tasks of natural language processing. It cuts text data into individual words or phrases for subsequent processing and analysis.

[0069] ‌Input text‌: First, you need to input text data containing characteristic keywords into the large language model.

[0070] ‌Word segmentation‌: The large language model will use its own word segmenter to segment the input text. These word segmenters are usually based on deep learning technology and can automatically learn and identify word boundaries and phrase structures in the text.

[0071] ‌Output word segmentation results‌: After word segmentation is completed, the large language model will output a word sequence after word segmentation. This sequence contains all the words and phrases in the text.

[0072] 2. Feature Enhancement Feature enhancement is to further weight or highlight feature keywords based on word segmentation processing to increase their influence in subsequent models.

[0073] ‌Identify characteristic keywords‌: In the word segmentation results, the semantic understanding ability of the large language model can be used to identify characteristic keywords related to the task. These keywords may be nouns, verbs, adjectives, etc., depending on the requirements of the task.

[0074] ‌Weighted processing‌: For the identified characteristic keywords, they can be weighted. For example, the representation of these keywords in the model can be strengthened by increasing the frequency of the keywords, adjusting the weight value in their vector representation, etc.

[0075] ‌Constructing feature vectors‌: After weighted processing, the word segmentation results can be converted into feature vectors. These vectors can be used as input for subsequent machine learning or deep learning models to train models and complete tasks.

[0076] Here, by "building a feature vector", the word segmenter performs word segmentation processing on the feature description text to generate a feature sequence corresponding to the feature description text; based on the reinforcement logic, feature weighting processing is performed on each feature segmentation in the feature sequence to adjust the weight value of each decision feature segmentation. The reinforcement logic describes the weight configuration rules of the feature segmentation, such as configuring the weight according to the correlation between the feature segmentation and the behavior feature (for example, determining the weight according to the proportion of the correlation (the proportion of a single correlation in the sum of all correlations).

[0077] After the weights are configured, the weighted feature segmentations are obtained, and the enhanced decision feature segmentations of the decision behavior feature St(i) are output to obtain M(S): M(S)={St1(i),St2(i),...,St n (i)}, Among them, St n (i) segmenting the decision feature; Count the M(S) corresponding to the behavior feature Ct(i) to obtain the feature enhancement set Mt T : Mt T ={Ct(i),M(S)}.

[0078] In this way, the behavioral characteristics of each risk control behavior are configured with a decision feature set after feature enhancement, which can subsequently enable the model to identify and predict the output of a broad range of decision features and a number of decision-making decisions / rules for corresponding risk control behaviors, thereby preventing current risk control behaviors in an expanded manner and strengthening risk prevention efforts.

[0079] Preferably, the S4, based on the annotated feature enhancement set, performs model training and learning, builds a risk control behavior early warning prediction model, and deploys and applies it after verification, including: Dividing the feature enhancement set into a training set and a validation set according to a preset ratio; Input the training set into a preset random forest model, perform feature training and learning on the model, and generate the risk control behavior early warning prediction model; The recognition performance of the risk control behavior early warning prediction model is verified using the verification set: If the verification is successful, the risk control behavior early warning prediction model is deployed and applied on the background server; If the verification fails, steps S1-S4 are repeated.

[0080] like Figure 4 As shown, the model training will be carried out based on the enhanced feature level next. The present invention adopts a random forest model to train the risk control behavior early warning prediction model for the above-mentioned annotated feature enhancement set, and constructs the model architecture of the random forest model and its model training and application. The description of the random forest model in the prior art can be referred to. The feature enhancement set is divided into a training set and a validation set in a ratio of 8:2. The enhanced training set is used as the input of the random forest model to perform model feature training and learning to generate a risk control behavior early warning prediction model, and then the validation set is used to input, verify and identify the recognizability of the model. If the recognition is successful, the early warning prediction model is deployed on the background server for risk control decision early warning prediction of the risk control behavior monitored by the front-end; if the verification fails, the above steps are repeated and the model is retrained. The model training and verification of the random forest model can refer to the following steps: Model training and optimization ‌Training data set partitioning‌: Divide the data set into training set and validation set for model training, validation, and evaluation.

[0081] ‌Model training‌: Use the training set data to train the model to obtain a preliminary risk behavior identification model.

[0082] ‌Model Optimization‌: Improve the performance and accuracy of the model by adjusting model parameters, optimizing feature selection, using ensemble learning methods, etc.

[0083] ‌Model evaluation‌: Use the validation set data to evaluate the model, calculate indicators such as accuracy, recall, F1 score, and evaluate the performance of the model.

[0084] ‌Cross-validation‌: Use methods such as cross-validation to further verify the stability and generalization ability of the model.

[0085] ‌Model deployment‌: Deploy the trained risk behavior identification model to the actual business system for real-time monitoring and identification of risky behaviors.

[0086] ‌Model Monitoring‌: Continuously monitor the performance of the model in actual applications to promptly detect and address problems such as model performance degradation or false positives.

[0087] ‌Data Feedback‌: Collect new data from practical applications for continuous improvement and iteration of the model.

[0088] ‌Feature Update‌: Regularly update feature engineering based on business changes and data characteristics to improve the adaptability of the model.

[0089] ‌Model upgrade‌: With the development of business and advancement of technology, model algorithms will be upgraded in a timely manner to improve the accuracy and efficiency of risk identification.

[0090] Preferably, the step S5, monitoring the user risk control behavior data and inputting the risk control behavior early warning prediction model, and having the risk control behavior early warning prediction model predict and output the corresponding strategy prediction result to the LLM large language model, includes: The system automatically monitors and collects user risk control behavior data; Using a supervised learning algorithm to mine and extract behavioral features from the user risk control behavior data and output the risk control behavior early warning prediction model; Through the risk control behavior early warning prediction model, identify and judge whether the behavior characteristics trigger relevant reinforcement characteristics: If triggered, the enhanced feature M(S) and its annotation information matching the behavior feature are output, and the enhanced feature M(S) and its annotation information are input into the LLM large language model as the strategy prediction result; If not triggered, a warning message will be issued.

[0091] The steps of the system monitoring user risk control behavior data can continue to use the existing risk behavior supervision, such as the bank's supervision model for risky trading behaviors, etc. When the front end monitors possible risky behaviors, the corresponding user risk control behavior data will be automatically collected and fed back to the back end.

[0092] In the background, we first use machine learning algorithms to mine the behavioral features in the current user risk control behavior data, and then input the mined behavioral features into the risk control behavior early warning prediction model deployed in the background. The method of using supervised learning algorithms to mine and extract corresponding behavioral features can refer to the algorithm feature mining method described above.

[0093] The model can identify the current behavior characteristics and predict and output the enhanced characteristics that match the current behavior characteristics. Because the decision-making behavior characteristics corresponding to the corresponding behavior characteristics have been previously subjected to feature segmentation and enhancement processing, the model can output a set of enhanced characteristics that match the behavior characteristics, output several enhanced characteristics related to the behavior characteristics, and can also output the annotation information marked on the corresponding characteristics. The decision characteristics output by the model can be used to retrieve the corresponding decision strategies or decision rules (LLM combines the enhanced characteristics or their annotation information to perform combined retrieval and expand the search scope), and retrieve the risk control decision strategies or risk control management rules containing the corresponding decision characteristics from the library. In the present invention, because the information is annotated on the corresponding characteristics, the annotation information of the corresponding characteristics can be combined with the annotation information of the corresponding characteristics to retrieve the risk control decision strategies containing the corresponding characteristics and the corresponding annotation information. For example, based on a certain feature segmentation output by the current model, combined with the risk level or risk type marked by it, a more representative risk control decision strategy can be comprehensively retrieved, which can be used for targeted management and early warning defense of risk control behaviors; according to the risk type or user behavior pattern marked by the corresponding feature, the user risk control behavior of the corresponding type or pattern can be matched with the corresponding risk control decision strategy and targeted. This can be understood in combination with the above model generation principle.

[0094] Preferably, the step S6, analyzing the strategy prediction results by using the LLM large language model, searching the database and outputting the corresponding risk control decision data set, includes: Receiving the strategy prediction result and constructing a combination retrieval logic between the enhanced feature M(S) and the annotation information; According to the combined search logic, construct the corresponding large language model prompt word and input the preset LLM large language model; The LLM large language model performs a database search based on the large language model prompt words, and retrieves a number of corresponding risk control decision strategies from the decision database; The risk control decision strategies are counted and formed into a risk control decision data set, and the risk control decision data set is fed back to the front end.

[0095] Combined search logic, including the following search information: Each strengthening feature M(S); The combination of each enhanced feature M(S) and each of the annotation information includes the enhanced feature M(S) and the search term of decision priority, the enhanced feature M(S) and the search term of decision priority and risk level, risk type, risk source or user behavior pattern.

[0096] LLM can search the database based on the characteristic keywords in each search information (if it is a combined search, there are other keywords in the corresponding combined search information, such as the "characteristic keywords" + "decision priority" of the enhanced feature M (S), etc.) and search the database based on the characteristic keywords and search logic (here we first build the model prompt words, which can be understood in combination with the construction of the previous prompt words), and let LLM retrieve and output several decision strategy information that meet the prompt words from the strategy library.

[0097] By following the enhanced features and annotation information of the corresponding risk control behaviors, intelligent combined retrieval can be achieved, thereby expanding the retrieval and matching of decision-making strategies for risk control behaviors, providing richer risk management strategies and corresponding decision-making rules for current risk control behaviors, and taking strict precautions against current risk control behaviors.

[0098] Therefore, the present invention combines AI models and large language models to greatly realize the intelligent management of risk control behaviors and improve the efficiency of risk control management.

[0099] On the other hand, a risk control behavior early warning prediction system based on AI recognition is provided, and the risk control behavior early warning prediction system based on AI recognition is used to implement the risk control behavior early warning prediction method based on AI recognition described above, and the system includes: A feature set building module is used to collect historical risk control behavior data, use machine learning algorithms to extract decision-making behavior features related to risk control in the historical risk control behavior data, and form a feature set; A feature enhancement module, used for performing feature segmentation enhancement processing on the decision-making behavior features in the feature set through the LLM large language model, and outputting the enhanced decision-making behavior features to obtain a feature enhancement set; A feature annotation module, used to perform feature annotation on the feature enhancement set, wherein the annotation information includes decision priority and at least one of the following information: risk level, risk type, risk source or user behavior pattern; The risk control model management module is used to conduct model training and learning based on the annotated feature enhancement set, build a risk control behavior early warning prediction model, and deploy and apply it after verification; A risk control supervision module is used to monitor the user's risk control behavior data and input it into the risk control behavior early warning prediction model, and the risk control behavior early warning prediction model predicts and outputs the corresponding strategy prediction results to the LLM large language model; The decision module is used to analyze the strategy prediction results through the LLM large language model, search the database and output the corresponding risk control decision data set.

[0100] Please understand and implement the functions and interactions of each module of this system in conjunction with the corresponding steps in the above method, which will not be repeated here.

[0101] Figure 5 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, such as Figure 5 As shown, the electronic device may include the above-mentioned risk control behavior early warning prediction system based on AI identification. Optionally, the electronic device 410 may include a first processor 2001.

[0102] Optionally, the electronic device 410 may further include a memory 2002 and a transceiver 2003 .

[0103] The first processor 2001, the memory 2002 and the transceiver 2003 may be connected via a communication bus.

[0104] Combine the following Figure 5 The components of the electronic device 410 are described in detail: The first processor 2001 is the control center of the electronic device 410, and may be a processor or a general term for multiple processing elements. For example, the first processor 2001 is one or more central processing units (CPUs), or may be application specific integrated circuits (ASICs), or may be one or more integrated circuits configured to implement the embodiments of the present invention, such as one or more microprocessors (digital signal processors, DSPs), or one or more field programmable gate arrays (field programmable gate arrays, FPGAs).

[0105] Optionally, the first processor 2001 can execute various functions of the electronic device 410 by running or executing a software program stored in the memory 2002 and calling data stored in the memory 2002 .

[0106] In a specific implementation, as an embodiment, the first processor 2001 may include one or more CPUs, such as Figure 5 CPU0 and CPU1 are shown in FIG.

[0107] In a specific implementation, as an embodiment, the electronic device 410 may also include multiple processors, such as Figure 5 The first processor 2001 and the second processor 2004 are shown in FIG. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0108] The memory 2002 is used to store the software program for executing the solution of the present invention, and is controlled to be executed by the first processor 2001. The specific implementation method can refer to the above method embodiment, which will not be repeated here.

[0109] Optionally, the memory 2002 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 2002 may be integrated with the first processor 2001, or may exist independently and access the first processor 2001 through the interface circuit ( Figure 5 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0110] The transceiver 2003 is used to communicate with a network device or a terminal device.

[0111] Optionally, the transceiver 2003 may include a receiver and a transmitter ( Figure 5 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0112] Optionally, the transceiver 2003 may be integrated with the first processor 2001, or may exist independently and communicate with the first processor 2001 through the interface circuit ( Figure 5 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0113] It should be noted that Figure 5 The structure of the electronic device 410 shown in the figure does not constitute a limitation on the router, and the actual knowledge structure recognition device may include more or fewer components than those shown in the figure, or combine certain components, or arrange the components differently.

[0114] In addition, the technical effects of the electronic device 410 can refer to the technical effects of the risk control behavior warning prediction method based on Al identification described in the above method embodiment, which will not be repeated here.

[0115] It should be understood that the first processor 2001 in the embodiment of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0116] It should also be understood that the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0117] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable system. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0118] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0119] In the present invention, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0120] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0121] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0122] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices, systems and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0123] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of the system or unit, which can be electrical, mechanical or other forms.

[0124] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0125] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0126] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0127] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A risk control behavior early warning prediction method based on AI identification, characterized in that: The method comprises: S1. Collect historical risk control behavior data, use machine learning algorithms to extract risk control decision-making behavior features from the historical risk control behavior data and form a feature set; S2. Performing feature segmentation enhancement processing on the decision-making behavior features in the feature set through the LLM large language model, and outputting the enhanced decision-making behavior features to obtain a feature enhancement set; S3. feature labeling the feature enhancement set, wherein the labeling information includes decision priority and at least one of the following information: risk level, risk type, risk source or user behavior pattern; S4. Based on the annotated feature enhancement set, model training and learning are performed to build a risk control behavior early warning prediction model, which is deployed and applied after verification; S5, monitoring the user's risk control behavior data and inputting it into the risk control behavior early warning prediction model, and the risk control behavior early warning prediction model predicts and outputs the corresponding strategy prediction result to the LLM large language model; S6. Analyze the strategy prediction results through the LLM large language model, search the database and output the corresponding risk control decision data set.

2. The risk control behavior early warning and prediction method based on AI identification according to claim 1 is characterized in that: S1, collecting historical risk control behavior data, using machine learning algorithms to extract decision-making behavior features related to risk control in the historical risk control behavior data and forming a feature set, including: Construct risk control data retrieval keywords and retrieval logic; Combining the risk control data search keywords and the search logic, constructing a large language model search prompt word and inputting a preset LLM large language model; The LLM large language model is used to search the database, and based on the large language model search prompt words, the decision behavior logs S(i) of several different risk control behaviors C(i) are retrieved and collected from the database to form the historical risk control behavior data M: M={C(i), S(i)}, i≥500; Traverse each group of data in the historical risk control behavior data M, and use a supervised learning algorithm to mine and extract the behavior feature Ct(i) in the risk control behavior C(i) and the decision behavior feature St(i) related to the behavior feature Ct(i) in the decision behavior log S(i); wherein, if a number of decision behavior features St(i) are extracted, calculate the correlation between each decision behavior feature St(i) and the behavior feature Ct(i), and take the decision behavior feature St(i) with the maximum correlation as the final decision behavior feature of the behavior feature Ct(i); Based on the statistics of each group of mining results, the feature set Mt is formed: Mt={Ct(i),St(i)}.

3. The risk control behavior early warning and prediction method based on AI identification according to claim 2 is characterized in that: The step S2, performing feature segmentation enhancement processing on the decision-making behavior features in the feature set through the LLM large language model, and outputting the enhanced decision-making behavior features to obtain a feature enhancement set, includes: Construct the reinforcement logic about the decision-making behavior characteristics and output the preset LLM large language model; The feature set Mt is traversed by the LLM large language model, and feature segmentation enhancement processing is performed on the decision behavior feature St(i) corresponding to the behavior feature Ct(i) in the feature set Mt based on the enhancement logic, including: Extracting feature description text in the decision behavior feature St(i); The word segmenter performs word segmentation processing on the feature description text to generate a feature sequence corresponding to the feature description text; Based on the reinforcement logic, feature weighting processing is performed on each feature segmentation in the feature sequence to adjust the weight value of each decision feature segmentation; Output the enhanced decision-making behavior feature St (i) of each decision feature segmentation, and obtain M (S): M(S)={St1(i),St2(i),...,St n (i)}, Among them, St n (i) segmenting the decision feature; Count the M(S) corresponding to the behavior feature Ct(i) to obtain the feature enhancement set Mt T : Mt T ={Ct(i),M(S)}。 4. The risk control behavior early warning and prediction method based on AI identification according to claim 3 is characterized in that: S4, based on the annotated feature enhancement set, conducts model training and learning, builds a risk control behavior early warning prediction model, and deploys and applies it after verification, including: Dividing the feature enhancement set into a training set and a validation set according to a preset ratio; Input the training set into a preset random forest model, perform feature training and learning on the model, and generate the risk control behavior early warning prediction model; The recognition performance of the risk control behavior early warning prediction model is verified using the verification set: If the verification is successful, the risk control behavior early warning prediction model is deployed and applied on the background server; If the verification fails, steps S1-S4 are repeated.

5. The risk control behavior early warning and prediction method based on AI identification according to claim 3 is characterized in that: The step S5, monitoring the user risk control behavior data and inputting the risk control behavior early warning prediction model, and having the risk control behavior early warning prediction model predict and output the corresponding strategy prediction result to the LLM large language model, includes: The system automatically monitors and collects user risk control behavior data; Using a supervised learning algorithm to mine and extract behavioral features from the user risk control behavior data and output the risk control behavior early warning prediction model; Through the risk control behavior early warning prediction model, identify and judge whether the behavior characteristics trigger relevant reinforcement characteristics: If triggered, the enhanced feature M(S) and its annotation information matching the behavior feature are output, and the enhanced feature M(S) and its annotation information are input into the LLM large language model as the strategy prediction result; If not triggered, a warning message will be issued.

6. The risk control behavior early warning and prediction method based on AI identification according to claim 5 is characterized in that: S6, analyzing the strategy prediction results by using the LLM large language model, searching the database and outputting the corresponding risk control decision data set, including: Receiving the strategy prediction result and constructing a combination retrieval logic between the enhanced feature M(S) and the annotation information; According to the combined search logic, construct the corresponding large language model prompt word and input the preset LLM large language model; The LLM large language model performs a database search based on the large language model prompt words, and retrieves a number of corresponding risk control decision strategies from the decision database; The risk control decision strategies are counted and a risk control decision data set is formed, and the risk control decision data set is fed back to the front end.

7. A risk control behavior early warning prediction system based on AI identification, the risk control behavior early warning prediction system based on AI identification is used to implement the risk control behavior early warning prediction method based on AI identification as claimed in any one of claims 1 to 6, characterized in that: The system comprises: A feature set building module is used to collect historical risk control behavior data, use machine learning algorithms to extract decision-making behavior features related to risk control in the historical risk control behavior data, and form a feature set; A feature enhancement module, used for performing feature segmentation enhancement processing on the decision-making behavior features in the feature set through the LLM large language model, and outputting the enhanced decision-making behavior features to obtain a feature enhancement set; A feature annotation module, used to perform feature annotation on the feature enhancement set, wherein the annotation information includes decision priority and at least one of the following information: risk level, risk type, risk source or user behavior pattern; The risk control model management module is used to conduct model training and learning based on the annotated feature enhancement set, build a risk control behavior early warning prediction model, and deploy and apply it after verification; A risk control supervision module is used to monitor the user's risk control behavior data and input it into the risk control behavior early warning prediction model, and the risk control behavior early warning prediction model predicts and outputs the corresponding strategy prediction results to the LLM large language model; The decision module is used to analyze the strategy prediction results through the LLM large language model, search the database and output the corresponding risk control decision data set.

8. An electronic device, characterized in that: The electronic device comprises: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, which can be called by a processor to execute the method according to any one of claims 1 to 6.

Images