Suspicious transaction evaluation method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a suspicious transaction evaluation method and device, electronic equipment and a storage medium, and belongs to the technical field of financial science and technology and artificial intelligence. The method comprises the following steps: acquiring static information and dynamic information of a target user; based on a preset suspicious transaction scoring model, performing feature extraction on the static information to obtain static features, and performing feature extraction on the dynamic information to obtain dynamic features; based on a static evaluation model, performing feature mapping on the static features to obtain static feature evaluation data; performing feature regulation and control on the dynamic features based on a dynamic evaluation model to obtain dynamic feature evaluation data; performing feature data evaluation on the target user based on the static feature evaluation data and the dynamic feature evaluation data to obtain target suspicious transaction evaluation data; and performing suspicious transaction evaluation on the target user based on the target suspicious transaction evaluation data. According to the embodiment of the invention, the efficiency of suspicious transaction evaluation can be improved.

Description

Technical Field

[0001] The present application relates to the fields of financial technology and artificial intelligence technology, and in particular to a suspicious transaction assessment method and device, electronic device and storage medium. Background Art

[0002] Suspicious transaction assessment refers to the assessment of the user's financial transaction information to determine whether there is a risk of suspicious transactions. For example, in the financial field, there is a risk of users laundering money through insurance claims. At this time, it is necessary to conduct a suspicious transaction assessment on the user's financial transaction account and related financial transaction information.

[0003] At present, the common method of suspicious transaction assessment is usually to manually evaluate the financial transaction data in risky user accounts. However, the manual evaluation method is prone to errors and takes a lot of time. Therefore, how to improve the efficiency of suspicious transaction assessment has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to provide a suspicious transaction assessment method and device, an electronic device and a storage medium, aiming to improve the efficiency of suspicious transaction assessment.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a suspicious transaction assessment method, the method comprising:

[0006] Obtaining static information and dynamic information of the target user, wherein the static information is used to represent the basic information of the target user, and the dynamic information refers to the dynamic data generated by the behavior of the target user;

[0007] Based on a preset suspicious transaction scoring model, feature extraction is performed on the static information to obtain static features, and feature extraction is performed on the dynamic information to obtain dynamic features, wherein the suspicious transaction scoring model includes a static evaluation model and a dynamic evaluation model;

[0008] Based on the static evaluation model, feature mapping is performed on the static features to obtain static feature evaluation data;

[0009] Based on the dynamic evaluation model, the dynamic feature is controlled to obtain dynamic feature evaluation data;

[0010] Based on the static feature evaluation data and the dynamic feature evaluation data, the feature data of the target user is evaluated to obtain target suspicious transaction evaluation data;

[0011] Based on the target suspicious transaction evaluation data, a suspicious transaction evaluation is performed on the target user.

[0012] In some embodiments, the step of performing feature mapping on the static feature based on the static evaluation model to obtain static feature evaluation data includes:

[0013] Based on the static evaluation model, performing attention weight allocation processing on the static features to obtain feature weights;

[0014] Based on the feature weight, performing feature transformation on the static feature to obtain a hidden feature;

[0015] Performing feature activation processing on the hidden features to obtain the static feature evaluation data.

[0016] In some embodiments, the step of performing feature control on the dynamic feature based on the dynamic evaluation model to obtain dynamic feature evaluation data includes:

[0017] Based on the dynamic evaluation model, feature forgetting is performed on the dynamic feature to obtain a current unit feature;

[0018] Performing feature updating on the current unit feature to obtain a target feature;

[0019] Performing feature activation processing on the target feature to obtain the dynamic feature evaluation data.

[0020] In some embodiments, the extracting features from the static information to obtain static features based on a preset suspicious transaction scoring model, and extracting features from the dynamic information to obtain dynamic features, include:

[0021] Based on the static evaluation model, performing data standardization processing on the static information to obtain standard information;

[0022] Encoding the standard information to obtain the static features;

[0023] Based on the dynamic evaluation model, the dynamic information is normalized to obtain normalized information;

[0024] The normalized information is subjected to time window combination processing to obtain the dynamic feature.

[0025] In some embodiments, performing time window combination processing on the normalized information to obtain the dynamic feature includes:

[0026] Based on the normalized information, the preset initial time window is divided into windows to obtain a target time window;

[0027] Based on the target time window, the normalized information is integrated to obtain the dynamic feature.

[0028] In some embodiments, the performing feature data evaluation on the target user based on the static feature evaluation data and the dynamic feature evaluation data to obtain target suspicious transaction evaluation data includes:

[0029] Based on a preset static feature weight value, score calculation is performed on the static feature evaluation data to obtain a target static score;

[0030] Based on a preset dynamic feature weight value, score calculation is performed on the dynamic feature evaluation data to obtain a target dynamic score;

[0031] The target static score and the target dynamic score are numerically merged to obtain the target suspicious transaction assessment data.

[0032] In some embodiments, performing a suspicious transaction assessment on the target user based on the target suspicious transaction assessment data includes:

[0033] Obtaining a mapping function between suspicious transaction assessment data and suspicious transaction assessment levels;

[0034] The target suspicious transaction assessment data is input into the mapping function to perform level calculation to obtain the target suspicious transaction level.

[0035] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application provides a suspicious transaction evaluation device, the device comprising:

[0036] An information acquisition module, used to acquire static information and dynamic information of a target user, wherein the static information is used to represent basic information owned by the target user, and the dynamic information is used to represent basic information generated by the behavior of the target user;

[0037] A feature extraction module, configured to extract features from the static information to obtain static features, and to extract features from the dynamic information to obtain dynamic features based on a preset suspicious transaction scoring model, wherein the suspicious transaction scoring model includes a static evaluation model and a dynamic evaluation model;

[0038] A static evaluation module, used for performing feature mapping on the static features based on the static evaluation model to obtain static feature evaluation data;

[0039] A dynamic evaluation module, used to perform feature control on the dynamic feature based on the dynamic evaluation model to obtain dynamic feature evaluation data;

[0040] A total score calculation module, used to evaluate the characteristic data of the target user based on the static characteristic evaluation data and the dynamic characteristic evaluation data, and obtain target suspicious transaction evaluation data;

[0041] The suspicious transaction evaluation module is used to perform a suspicious transaction evaluation on the target user based on the target suspicious transaction evaluation data.

[0042] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0043] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0044] The suspicious transaction assessment method and device, electronic device and storage medium proposed in the present application obtain static information and dynamic information of the target user, and use a preset suspicious transaction scoring model to perform feature extraction on the static information to obtain static features, and to perform feature extraction on the dynamic information to obtain dynamic features, and then perform feature mapping on the static features according to the static assessment model to obtain static feature assessment data, and perform feature regulation on the dynamic features according to the dynamic assessment model to obtain dynamic feature assessment data, thereby reducing the manual assessment participation of the target user's transaction information, thereby improving the efficiency of the suspicious transaction assessment, and further, perform feature data assessment on the target user according to the static feature assessment data and the dynamic feature assessment data to obtain target suspicious transaction assessment data, and perform suspicious transaction assessment on the target user according to the target suspicious transaction assessment data, which can improve the robustness of suspicious transaction assessment, thereby improving the accuracy and efficiency of suspicious transaction assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 is a flow chart of a suspicious transaction assessment method provided by an embodiment of the present application;

[0046] Figure 2 yes Figure 1 Flow chart of step S102 in FIG.

[0047] Figure 3 yes Figure 2 Flow chart of step S204 in FIG.

[0048] Figure 4 yes Figure 1 Flow chart of step S103 in FIG.

[0049] Figure 5 yes Figure 1 Flow chart of step S104 in FIG.

[0050] Figure 6 yes Figure 1Flow chart of step S105 in FIG.

[0051] Figure 7 yes Figure 1 Flow chart of step S106 in FIG.

[0052] Figure 8 It is a structural schematic diagram of a suspicious transaction assessment device provided in an embodiment of the present application;

[0053] Fig. 9 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0056] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0057] First, some nouns involved in this application are analyzed:

[0058] Multilayer Perceptron: Multilayer Perceptron is a feedforward neural network consisting of multiple layers, including an input layer, one or more hidden layers, and an output layer. Each layer consists of multiple neurons, which transmit signals through weighted connections and undergo nonlinear transformations through activation functions. Multilayer Perceptron is trained using the back-propagation algorithm and is suitable for classification and regression tasks of nonlinear problems.

[0059] Long Short-Term Memory Network: Long Short-Term Memory Network is a special type of recursive neural network designed to process long sequence data and overcome the shortcomings of traditional recursive neural networks in long-distance dependency problems. Long Short-Term Memory Network introduces a special unit structure, including input gate, forget gate and output gate, which can effectively store and update information, thereby capturing long-term dependencies in the sequence. It is widely used in speech recognition, natural language processing and time series prediction.

[0060] Suspicious transaction assessment refers to the assessment of the user's financial transaction information to determine whether there is a risk of suspicious transactions. For example, in the financial field, there is a risk of users laundering money through insurance claims. At this time, it is necessary to conduct a suspicious transaction assessment on the user's financial transaction account and related financial transaction information.

[0061] At present, the common method of suspicious transaction assessment is usually to manually evaluate the financial transaction data in risky user accounts. However, the manual evaluation method is prone to errors and takes a lot of time. Therefore, how to improve the efficiency of suspicious transaction assessment has become a technical problem that needs to be solved urgently.

[0062] Based on this, the embodiments of the present application provide a suspicious transaction assessment method and device, an electronic device and a storage medium, aiming to improve the efficiency of suspicious transaction assessment.

[0063] The suspicious transaction assessment method and device, electronic device and storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the suspicious transaction assessment method in the embodiments of the present application is described.

[0064] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0065] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0066] The suspicious transaction assessment method provided in the embodiment of the present application relates to the fields of financial technology and artificial intelligence technology. The suspicious transaction assessment method provided in the embodiment of the present application can be applied to a terminal, can be applied to a server side, or can be software running in a terminal or a server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or can be configured as a server cluster or a distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the suspicious transaction assessment method, etc., but is not limited to the above forms.

[0067] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0068] Figure 1 is an optional flow chart of the suspicious transaction assessment method provided in the embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S106.

[0069] Step S101, obtaining static information and dynamic information of a target user, wherein the static information is used to represent basic information of the target user, and the dynamic information refers to dynamic data generated by the behavior of the target user;

[0070] Step S102, based on a preset suspicious transaction scoring model, feature extraction is performed on static information to obtain static features, and feature extraction is performed on dynamic information to obtain dynamic features, wherein the suspicious transaction scoring model includes a static evaluation model and a dynamic evaluation model;

[0071] Step S103, based on the static evaluation model, feature mapping is performed on the static features to obtain static feature evaluation data;

[0072] Step S104, based on the dynamic evaluation model, the dynamic features are controlled to obtain dynamic feature evaluation data;

[0073] Step S105, based on the static feature evaluation data and the dynamic feature evaluation data, the feature data of the target user is evaluated to obtain target suspicious transaction evaluation data;

[0074] Step S106: Perform a suspicious transaction assessment on the target user based on the target suspicious transaction assessment data.

[0075] In steps S101 to S106 shown in the embodiment of the present application, basic information of the target user and dynamic data generated by the behavior of the target user are obtained to obtain static information and dynamic information of the target user. According to a pre-trained suspicious transaction scoring model, feature extraction is performed on the static information to obtain static features, and feature extraction is performed on the dynamic information to obtain dynamic features. The suspicious transaction scoring model includes a static evaluation model and a dynamic evaluation model. Further, according to the static evaluation model, feature mapping is performed on the static features to obtain static feature evaluation data. According to the dynamic evaluation model, feature regulation is performed on the dynamic features to obtain dynamic feature evaluation data. Secondly, according to the static feature evaluation data and the dynamic feature evaluation data, feature data evaluation is performed on the target user to obtain target suspicious transaction evaluation data. Finally, according to the target suspicious transaction evaluation data, a suspicious transaction evaluation is performed on the target user. Therefore, the present application obtains static information and dynamic information of the target user, and uses a preset suspicious transaction scoring model to perform feature extraction on the static information to obtain static features, and to perform feature extraction on the dynamic information to obtain dynamic features, and then performs feature mapping on the static features according to the static evaluation model to obtain static feature evaluation data, and performs feature regulation on the dynamic features according to the dynamic evaluation model to obtain dynamic feature evaluation data, thereby reducing the manual evaluation participation of the target user's transaction information, thereby improving the efficiency of suspicious transaction evaluation, and further, based on the static feature evaluation data and the dynamic feature evaluation data, the target user is evaluated for feature data to obtain target suspicious transaction evaluation data, and based on the target suspicious transaction evaluation data, a suspicious transaction evaluation is performed on the target user, which can improve the robustness of the transaction evaluation, thereby improving the accuracy and efficiency of the transaction evaluation.

[0076] In step S101 of some embodiments, the target user may be a user who has conducted resource transactions, wherein the resource transactions include but are not limited to currency transactions and item transactions. Static information may be the attributes carried by the target user itself, i.e., basic information, and the static information may be the region where the user is located, the industry where the user is located, etc. Dynamic information may be dynamic attributes generated by the transaction behavior of the target user, for example, the amount of resources and the transaction time when the target user conducts resource transactions.

[0077] This application can obtain the static information of the target user by querying the basic information of the target user, and obtain the dynamic information of the target user by crawling the resource transaction data of the target user.

[0078] In step S102 of some embodiments, the suspicious transaction scoring model may be a pre-trained comprehensive model including a static evaluation model and a dynamic evaluation model, wherein the static evaluation model refers to a model for performing suspicious transaction evaluation on static information, and the static evaluation model may be a model such as a multi-layer perceptron, and the dynamic evaluation model refers to a model for performing suspicious transaction evaluation on dynamic information, and the dynamic evaluation model may be a model such as a long short-term memory network.

[0079] The present application can utilize a static evaluation model to perform feature extraction on static information to obtain static features, and utilize a dynamic evaluation model to perform feature extraction on dynamic information to obtain dynamic features.

[0080] For details, see Figure 2 In some embodiments, step S102 may include but is not limited to steps S201 to S204:

[0081] Step S201, based on the static evaluation model, perform data standardization processing on the static information to obtain standard information;

[0082] Step S202, encoding the standard information to obtain static features;

[0083] Step S203, based on the dynamic evaluation model, normalize the dynamic information to obtain normalized information;

[0084] Step S204, performing time window combination processing on the normalized information to obtain dynamic features.

[0085] In step S201 of some embodiments, by performing information cleaning on the static information, that is, deleting duplicate information and filling in missing information, the cleaned standard information can be made more accurate, thereby improving the accuracy of the static features.

[0086] In step S202 of some embodiments, the standard information after the data standardization process is mapped to the feature space in the static evaluation model, so as to obtain the static features of the target user.

[0087] In step S203 of some embodiments, the dynamic information is dynamic data generated by the transaction behavior of the target user. The size of the data may vary greatly, resulting in difficulty in extracting dynamic features. Therefore, it is necessary to use a dynamic evaluation model to normalize the dynamic information to obtain normalized information.

[0088] In step S204 of some embodiments, a preset initial time window is divided according to the processed normalized information to obtain a target time window, and then the normalized information is integrated according to the target time window to obtain dynamic information of the target user.

[0089] For details, see Figure 3 In some embodiments, step S204 may include but is not limited to steps S301 to S302:

[0090] Step S301, based on the normalized information, dividing the preset initial time window into windows to obtain a target time window;

[0091] Step S302: Based on the target time window, the normalized information is integrated to obtain dynamic features.

[0092] In step S301 of some embodiments, the initial time window may be a continuous long time period.

[0093] The present application can divide a continuous initial time window into multiple overlapping or non-overlapping target time windows according to the time data in the normalized information. For example, the normalized information indicates that the target user's transaction resources in January are 0.2, the target user's transaction resources in February are 0.5, the target user's transaction resources in March are 0.16, the target user's transaction resources in April are 0.08, the target user's transaction resources in May are -0.2, and the target user's transaction resources in June are 0.13. By dividing the pre-set initial time window, two target time windows can be obtained, wherein the first target time window is used to represent a continuous time period from January to March, and the second target time window is used to represent a continuous time period from April to June.

[0094] In step S302 of some embodiments, the normalized information is filled into the window organization according to the division of the target time window mentioned above, and the dynamic characteristics of the target user can be obtained. For example, when the first target time window represents a continuous time period from January to March, and the second target time window represents a continuous time period from April to June, the normalized information "the transaction resources in January are 0.2, the transaction resources in February are 0.5, the transaction resources in March are 0.16, the transaction resources in April are 0.08, the transaction resources in May are -0.2, and the transaction resources in June are 0.13" is filled into the window organization to obtain the first dynamic characteristics (1, 0.2; 2, 0.5; 3, 0.16) and the second dynamic characteristics (4, 0.08; 5, -0.2; 6, 0.13).

[0095] In steps S301 to S302 shown in this embodiment, the preset initial time window is divided into windows according to the normalized information to obtain the target time window, and then the normalized information is integrated according to the target time window to obtain the dynamic feature, which can avoid the window organization being too large, thereby reducing the difficulty of model calculation and improving the efficiency of dynamic feature extraction.

[0096] In steps S201 to S204 shown in this embodiment, according to the static evaluation model, data standardization processing is performed on the static information to obtain standard information, and then the standard information is encoded to obtain static features. Further, according to the dynamic evaluation model, the dynamic information is normalized to obtain normalized information, and then the normalized information is combined in a time window to obtain dynamic features, which can improve the information accuracy of the target user, thereby reducing the number of suspicious transaction evaluations, thereby improving the efficiency of suspicious transaction evaluations.

[0097] In step S103 of some embodiments, by using a static evaluation model to perform weight assignment, feature transformation, feature activation and other processing on static features, evaluation data of the static features, namely, static feature evaluation data, can be obtained.

[0098] For details, see Figure 4 In some embodiments, step S103 may include but is not limited to steps S401 to S403:

[0099] Step S401, based on the static evaluation model, performing attention weight allocation processing on the static features to obtain feature weights;

[0100] Step S402, based on the feature weight, the static feature is transformed to obtain a hidden feature;

[0101] Step S403, performing feature activation processing on the hidden features to obtain static feature evaluation data.

[0102] In step S401 of some embodiments, attention weight evaluation is performed on the static features according to the static evaluation model to determine the attention weight that needs to be allocated to each static feature, ie, the feature weight.

[0103] In step S402 of some embodiments, the static feature is multiplied by the feature weight, and then the pre-set bias data in the static evaluation model is added, so that the feature transformation of the static feature can be achieved to obtain the hidden feature.

[0104] In step S403 of some embodiments, the hidden feature is activated using the activation function in the static evaluation model to obtain the confidence of the hidden feature in each evaluation dimension, and then the static feature evaluation data of the hidden feature is determined based on the confidence, wherein the activation function in the static evaluation model is usually a sigmoid activation function.

[0105] In steps S401 to S403 shown in the present embodiment, attention weights are allocated to static features according to the static evaluation model to obtain feature weights, and then feature transformation is performed on the static features according to the feature weights to obtain hidden features. Furthermore, feature activation is performed on the hidden features to obtain static feature evaluation data, which can determine the evaluation score of the static information of the target user's resource transaction, thereby realizing the evaluation of the static dimension of the resource transaction.

[0106] In step S104 of some embodiments, a dynamic evaluation model can be used to forget some features in the dynamic features to obtain the current unit features, and then the current unit features are updated to obtain the target features. Finally, the target features are activated to obtain the dynamic feature evaluation data of the target user.

[0107] For details, see Figure 5 In some embodiments, step S104 may include but is not limited to steps S501 to S503:

[0108] Step S501, based on the dynamic evaluation model, feature forgetting is performed on the dynamic feature to obtain the current unit feature;

[0109] Step S502, updating the current unit feature to obtain the target feature;

[0110] Step S503, performing feature activation processing on the target feature to obtain dynamic feature evaluation data.

[0111] In steps S501 and S502 of some embodiments, the dynamic evaluation model includes a forget gate, an input gate, and an output gate, wherein the forget gate is used to determine which feature information in the dynamic features needs to be forgotten, the input gate is used to determine which new features need to be stored in the dynamic features, and the output gate is used to determine which features of the dynamic features will be output.

[0112] The present application can use the dynamic evaluation model to perform forget gate calculation, input gate calculation and output gate calculation on the dynamic features to obtain the forget gate value, input gate value and output gate value, and then perform feature forgetting on the dynamic features according to the forget gate value to obtain the current unit feature, and perform feature addition on the current unit feature according to the input gate value to obtain the target feature.

[0113] In step S503 of some embodiments, the target feature is activated using the activation function in the dynamic evaluation model, and the activated target feature is combined with the output gate value to determine the dynamic feature evaluation data of the target user, wherein the activation function in the dynamic evaluation model is usually a tanh function.

[0114] In steps S501 to S503 shown in this embodiment, according to the dynamic evaluation model, the dynamic features are forgotten to obtain the current unit features, and then the current unit features are updated to obtain the target features. Furthermore, the target features are activated to obtain dynamic feature evaluation data, which can determine the evaluation score of the dynamic information of the target user during resource transactions, thereby realizing the evaluation of the dynamic dimension of resource transactions.

[0115] In step S105 of some embodiments, after obtaining the static feature evaluation data and the dynamic feature evaluation data generated by the target user's resource transaction, the target user's feature data is evaluated based on the weight of the static feature evaluation data in the suspicious transaction evaluation and the weight of the dynamic feature evaluation data in the suspicious transaction evaluation, and the target suspicious transaction evaluation data of the target user can be obtained.

[0116] For details, see Figure 6 In some embodiments, step S105 may include but is not limited to steps S601 to S603:

[0117] Step S601, based on a preset static feature weight value, score the static feature evaluation data to obtain a target static score;

[0118] Step S602, based on the preset dynamic feature weight value, score the dynamic feature evaluation data to obtain a target dynamic score;

[0119] Step S603: numerically merge the target static score and the target dynamic score to obtain target suspicious transaction assessment data.

[0120] In step S601 and step S602 of some embodiments, the static feature weight value may be pre-set, for example, the static feature weight value of the region where the target user is located in the static information may be 0.1, and the static feature weight value of the industry of the target user in the static information may be 0.2. The dynamic feature weight value may be pre-set, for example, the dynamic feature weight value of the transaction amount of the target user in the dynamic information may be 0.2, and the dynamic feature weight value of the transaction frequency of the target user in the dynamic information may be 0.3.

[0121] The present application can obtain the target static score of the target user by multiplying the static feature evaluation data with the pre-set static feature weight value, and obtain the target dynamic score of the target user by multiplying the dynamic feature evaluation data with the pre-set dynamic feature weight value.

[0122] In step S603 of some embodiments, the target suspicious transaction assessment data can be obtained by simply adding and merging the target static score and the target dynamic score, or the target acceptable transaction assessment data can be obtained by scaling the target static score and the target dynamic score and then adding them.

[0123] In steps S601 to S603 shown in this embodiment, the static feature evaluation data is scored according to the preset static feature weight value to obtain the target static score, and the dynamic feature evaluation data is scored according to the preset dynamic feature weight value to obtain the target dynamic score. The target static score and the target dynamic score are then numerically merged to obtain the target suspicious transaction evaluation data, which can evaluate the user's suspicious transactions based on the combination of static dimensions and dynamic dimensions, thereby improving the accuracy of the suspicious transaction evaluation.

[0124] In step S106 of some embodiments, based on the target suspicious transaction assessment data, the assessment level of suspicious transactions when the target user conducts resource transactions can be clearly determined, so that customer service personnel can clearly understand whether the target user has a risk of suspicious transactions.

[0125] For details, see Figure 6 In some embodiments, step S106 may include but is not limited to steps S701 to S702:

[0126] Step S701, obtaining a mapping function between suspicious transaction assessment data and suspicious transaction assessment levels;

[0127] Step S701: Input the target suspicious transaction assessment data into a mapping function to perform level calculation to obtain the target suspicious transaction level.

[0128] In step S701 of some embodiments, function fitting may be performed according to the values ​​in a preset mapping table of suspicious transaction assessment data and suspicious transaction assessment levels to obtain a mapping function of suspicious transaction assessment data and suspicious transaction assessment levels.

[0129] It should be noted that the mapping function between suspicious transaction assessment data and suspicious transaction assessment level is generally a piecewise function.

[0130] In step S702 of some embodiments, the target suspicious transaction assessment data is substituted into the mapping function of the fitted suspicious transaction assessment data and the suspicious transaction assessment level to perform function calculation, so as to obtain the target suspicious transaction level of the target user.

[0131] In steps S701 to S702 shown in this embodiment, a mapping function between suspicious transaction assessment data and suspicious transaction assessment levels is obtained, and then the target suspicious transaction assessment data is input into the mapping function for level calculation to obtain a target suspicious transaction level. This can convert complex numerical data into simple level data, so that customer service personnel can quickly determine whether the target user has a risk of suspicious transactions.

[0132] In an application scenario, taking money laundering as an example, the static information of the target transaction user, such as the user industry and user region, and the dynamic information of the target transaction user, such as the transaction time, transaction frequency, and transaction amount, are obtained, and then the pre-trained anti-money laundering scoring model is used to extract features of the above information, such as the user industry, user region, transaction time, transaction frequency, and transaction amount, to obtain the static features of the information, such as the user industry and user region, and the dynamic features of the information, such as the transaction time, transaction frequency, and transaction amount, and further, the static evaluation model in the above anti-money laundering scoring model is used to perform feature mapping on the static features of the information, such as the user industry and user region, to obtain the risk degree of money laundering of the target transaction user in the dimensions of the user industry and user region, and to use the anti-money laundering scoring model to extract features of the above information. The dynamic assessment model in the above-mentioned anti-money laundering scoring model is used to perform feature control on the dynamic features of information such as transaction time, transaction frequency, and transaction amount, so as to obtain the risk level of money laundering for the target transaction user in dimensions such as transaction time, transaction frequency, and transaction amount. Secondly, the static feature assessment data output by the above-mentioned anti-money laundering scoring model, which characterizes the risk level of money laundering for the target transaction user in dimensions such as user industry and user region, is weightedly summed with the dynamic feature assessment data, which characterizes the risk level of money laundering for the target transaction user in dimensions such as transaction time, transaction frequency, and transaction amount, so as to obtain the anti-money laundering assessment data of the target transaction user. Finally, the anti-money laundering assessment data is converted into a risk level to realize the money laundering assessment of the target transaction user.

[0133] The present application obtains static information and dynamic information of the target user, and uses a preset suspicious transaction scoring model to perform feature extraction on the static information to obtain static features, and to perform feature extraction on the dynamic information to obtain dynamic features, and then performs feature mapping on the static features according to the static evaluation model to obtain static feature evaluation data, and performs feature regulation on the dynamic features according to the dynamic evaluation model to obtain dynamic feature evaluation data, thereby reducing the manual evaluation participation of the target user's transaction information, thereby improving the efficiency of suspicious transaction evaluation, and further, based on the static feature evaluation data and the dynamic feature evaluation data, the target user is evaluated for feature data to obtain target suspicious transaction evaluation data, and based on the target suspicious transaction evaluation data, a suspicious transaction evaluation is performed on the target user, which can improve the robustness of suspicious transaction evaluation, thereby improving the accuracy and efficiency of suspicious transaction evaluation.

[0134] See also Figure 8 The embodiment of the present application also provides a suspicious transaction evaluation device, which can implement the above-mentioned suspicious transaction evaluation method, and the device includes:

[0135] The information acquisition module 801 is used to acquire static information and dynamic information of the target user, wherein the static information is used to represent the basic information of the target user, and the dynamic information is used to represent the basic information generated by the behavior of the target user;

[0136] The feature extraction module 802 is used to extract features from static information based on a preset suspicious transaction scoring model to obtain static features, and to extract features from dynamic information to obtain dynamic features, wherein the suspicious transaction scoring model includes a static evaluation model and a dynamic evaluation model;

[0137] A static evaluation module 803 is used to perform feature mapping on static features based on a static evaluation model to obtain static feature evaluation data;

[0138] A dynamic evaluation module 804 is used to perform feature control on the dynamic features based on the dynamic evaluation model to obtain dynamic feature evaluation data;

[0139] The total score calculation module 805 is used to evaluate the characteristic data of the target user based on the static characteristic evaluation data and the dynamic characteristic evaluation data to obtain the target suspicious transaction evaluation data;

[0140] The suspicious transaction evaluation module 806 is used to perform a suspicious transaction evaluation on the target user based on the target suspicious transaction evaluation data.

[0141] The specific implementation of the suspicious transaction evaluation device is substantially the same as the specific implementation of the suspicious transaction evaluation method described above, and will not be described in detail herein.

[0142] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above suspicious transaction assessment method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0143] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0144] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0145] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the suspicious transaction assessment method of the embodiment of this application;

[0146] Input / output interface 903, used to implement information input and output;

[0147] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0148] A bus 905 that transmits information between various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0149] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0150] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned suspicious transaction assessment method is implemented.

[0151] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0152] The suspicious transaction assessment method, suspicious transaction assessment device, electronic device and storage medium provided in the embodiments of the present application obtain the basic information of the target user and the dynamic data generated by the behavior of the target user to obtain the static information and dynamic information of the target user, and perform feature extraction on the static information to obtain the static features and feature extraction on the dynamic information to obtain the dynamic features according to the pre-trained suspicious transaction scoring model, wherein the suspicious transaction scoring model includes a static assessment model and a dynamic assessment model, further, according to the static assessment model, feature mapping is performed on the static features to obtain static feature assessment data, according to the dynamic assessment model, feature regulation is performed on the dynamic features to obtain dynamic feature assessment data, then, according to the static feature assessment data and the dynamic feature assessment data, feature data assessment is performed on the target user to obtain target suspicious transaction assessment data, and finally, according to the target suspicious transaction assessment data, a suspicious transaction assessment is performed on the target user.

[0153] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0154] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0155] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0156] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0157] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0158] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0159] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0160] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0161] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0162] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0163] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A suspicious transaction assessment method, characterized in that: The method comprises: Obtaining static information and dynamic information of the target user, wherein the static information is used to represent the basic information of the target user, and the dynamic information refers to the dynamic data generated by the behavior of the target user; Based on a preset suspicious transaction scoring model, feature extraction is performed on the static information to obtain static features, and feature extraction is performed on the dynamic information to obtain dynamic features, wherein the suspicious transaction scoring model includes a static evaluation model and a dynamic evaluation model; Based on the static evaluation model, feature mapping is performed on the static features to obtain static feature evaluation data; Based on the dynamic evaluation model, the dynamic feature is controlled to obtain dynamic feature evaluation data; Based on the static feature evaluation data and the dynamic feature evaluation data, the feature data of the target user is evaluated to obtain target suspicious transaction evaluation data; Based on the target suspicious transaction evaluation data, a suspicious transaction evaluation is performed on the target user.

2. The method according to claim 1, characterized in that: The step of performing feature mapping on the static features based on the static evaluation model to obtain static feature evaluation data includes: Based on the static evaluation model, performing attention weight allocation processing on the static features to obtain feature weights; Based on the feature weight, performing feature transformation on the static feature to obtain a hidden feature; Performing feature activation processing on the hidden features to obtain the static feature evaluation data.

3. The method according to claim 1, characterized in that The step of performing feature control on the dynamic feature based on the dynamic evaluation model to obtain dynamic feature evaluation data includes: Based on the dynamic evaluation model, feature forgetting is performed on the dynamic feature to obtain a current unit feature; Performing feature updating on the current unit feature to obtain a target feature; Performing feature activation processing on the target feature to obtain the dynamic feature evaluation data.

4. The method according to claim 1, characterized in that: The step of extracting features from the static information to obtain static features and extracting features from the dynamic information to obtain dynamic features based on the preset suspicious transaction scoring model includes: Based on the static evaluation model, performing data standardization processing on the static information to obtain standard information; Encoding the standard information to obtain the static features; Based on the dynamic evaluation model, the dynamic information is normalized to obtain normalized information; The normalized information is subjected to time window combination processing to obtain the dynamic feature.

5. The method according to claim 4, characterized in that The performing time window combination processing on the normalized information to obtain the dynamic feature includes: Based on the normalized information, the preset initial time window is divided into windows to obtain a target time window; Based on the target time window, the normalized information is integrated to obtain the dynamic feature.

6. The method according to any one of claims 1 to 5, characterized in that: The step of performing feature data evaluation on the target user based on the static feature evaluation data and the dynamic feature evaluation data to obtain target suspicious transaction evaluation data includes: Based on a preset static feature weight value, score calculation is performed on the static feature evaluation data to obtain a target static score; Based on a preset dynamic feature weight value, score calculation is performed on the dynamic feature evaluation data to obtain a target dynamic score; The target static score and the target dynamic score are numerically merged to obtain the target suspicious transaction assessment data.

7. The method according to any one of claims 1 to 5, characterized in that: The performing suspicious transaction evaluation on the target user based on the target suspicious transaction evaluation data includes: Obtaining a mapping function between suspicious transaction assessment data and suspicious transaction assessment levels; The target suspicious transaction assessment data is input into the mapping function to perform level calculation to obtain the target suspicious transaction level.

8. A suspicious transaction assessment device, characterized in that: The device comprises: An information acquisition module, used to acquire static information and dynamic information of a target user, wherein the static information is used to represent basic information owned by the target user, and the dynamic information is used to represent basic information generated by the behavior of the target user; A feature extraction module, configured to extract features from the static information to obtain static features, and to extract features from the dynamic information to obtain dynamic features based on a preset suspicious transaction scoring model, wherein the suspicious transaction scoring model includes a static evaluation model and a dynamic evaluation model; A static evaluation module, used for performing feature mapping on the static features based on the static evaluation model to obtain static feature evaluation data; A dynamic evaluation module, used to perform feature control on the dynamic feature based on the dynamic evaluation model to obtain dynamic feature evaluation data; A total score calculation module, used to evaluate the characteristic data of the target user based on the static characteristic evaluation data and the dynamic characteristic evaluation data, and obtain target suspicious transaction evaluation data; The suspicious transaction evaluation module is used to perform a suspicious transaction evaluation on the target user based on the target suspicious transaction evaluation data.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory stores a computer program, and the processor implements the suspicious transaction assessment method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the suspicious transaction assessment method according to any one of claims 1 to 7 is implemented.

Images