Alarm information processing method and device, equipment, storage medium and product

Abstract

The invention discloses an alarm information processing method and device, equipment, a storage medium and a product. The invention relates to the technical field of big data. The method comprises the following steps: acquiring abnormal transaction alarm information; performing element extraction on the abnormal transaction alarm information to obtain element information corresponding to the abnormal transaction alarm information; screening the abnormal transaction alarm information based on the element information corresponding to the abnormal transaction alarm information to obtain screened abnormal transaction alarm information; and performing context degradation matching on the field value in the screened abnormal transaction alarm information, and generating an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and the matched context information of the field value meeting a preset recommendation condition. According to the technical scheme, the context information of the field value does not need to be manually discriminated, and the context discrimination efficiency is improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of big data technology, and in particular, to an alarm information processing method, device, equipment, storage medium and product. Background Art

[0002] In the era of big data, data analysis and data mining are very important. Extracting effective rules from massive data is a difficult but important task.

[0003] In the field of anti-money laundering, financial institutions need to manually identify the context of keywords in a large number of abnormal transaction alarm information through the anti-money laundering list monitoring system, so as to use the context of keywords that meet the requirements as intelligent review recommendation rules.

[0004] In the process of implementing the present invention, it is found that there are at least the following technical problems in the prior art: the prior art solution has the problem of low efficiency in identifying contexts. Summary of the invention

[0005] The embodiments of the present invention provide an alarm information processing method, device, equipment, storage medium and product to solve the problem of low context identification efficiency.

[0006] In a first aspect, an embodiment of the present invention provides a method for processing alarm information, including:

[0007] Obtain abnormal transaction warning information;

[0008] Extracting elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information;

[0009] Based on the element information corresponding to the abnormal transaction warning information, the abnormal transaction warning information is screened to obtain screened abnormal transaction warning information;

[0010] Performing context degradation matching on the field values ​​in the filtered abnormal transaction warning information, wherein the context degradation matching refers to taking the context information of the field values ​​with a preset number of words as the matching starting point, and sequentially reducing the number of word matching of the context information of the field values, until the context information of the field values ​​obtained by matching meets the preset recommendation condition and ends the matching process;

[0011] Based on the element information corresponding to the abnormal transaction alarm information and the context information of the field value obtained by matching and satisfying the preset recommendation condition, an alarm information recommendation model is generated, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0012] In a second aspect, an embodiment of the present invention further provides an alarm information processing device, the device comprising:

[0013] An alarm information acquisition module is used to obtain abnormal transaction alarm information;

[0014] An element information extraction module is used to extract elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information;

[0015] An alarm information screening module, used to screen the abnormal transaction alarm information based on the element information corresponding to the abnormal transaction alarm information, and obtain the screened abnormal transaction alarm information;

[0016] Context degradation matching is used to perform context degradation matching on the field values ​​in the filtered abnormal transaction alarm information. The context degradation matching refers to taking the context information of the field values ​​with a preset number of words as the matching starting point, and sequentially reducing the number of word matching of the context information of the field values ​​until the context information of the field values ​​obtained by matching meets the preset recommendation condition and ends the matching process;

[0017] The alarm information recommendation model generation module is used to generate an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and the context information of the field value that meets the preset recommendation condition obtained by matching, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0018] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, an alarm information processing method as described in any one of the embodiments of the present invention is implemented.

[0019] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the alarm information processing method as described in any one of the embodiments of the present invention.

[0020] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the alarm information processing method as described in any one of the embodiments of the present invention.

[0021] In the embodiment of the present invention, by obtaining abnormal transaction alarm information, and then extracting elements from the abnormal transaction alarm information, the element information corresponding to the abnormal transaction alarm information is obtained, and then the abnormal transaction alarm information is screened according to the element information corresponding to the abnormal transaction alarm information to obtain the screened abnormal transaction alarm information, and then the field values ​​in the screened abnormal transaction alarm information are context-downgraded matched. Context-downgraded matching refers to taking the context information of the field values ​​of a preset number of words as the matching starting point, and successively reducing the number of word matches of the context information of the field values, until the context information of the field values ​​obtained by matching meets the preset recommendation conditions and ends the matching process; based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​obtained by matching that meets the preset recommendation conditions, an alarm information recommendation model is generated, and then abnormal transaction review rules are generated based on the alarm information recommendation model. The above technical scheme realizes the automatic downgrade matching and judgment of the context information of the field values, without the need to manually identify the context information of the field values, thereby improving the efficiency of identifying the context information. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 A flowchart of a method for processing alarm information provided by an embodiment of the present invention;

[0024] Figure 2 A flowchart of a method for processing alarm information provided by an embodiment of the present invention;

[0025] Figure 3 A flowchart of a method for processing alarm information provided by an embodiment of the present invention;

[0026] Figure 4 A flowchart of a method for processing alarm information provided by an embodiment of the present invention;

[0027] Figure 5 A flowchart of a method for processing alarm information provided by an embodiment of the present invention;

[0028] Figure 6 A schematic diagram of the structure of an alarm information processing device provided by an embodiment of the present invention;

[0029] Figure 7 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0031] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance. The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0032] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0033] Figure 1 This is a flowchart of an alarm information processing method provided by an embodiment of the present invention. This embodiment is applicable to the case of automatic matching and judgment of field value context information. The method can be executed by an alarm information processing device. The alarm information processing device can be implemented in the form of hardware and / or software. The alarm information processing device can be configured in electronic devices such as computer terminals or servers. Figure 1 As shown, the method includes:

[0034] S110. Obtain abnormal transaction warning information.

[0035] In the embodiment of the present invention, abnormal transactions refer to transactions that may have money laundering risks detected by the anti-money laundering list monitoring system. Abnormal transaction alarm information refers to the relevant information of abnormal transactions that trigger alarms, which may include but are not limited to transaction flow, transaction time, and transaction personnel information, etc. It can be structured information or unstructured message information, which is not specifically limited here.

[0036] S120: Extract elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information.

[0037] In an embodiment of the present invention, one or more elements in the abnormal transaction alarm information can be extracted to obtain element information corresponding to the abnormal transaction alarm information, wherein the element information can be field values, hit names, list identifiers, etc., which are not specifically limited here.

[0038] S130. Filter the abnormal transaction warning information based on the element information corresponding to the abnormal transaction warning information to obtain filtered abnormal transaction warning information.

[0039] In the embodiment of the present invention, screening refers to extracting key warning information that can represent audit experience from abnormal transaction warning information, that is, extracting abnormal transaction warning information that can be used to formulate or generate abnormal transaction audit rules.

[0040] Specifically, filtered abnormal transaction warning information associated with element information can be obtained by limiting the start and end time, limiting the range of false hit samples, and performing filtering operations such as threshold filtering.

[0041] S140. Perform context downgrade matching on the field values ​​in the filtered abnormal transaction alarm information. Context downgrade matching refers to taking the context information of the field values ​​with a preset number of words as the matching starting point, and successively reducing the number of word matches in the context information of the field values ​​until the context information of the field values ​​obtained by matching meets the preset recommendation conditions, thereby terminating the matching process.

[0042] The preset number of words may be any integer greater than 1 and is not specifically limited here.

[0043] In the embodiment of the present invention, N-word context matching can be performed on the field value in the abnormal transaction alarm information first, and when the N-word context information of the field value does not meet the preset recommendation condition, N-1-word context matching is performed, until N-1=1 and the degradation ends, where N is an integer greater than 1. N-word context information refers to a total of N words selected as context before or after the field value.

[0044] S150. Generate an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and the context information of the field value that meets the preset recommendation condition obtained by matching, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0045] The preset recommendation condition is a basis for determining whether the context information can be used to construct an alarm information recommendation model. Optionally, the preset recommendation condition may include that the number of context information in the field value is greater than a preset number threshold, or the ratio of the number of words in the context information in the field value to the number of words in the abnormal transaction alarm information group is greater than a preset ratio threshold.

[0046] In an embodiment of the present invention, the number of context information refers to the number of times the context information of the field value appears in the abnormal transaction alarm information. Exemplarily, the field value is "Zhang San", and the context information of the field value is "Zhang San remittance". If the number of times "Zhang San remittance" appears in the abnormal transaction alarm information exceeds 100 times, then an alarm information recommendation model can be generated based on "Zhang San remittance". It should be noted that abnormal transaction alarm information with the same element information can be divided into an abnormal transaction alarm information group. Exemplarily, in any abnormal transaction alarm information group, if the number of words of "Zhang San remittance" that appear accounts for more than one third of the number of words in the abnormal transaction alarm information group, then an alarm information recommendation model can be generated for "Zhang San remittance".

[0047] In an embodiment of the present invention, the alarm information recommendation model is an information storage model, which can store element information corresponding to abnormal transaction alarm information and context information of field values ​​that meet preset recommendation conditions for subsequent generation of abnormal transaction review rules. The abnormal transaction review rules can be used for anti-money laundering monitoring.

[0048] In some optional embodiments, when the abnormal transaction alarm information is structured data, an alarm information recommendation model can be directly constructed based on the element information corresponding to the abnormal transaction alarm information.

[0049] In the embodiment of the present invention, by obtaining abnormal transaction alarm information, and then extracting elements from the abnormal transaction alarm information, element information corresponding to the abnormal transaction alarm information is obtained, and then the abnormal transaction alarm information is screened according to the element information corresponding to the abnormal transaction alarm information to obtain the screened abnormal transaction alarm information, and then the field values ​​in the screened abnormal transaction alarm information are context-downgraded matched. Context-downgraded matching refers to taking the context information of the field values ​​of a preset number of words as the matching starting point, and successively reducing the number of word matches of the context information of the field values, until the context information of the field values ​​obtained by matching meets the preset recommendation conditions to end the matching process, and based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​obtained by matching that meet the preset recommendation conditions, an alarm information recommendation model is generated, and then abnormal transaction review rules are generated based on the alarm information recommendation model. The above technical scheme realizes the automatic matching and judgment of the context information of the field values, without the need to manually identify the context information of the field values, thereby improving the efficiency of identifying the context information.

[0050] Figure 2The flowchart of an alarm information processing method provided in an embodiment of the present invention is a flowchart of an alarm information processing method provided in an embodiment of the present invention. The method of this embodiment can be combined with each optional solution in the alarm information processing method provided in the above embodiment. The alarm information processing method provided in this embodiment is further optimized. Optionally, obtaining abnormal transaction alarm information includes: obtaining abnormal transaction alarm information from an alarm information table and / or an alarm detail table.

[0051] like Figure 2 As shown, the method includes:

[0052] S210. Obtain abnormal transaction alarm information from the alarm information table and / or the alarm detail table.

[0053] S220: Extract elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information.

[0054] S230: Filter the abnormal transaction warning information based on the element information corresponding to the abnormal transaction warning information to obtain filtered abnormal transaction warning information.

[0055] S240, performing context downgrade matching on the field values ​​in the filtered abnormal transaction alarm information. Context downgrade matching refers to taking the context information of the field values ​​with a preset number of words as the matching starting point, and successively reducing the number of word matches in the context information of the field values ​​until the context information of the field values ​​obtained by matching meets the preset recommendation conditions, thereby terminating the matching process.

[0056] S250. Generate an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and the context information of the field value obtained by matching and satisfying the preset recommendation condition, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0057] In an embodiment of the present invention, the alarm information table may include but is not limited to the business number of the abnormal transaction, the transaction flow of the abnormal transaction, the transaction time of the abnormal transaction, the transaction personnel information of the abnormal transaction, and the monitoring time of the abnormal transaction. The alarm details table may include but is not limited to the user information of the abnormal transaction, the amount of the abnormal transaction, and the currency of the abnormal transaction. The user information may include but is not limited to the name, nationality, and user ID number, etc. The alarm information table and the alarm details table may be associated through the alarm identifier.

[0058] In the embodiment of the present invention, automatic acquisition of abnormal transaction alarm information is achieved by reading the alarm information table and / or the alarm detail table, which improves the data acquisition rate and lays a data foundation for matching the context information of subsequent field values.

[0059] Figure 3A flowchart of an alarm information processing method provided in an embodiment of the present invention, the method of this embodiment can be combined with each optional scheme in the alarm information processing method provided in the above embodiment. The alarm information processing method provided in this embodiment is further optimized. Optionally, extracting elements from abnormal transaction alarm information to obtain element information corresponding to the abnormal transaction alarm information includes: extracting multiple elements from abnormal transaction alarm information to obtain element information corresponding to the abnormal transaction alarm information, wherein the element information corresponding to the abnormal transaction alarm information includes field values, list identifiers and hit names.

[0060] like Figure 3 As shown, the method includes:

[0061] S310. Obtain abnormal transaction warning information.

[0062] S320. Extract multiple elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information, wherein the element information corresponding to the abnormal transaction warning information includes field value, list identifier and hit name.

[0063] S330. Filter the abnormal transaction warning information based on the element information corresponding to the abnormal transaction warning information to obtain filtered abnormal transaction warning information.

[0064] S340, performing context downgrade matching on the field values ​​in the filtered abnormal transaction alarm information. Context downgrade matching refers to taking the context information of the field values ​​with a preset number of words as the matching starting point, and successively reducing the number of word matches in the context information of the field values ​​until the context information of the field values ​​obtained by matching meets the preset recommendation conditions, thereby terminating the matching process.

[0065] S350. Generate an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and the context information of the field value that meets the preset recommendation condition obtained by matching, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0066] In an embodiment of the present invention, the field value refers to the key information item of the alarm in the abnormal transaction targeted by the abnormal transaction alarm information, for example, the field value may be "Zhang San" or the like; the hit name refers to the name that matches the field value and triggers the alarm, for example, the hit name may be "Zhang San" or other names that match the field value; the list identifier refers to the unique identifier corresponding to the list in the abnormal transaction alarm information, for example, the list identifier may be a list ID.

[0067] In the embodiment of the present invention, the extraction of three elements is achieved by extracting field values, list identifiers and hit names from abnormal transaction alarm information, providing information support for the automatic matching and judgment of context information of subsequent field values, thereby ensuring the accuracy of context information identification.

[0068] Figure 4 A flowchart of an alarm information processing method provided in an embodiment of the present invention, the method of this embodiment can be combined with each optional scheme in the alarm information processing method provided in the above embodiment. The alarm information processing method provided in this embodiment is further optimized. Optionally, based on the element information corresponding to the abnormal transaction alarm information, the abnormal transaction alarm information is screened to obtain the screened abnormal transaction alarm information, including: obtaining the statistical data start time and the statistical data end time, retaining the abnormal transaction alarm information within the statistical data start time and the statistical data end time; limiting the false hit sample range for the abnormal transaction alarm information within the statistical data start time and the statistical data end time, and obtaining the abnormal transaction alarm information after the false hit sample range is limited; based on the element information, the abnormal transaction alarm information after the false hit sample range is limited is grouped and counted, and the abnormal transaction alarm information after the grouped statistics is obtained; based on the grouped statistics threshold, the abnormal transaction alarm information after the grouped statistics is filtered to obtain the screened abnormal transaction alarm information.

[0069] like Figure 4 As shown, the method includes:

[0070] S410: Obtain abnormal transaction warning information.

[0071] S420: Extract elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information.

[0072] S430, obtaining statistical data start time and statistical data end time, and retaining abnormal transaction alarm information within the statistical data start time and the statistical data end time.

[0073] In the embodiment of the present invention, the statistical data start time and the statistical data end time can be preset through the interactive interface.

[0074] Exemplarily, the user sets the statistical data start time to 20241001 and the statistical data end time to 20241031, so that abnormal transaction alarm information within the time range of 20241001-20241031 can be obtained.

[0075] S440, limiting the false hit sample range of the abnormal transaction alarm information within the statistical data start time and the statistical data end time, and obtaining the abnormal transaction alarm information after the false hit sample range is limited.

[0076] Specifically, the normal transaction object identifier can be obtained; the normal transaction object identifier is matched to the abnormal transaction alarm information, and the abnormal transaction alarm information within the statistical data start time and the statistical data end time is eliminated to obtain the abnormal transaction alarm information after the false hit sample range is limited.

[0077] Among them, the normal transaction object identifier refers to the user identifier of non-money laundering transactions, which can be a user name or transaction number, etc., and is not specifically limited here. It should be noted that by eliminating the abnormal transaction alarm information corresponding to the normal transaction object, the abnormal transaction alarm information corresponding to the money laundering user is retained, thereby reducing the occurrence of false hits and improving the data quality of the abnormal transaction alarm information.

[0078] S450. Based on the element information, group and count the abnormal transaction warning information after the false hit sample range is limited to obtain the abnormal transaction warning information after group and count.

[0079] Specifically, the element information includes multiple element information. Accordingly, based on the element information, the abnormal transaction alarm information after the false hit sample range is limited is grouped and counted to obtain the abnormal transaction alarm information after grouping and counting, including: dividing the abnormal transaction alarm information with the same element information into an abnormal transaction alarm information group to obtain the abnormal transaction alarm information after grouping and counting, wherein the abnormal transaction alarm information after grouping and counting includes the abnormal transaction alarm information groups corresponding to the multiple element information.

[0080] It should be noted that by grouping and counting the abnormal transaction alarm information based on the factor information, the abnormal transaction alarm information can be classified so that the abnormal transaction alarm information can be subsequently filtered through the group statistical threshold, thereby improving the data quality of the abnormal transaction alarm information.

[0081] S460: Filter the abnormal transaction alarm information after the group statistics based on the group statistics threshold to obtain filtered abnormal transaction alarm information.

[0082] Exemplarily, the grouping statistical threshold may be 3 or other values. Specifically, if the number of occurrences of "Zhang San" in the abnormal transaction alarm information group is less than 3, it indicates that the abnormal transaction alarm information corresponding to the abnormal transaction alarm information group is not related to money laundering and can be filtered and deleted.

[0083] S470, performing context downgrade matching on the field values ​​in the filtered abnormal transaction alarm information. Context downgrade matching refers to taking the context information of the field values ​​with a preset number of words as the matching starting point, and successively reducing the number of word matches in the context information of the field values ​​until the context information of the matched field values ​​meets the preset recommendation conditions, thereby terminating the matching process.

[0084] S480. Generate an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and the context information of the field value that meets the preset recommendation condition obtained by matching, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0085] In the embodiment of the present invention, by limiting the start and end time, limiting the range of false hit samples, and filtering by group statistical thresholds, abnormal transaction alarm information screening is achieved, the data quality of abnormal transaction alarm information is improved, and thus the accuracy of identifying context information is improved.

[0086] Figure 5 A flowchart of an alarm information processing method provided in an embodiment of the present invention, the method of this embodiment can be combined with each optional solution in the alarm information processing method provided in the above embodiment. The alarm information processing method provided in this embodiment is further optimized. Optionally, context degradation matching is performed on the field values ​​in the filtered abnormal transaction alarm information, including: performing one or more of four-word context matching, three-word context matching, two-word context matching and one-word context matching on the field values ​​in the filtered abnormal transaction alarm information.

[0087] like Figure 5 As shown, the method includes:

[0088] S510. Obtain abnormal transaction warning information.

[0089] S520: Extract elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information.

[0090] S530: Filter the abnormal transaction warning information based on the element information corresponding to the abnormal transaction warning information to obtain filtered abnormal transaction warning information.

[0091] S540: Perform one or more of four-word context matching, three-word context matching, two-word context matching and one-word context matching on the field values ​​in the filtered abnormal transaction alarm information.

[0092] S550. Generate an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and the context information of the field value obtained by matching and satisfying the preset recommendation condition, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0093] Specifically, obtain the two words before the field value in the filtered abnormal transaction alarm information and the two words after the field value in the filtered abnormal transaction alarm information; construct the four-word context information corresponding to the field value based on the two words before the field value and the two words after the field value; if the four-word context information corresponding to the field value does not meet the preset recommendation condition, then obtain the two words before the field value in the filtered abnormal transaction alarm information and the word after the field value in the filtered abnormal transaction alarm information, or obtain the word before the field value in the filtered abnormal transaction alarm information and the two words after the field value in the filtered abnormal transaction alarm information; construct the three-word context information corresponding to the field value based on the two words before the field value and the word after the field value, or based on the word before the field value and the two words after the field value; if the three-word context information corresponding to the field value does not meet the preset recommendation condition If the preset recommendation condition is met, then two words before the field value in the filtered abnormal transaction warning information are obtained, or two words after the field value in the filtered abnormal transaction warning information are obtained, or a word before the field value in the filtered abnormal transaction warning information and a word after the field value in the filtered abnormal transaction warning information are obtained; based on the word before the field value and the word after the field value, or the two words before the field value, or the two words after the field value, two-word context information corresponding to the field value is formed; if the two-word context information corresponding to the field value does not meet the preset recommendation condition, then a word before the field value in the filtered abnormal transaction warning information is obtained, or a word after the field value in the filtered abnormal transaction warning information is obtained; based on the word before the field value or the word after the field value, one-word context information corresponding to the field value is formed.

[0094] In an embodiment of the present invention, by performing four-word context matching, three-word context matching, two-word context matching and one-word context matching on the field value, automatic downgrade matching and judgment of the context information of the field value is achieved, without the need for manual identification of the context information of the field value, thereby improving the efficiency of identifying the context information.

[0095] Figure 6 The structure diagram of an alarm information processing device provided by an embodiment of the present invention is shown in FIG. Figure 6 As shown, the device comprises:

[0096] The alarm information acquisition module 610 is used to obtain abnormal transaction alarm information;

[0097] An element information extraction module 620 is used to extract elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information;

[0098] The alarm information screening module 630 is used to screen the abnormal transaction alarm information based on the element information corresponding to the abnormal transaction alarm information to obtain the screened abnormal transaction alarm information;

[0099] The context downgrade matching module 640 is used to perform context downgrade matching on the field values ​​in the filtered abnormal transaction alarm information. Context downgrade matching refers to taking the context information of the field values ​​with a preset number of words as the matching starting point, and successively reducing the number of word matches in the context information of the field values ​​until the context information of the matched field values ​​meets the preset recommendation conditions, thereby terminating the matching process.

[0100] The alarm information recommendation model generation module 650 is used to generate an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and the context information of the field value that meets the preset recommendation conditions, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0101] In the embodiment of the present invention, by obtaining abnormal transaction alarm information, and then extracting elements from the abnormal transaction alarm information, element information corresponding to the abnormal transaction alarm information is obtained, and then the abnormal transaction alarm information is screened according to the element information corresponding to the abnormal transaction alarm information to obtain the screened abnormal transaction alarm information, and then the field values ​​in the screened abnormal transaction alarm information are context-downgraded matched. Context-downgraded matching refers to taking the context information of the field values ​​of a preset number of words as the matching starting point, and successively reducing the number of word matches of the context information of the field values, until the context information of the field values ​​obtained by matching meets the preset recommendation conditions to end the matching process, and based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​obtained by matching that meets the preset recommendation conditions, an alarm information recommendation model is generated, and then abnormal transaction review rules are generated based on the alarm information recommendation model. The above technical scheme realizes the automatic matching and judgment of the context information of the field values, without the need to manually identify the context information of the field values, thereby improving the efficiency of identifying the context information.

[0102] In some optional implementations, the alarm information acquisition module 610 may also be specifically used to:

[0103] Obtain abnormal transaction alarm information from the alarm information table and / or alarm detail table.

[0104] In some optional embodiments, the alarm information table includes the business number of the abnormal transaction, the transaction flow of the abnormal transaction, the transaction time of the abnormal transaction, the transaction personnel information of the abnormal transaction and the monitoring time of the abnormal transaction; the alarm details table includes the user information of the abnormal transaction, the amount of the abnormal transaction, and the currency of the abnormal transaction.

[0105] In some optional implementations, the element information extraction module 620 may also be specifically used for:

[0106] Extract multiple elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information, wherein the element information corresponding to the abnormal transaction warning information includes field values, list identifiers and hit names.

[0107] In some optional implementations, the field value refers to the key information item of the alarm in the abnormal transaction targeted by the abnormal transaction alarm information; the hit name refers to the name of the triggered alarm that matches the field value; and the list identifier refers to the unique identifier corresponding to the list in the abnormal transaction alarm information.

[0108] In some optional implementations, the alarm information screening module 630 includes:

[0109] A time range limiting unit, used to obtain a statistical data start time and a statistical data end time, and retain abnormal transaction alarm information within the statistical data start time and the statistical data end time;

[0110] A false hit sample range limiting unit is used to limit the false hit sample range of the abnormal transaction alarm information within the statistical data start time and the statistical data end time, and obtain the abnormal transaction alarm information after the false hit sample range is limited;

[0111] A grouping statistics unit, configured to perform grouping statistics on the abnormal transaction warning information after the false hit sample range is limited based on the element information, to obtain the abnormal transaction warning information after grouping statistics;

[0112] The group statistical threshold filtering unit is used to filter the abnormal transaction alarm information after the group statistical analysis based on the group statistical threshold to obtain the filtered abnormal transaction alarm information.

[0113] In some optional implementations, the false hit sample range limiting unit may be specifically used to:

[0114] Get the normal transaction object identifier;

[0115] The abnormal transaction warning information corresponding to the normal transaction object identification is eliminated from the abnormal transaction warning information within the start time and the end time of the statistical data to obtain the abnormal transaction warning information after the false hit sample range is limited.

[0116] In some optional implementations, the group statistics unit may be specifically used for:

[0117] Abnormal transaction warning information with the same element information is divided into an abnormal transaction warning information group to obtain abnormal transaction warning information after grouping statistics, wherein the abnormal transaction warning information after grouping statistics includes abnormal transaction warning information groups corresponding to multiple element information.

[0118] In some optional implementations, the context degradation matching module 640 includes:

[0119] The multi-word downgrade matching unit is used to perform one or more of four-word context matching, three-word context matching, two-word context matching and one-word context matching on the field values ​​in the filtered abnormal transaction alarm information.

[0120] In some optional implementations, the multi-word downgrade matching unit may be specifically used for:

[0121] Obtaining two words before the field value in the filtered abnormal transaction warning information and two words after the field value in the filtered abnormal transaction warning information;

[0122] Four-word context information corresponding to the field value is formed based on the two words before the field value and the two words after the field value;

[0123] If the four-word context information corresponding to the field value does not meet the preset recommendation condition, then obtaining two words before the field value in the filtered abnormal transaction warning information and one word after the field value in the filtered abnormal transaction warning information, or obtaining one word before the field value in the filtered abnormal transaction warning information and two words after the field value in the filtered abnormal transaction warning information;

[0124] Three-word context information corresponding to the field value is formed based on two words before the field value and one word after the field value, or based on one word before the field value and two words after the field value;

[0125] If the three-word context information corresponding to the field value does not meet the preset recommendation condition, then obtain the two words before the field value in the filtered abnormal transaction warning information, or obtain the two words after the field value in the filtered abnormal transaction warning information, or obtain a word before the field value in the filtered abnormal transaction warning information and a word after the field value in the filtered abnormal transaction warning information;

[0126] Two-word context information corresponding to the field value is formed based on a word before the field value and a word after the field value, or two words before the field value, or two words after the field value;

[0127] If the two-word context information corresponding to the field value does not meet the preset recommendation condition, then obtaining a word before the field value in the filtered abnormal transaction warning information, or obtaining a word after the field value in the filtered abnormal transaction warning information;

[0128] The word context information corresponding to the field value is formed based on a word before the field value or a word after the field value.

[0129] In some optional implementations, the preset recommendation condition includes that the amount of context information of the field value is greater than a preset amount threshold, or the proportion of the context information of the field value in the abnormal transaction warning information group is greater than a preset proportion threshold.

[0130] The alarm information processing device provided in the embodiment of the present invention can execute the alarm information processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0131] Figure 7 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 7 , which shows an electronic device (eg Figure 7 The terminal device in the embodiment of the present invention may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0132] like Figure 7As shown, the electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An edit / output (I / O) interface 505 is also connected to the bus 504.

[0133] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 7 The electronic device 500 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0134] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the storage device 508, or installed from the ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of the embodiment of the present invention are executed.

[0135] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

[0136] The electronic device provided in the embodiment of the present invention and the alarm information processing method provided in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0137] An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the alarm information processing method provided in the above embodiment is implemented.

[0138] It should be noted that the computer-readable medium of the present invention can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0139] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0140] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0141] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device:

[0142] Obtain abnormal transaction warning information;

[0143] Extracting elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information;

[0144] Based on the element information corresponding to the abnormal transaction warning information, the abnormal transaction warning information is screened to obtain screened abnormal transaction warning information;

[0145] Performing context degradation matching on the field values ​​in the filtered abnormal transaction warning information, wherein the context degradation matching refers to taking the context information of the field values ​​with a preset number of words as the matching starting point, and sequentially reducing the number of word matching of the context information of the field values, until the context information of the field values ​​obtained by matching meets the preset recommendation condition and ends the matching process;

[0146] Based on the element information corresponding to the abnormal transaction alarm information and the context information of the field value obtained by matching and satisfying the preset recommendation conditions, an alarm information recommendation model is generated, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0147] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0148] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0149] The units involved in the embodiments of the present invention may be implemented by software or hardware, wherein the name of a unit does not limit the unit itself in some cases.

[0150] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0151] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0152] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the alarm information processing method provided in any embodiment of the present application.

[0153] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0154] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for processing alarm information, characterized in that: include: Obtain abnormal transaction warning information; Extracting elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information; Based on the element information corresponding to the abnormal transaction warning information, the abnormal transaction warning information is screened to obtain screened abnormal transaction warning information; Performing context degradation matching on the field values ​​in the filtered abnormal transaction warning information, wherein the context degradation matching refers to taking the context information of the field values ​​with a preset number of words as the matching starting point, and sequentially reducing the number of word matching of the context information of the field values, until the context information of the field values ​​obtained by matching meets the preset recommendation condition and ends the matching process; Based on the element information corresponding to the abnormal transaction alarm information and the context information of the field value obtained by matching and satisfying the preset recommendation condition, an alarm information recommendation model is generated, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

2. The method according to claim 1, characterized in that The obtaining of abnormal transaction warning information includes: Obtain abnormal transaction alarm information from the alarm information table and / or alarm detail table.

3. The method according to claim 2, characterized in that The alarm information table includes the business number of the abnormal transaction, the transaction flow of the abnormal transaction, the transaction time of the abnormal transaction, the transaction personnel information of the abnormal transaction and the monitoring time of the abnormal transaction; the alarm details table includes the user information of the abnormal transaction, the amount of the abnormal transaction and the currency of the abnormal transaction.

4. The method according to claim 1, characterized in that: The extracting elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information includes: Extract multiple elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information, wherein the element information corresponding to the abnormal transaction warning information includes field values, list identifiers and hit names.

5. The method according to claim 4, characterized in that The field value refers to the key information item of the alarm in the abnormal transaction targeted by the abnormal transaction alarm information; the hit name refers to the name of the triggered alarm that matches the field value; the list identifier refers to the unique identifier corresponding to the list in the abnormal transaction alarm information.

6. The method according to claim 1, characterized in that The filtering of the abnormal transaction warning information based on the element information corresponding to the abnormal transaction warning information to obtain the filtered abnormal transaction warning information includes: Obtain statistical data start time and statistical data end time, and retain abnormal transaction alarm information within the statistical data start time and the statistical data end time; Limiting the false hit sample range of abnormal transaction alarm information within the statistical data start time and the statistical data end time to obtain the false hit sample range-limited abnormal transaction alarm information; Based on the element information, grouping and counting the abnormal transaction warning information after the false hit sample range is limited to obtain the abnormal transaction warning information after grouping and counting; Based on the group statistical threshold, the abnormal transaction alarm information after the group statistical analysis is filtered to obtain the filtered abnormal transaction alarm information.

7. The method according to claim 6, characterized in that The step of limiting the false hit sample range of the abnormal transaction alarm information within the statistical data start time and the statistical data end time to obtain the abnormal transaction alarm information after the false hit sample range is limited includes: Get the normal transaction object identifier; The abnormal transaction warning information corresponding to the normal transaction object identification is eliminated from the abnormal transaction warning information within the start time and the end time of the statistical data to obtain the abnormal transaction warning information after the false hit sample range is limited.

8. The method according to claim 6, characterized in that The element information includes multiple element information. Accordingly, based on the element information, the abnormal transaction alarm information after the false hit sample range is limited is grouped and counted to obtain the abnormal transaction alarm information after grouping and counting, including: Abnormal transaction warning information with the same element information is divided into an abnormal transaction warning information group to obtain abnormal transaction warning information after grouping statistics, wherein the abnormal transaction warning information after grouping statistics includes abnormal transaction warning information groups corresponding to multiple element information.

9. The method according to claim 1, characterized in that: The performing context degradation matching on the field values ​​in the filtered abnormal transaction warning information includes: One or more of four-word context matching, three-word context matching, two-word context matching and one-word context matching are performed on the field values ​​in the filtered abnormal transaction alarm information.

10. The method according to claim 9, characterized in that The performing one or more of four-word context matching, three-word context matching, two-word context matching and one-word context matching on the field values ​​in the filtered abnormal transaction warning information includes: Obtaining two words before the field value in the filtered abnormal transaction warning information and two words after the field value in the filtered abnormal transaction warning information; Four-word context information corresponding to the field value is formed based on the two words before the field value and the two words after the field value; If the four-word context information corresponding to the field value does not meet the preset recommendation condition, then obtaining two words before the field value in the filtered abnormal transaction warning information and one word after the field value in the filtered abnormal transaction warning information, or obtaining one word before the field value in the filtered abnormal transaction warning information and two words after the field value in the filtered abnormal transaction warning information; Three-word context information corresponding to the field value is formed based on two words before the field value and one word after the field value, or based on one word before the field value and two words after the field value; If the three-word context information corresponding to the field value does not meet the preset recommendation condition, then obtain the two words before the field value in the filtered abnormal transaction warning information, or obtain the two words after the field value in the filtered abnormal transaction warning information, or obtain a word before the field value in the filtered abnormal transaction warning information and a word after the field value in the filtered abnormal transaction warning information; Two-word context information corresponding to the field value is formed based on a word before the field value and a word after the field value, or two words before the field value, or two words after the field value; If the two-word context information corresponding to the field value does not meet the preset recommendation condition, then obtaining a word before the field value in the filtered abnormal transaction warning information, or obtaining a word after the field value in the filtered abnormal transaction warning information; The word context information corresponding to the field value is formed based on a word before the field value or a word after the field value.

11. The method according to claim 1, characterized in that: The preset recommendation condition includes that the amount of context information of the field value is greater than a preset amount threshold, or the ratio of the number of words in the context information of the field value to the number of words in the abnormal transaction warning information group is greater than a preset ratio threshold.

12. An alarm information processing device, characterized in that: include: An alarm information acquisition module is used to obtain abnormal transaction alarm information; An element information extraction module is used to extract elements from the abnormal transaction warning information to obtain element information corresponding to the abnormal transaction warning information; An alarm information screening module, used to screen the abnormal transaction alarm information based on the element information corresponding to the abnormal transaction alarm information, and obtain the screened abnormal transaction alarm information; A context downgrade matching module, used for performing context downgrade matching on the field values ​​in the filtered abnormal transaction alarm information, wherein the context downgrade matching refers to taking the context information of the field values ​​with a preset number of words as the matching starting point, and sequentially reducing the number of word matches of the context information of the field values, until the context information of the field values ​​obtained by matching meets the preset recommendation condition and ends the matching process; The alarm information recommendation model generation module is used to generate an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and the context information of the field value that meets the preset recommendation condition obtained by matching, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

13. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the alarm information processing method according to any one of claims 1 to 11 when executing the computer program.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the alarm information processing method as described in any one of claims 1 to 11 is implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the alarm information processing method according to any one of claims 1 to 11.

Images