An alarm information processing method, device, equipment, storage medium and product

Abstract

The application discloses an alarm information processing method and device, equipment, storage medium and product. The application relates to the technical field of big data. The method comprises the following steps: acquiring abnormal transaction alarm information; performing element extraction on the abnormal transaction alarm information to obtain element information corresponding to the abnormal transaction alarm information; performing screening on the abnormal transaction alarm information based on the element information corresponding to the abnormal transaction alarm information, to obtain screened abnormal transaction alarm information; and performing context degradation matching on field value in the screened abnormal transaction alarm information, and generating an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and context information of the field value meeting preset recommendation conditions obtained through matching. According to the technical scheme, the context information of the field value does not need to be manually identified, and the identification efficiency is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of big data technology, and in particular to an alarm information processing method, apparatus, device, storage medium and product. Background Technology

[0002] In the era of big data, data analysis and data mining are very important. Extracting effective rules from massive amounts of data is a difficult but important task.

[0003] In the field of anti-money laundering, financial institutions need to manually identify the context of keywords in a large number of abnormal transaction alerts through anti-money laundering list monitoring systems, and then use the context of keywords that meet the requirements as intelligent review and recommendation rules.

[0004] In the process of realizing this invention, it was found that at least the following technical problems exist in the prior art: the prior art solutions have the problem of low efficiency in identifying context. Summary of the Invention

[0005] This invention provides an alarm information processing method, apparatus, device, storage medium, and product to solve the problem of low context discrimination efficiency.

[0006] In a first aspect, embodiments of the present invention provide an alarm information processing method, including:

[0007] Obtain abnormal transaction alert information;

[0008] Extract elements from the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information;

[0009] Based on the element information corresponding to the abnormal transaction alarm information, the abnormal transaction alarm information is filtered to obtain the filtered abnormal transaction alarm information.

[0010] The context-degraded matching is performed on the field values ​​in the filtered abnormal transaction alarm information. The context-degraded matching refers to starting the matching from the context information of the field value with a preset number of words, and successively reducing the number of words to match the context information of the field value until the context information of the matched field value meets the preset recommendation conditions and the matching process ends.

[0011] Based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​that meet the preset recommendation conditions, an alarm information recommendation model is generated, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0012] Secondly, embodiments of the present invention also provide an alarm information processing device, the device comprising:

[0013] The alarm information acquisition module is used to acquire abnormal transaction alarm information;

[0014] The element information extraction module is used to extract elements from the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information.

[0015] The alarm information filtering module is used to filter the abnormal transaction alarm information based on the element information corresponding to the abnormal transaction alarm information, and obtain the filtered abnormal transaction alarm information.

[0016] Context degradation matching is used to perform context degradation matching on the field values ​​in the filtered abnormal transaction alarm information. The context degradation matching refers to starting from the context information of the field value with a preset number of words, and successively reducing the number of words to match the context information of the field value until the context information of the matched field value meets the preset recommendation conditions and the matching process ends.

[0017] The alarm information recommendation model generation module is used to generate an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​that meet the preset recommendation conditions. The alarm information recommendation model is used to generate abnormal transaction review rules.

[0018] Thirdly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement an alarm information processing method as described in any of the embodiments of the present invention.

[0019] Fourthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the alarm information processing method as described in any of the embodiments of the present invention.

[0020] Fifthly, embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the alarm information processing method as described in any of the embodiments of the present invention.

[0021] In this embodiment of the invention, abnormal transaction alarm information is acquired, and then element extraction is performed on the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information. Then, based on the element information corresponding to the abnormal transaction alarm information, the abnormal transaction alarm information is filtered to obtain filtered abnormal transaction alarm information. Next, context-downgraded matching is performed on the field values ​​in the filtered abnormal transaction alarm information. Context-downgraded matching refers to starting with a preset number of words in the context information of the field value as the matching starting point, and successively reducing the number of words in the context information of the field value until the matched context information of the field value meets the preset recommendation conditions, ending the matching process. Based on the element information corresponding to the abnormal transaction alarm information and the matched context information of the field value that meets the preset recommendation conditions, an alarm information recommendation model is generated, and then abnormal transaction review rules are generated based on the alarm information recommendation model. The above technical solution realizes automatic downgraded matching and judgment of the context information of the field value, eliminating the need for manual identification of the context information of the field value and improving the efficiency of context information identification. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A flowchart of an alarm information processing method provided in an embodiment of the present invention;

[0024] Figure 2 A flowchart of an alarm information processing method provided in an embodiment of the present invention;

[0025] Figure 3 A flowchart of an alarm information processing method provided in an embodiment of the present invention;

[0026] Figure 4 A flowchart of an alarm information processing method provided in an embodiment of the present invention;

[0027] Figure 5 A flowchart of an alarm information processing method provided in an embodiment of the present invention;

[0028] Figure 6 This is a schematic diagram of the structure of an alarm information processing device provided in an embodiment of the present invention;

[0029] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0030] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0031] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this invention, terms such as "first," "second," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance. The acquisition, storage, use, and processing of data in the technical solutions of this application all comply with the relevant provisions of national laws and regulations.

[0032] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0033] Figure 1 This is a flowchart illustrating an alarm information processing method provided in an embodiment of the present invention. This embodiment is applicable to situations where the context information of field values ​​is automatically matched and judged. The method can be executed by an alarm information processing device, which can be implemented in hardware and / or software. This alarm information processing device can be configured in electronic devices such as computer terminals or servers. Figure 1 As shown, the method includes:

[0034] S110, Obtain abnormal transaction alarm information.

[0035] In this embodiment of the invention, an abnormal transaction refers to a transaction that may pose a money laundering risk, detected by the anti-money laundering list monitoring system. Abnormal transaction alarm information refers to relevant information about the abnormal transaction that triggers the alarm, which may include, but is not limited to, transaction details, transaction time, and transaction personnel information. This information can be structured or unstructured message information, and no specific limitation is made here.

[0036] S120. Extract elements from the abnormal transaction alarm information to obtain element information corresponding to the abnormal transaction alarm information.

[0037] In this embodiment of the invention, one or more elements can be extracted from the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information. The element information can be field values, hit names, and list identifiers, etc., which are not specifically limited here.

[0038] S130. Based on the element information corresponding to the abnormal transaction alarm information, the abnormal transaction alarm information is filtered to obtain the filtered abnormal transaction alarm information.

[0039] In this embodiment of the invention, screening refers to extracting key alarm information that can represent audit experience from abnormal transaction alarm information, that is, extracting abnormal transaction alarm information that can be used to formulate or generate abnormal transaction audit rules.

[0040] Specifically, filtering operations such as limiting start and end times, limiting the range of false hit samples, and threshold filtering can be used to obtain filtered abnormal transaction alarm information associated with element information.

[0041] S140. Perform context-downgraded matching on the field values ​​in the filtered abnormal transaction alarm information. Context-downgraded matching means taking the context information of the field value with a preset number of words as the starting point for matching, and successively reducing the number of words to match in the context information of the field value until the context information of the matched field value meets the preset recommendation conditions and the matching process ends.

[0042] The preset number of words can be any integer greater than 1, and no specific restrictions are imposed here.

[0043] In this embodiment of the invention, the field values ​​in the abnormal transaction alarm information can first undergo N-word context matching. If the N-word context information of the field value does not meet the preset recommendation conditions, then N-1-word context matching is performed until N-1 = 1, at which point the downgrade ends, where N is an integer greater than 1. The N-word context information refers to the selection of a total of N words as context before or after the field value.

[0044] S150. Based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​that meet the preset recommendation conditions, an alarm information recommendation model is generated, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0045] The preset recommendation criteria are used to determine whether the contextual information can be used to build an alarm information recommendation model. Optionally, the preset recommendation criteria may include the number of contextual information values ​​in a field being greater than a preset quantity threshold, or the proportion of the number of words in the contextual information values ​​in a field to the number of words in the abnormal transaction alarm information group being greater than a preset proportion threshold.

[0046] In this embodiment of the invention, the number of contextual information items refers to the number of times the contextual information of the field value appears in the abnormal transaction alarm information. For example, if the field value is "Zhang San" and the contextual information is "Zhang San remittance," and if "Zhang San remittance" appears more than 100 times in the abnormal transaction alarm information, an alarm information recommendation model can be generated based on "Zhang San remittance." It should be noted that abnormal transaction alarm information with the same element information can be divided into an abnormal transaction alarm information group. For example, in any abnormal transaction alarm information group, if the number of words containing "Zhang San remittance" accounts for more than one-third of the total number of words in that group, an alarm information recommendation model can be generated based on "Zhang San remittance."

[0047] In this embodiment of the invention, the alarm information recommendation model is an information storage model, which can store the element information corresponding to the abnormal transaction alarm information and the context information of the column values ​​that meet the preset recommendation conditions, so as to be used for the subsequent generation of abnormal transaction review rules. The abnormal transaction review rules can be used for anti-money laundering monitoring.

[0048] In some optional embodiments, when the abnormal transaction alarm information is structured data, an alarm information recommendation model can be directly constructed based on the element information corresponding to the abnormal transaction alarm information.

[0049] In this embodiment of the invention, abnormal transaction alarm information is acquired, and then element extraction is performed on the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information. Then, based on the element information corresponding to the abnormal transaction alarm information, the abnormal transaction alarm information is filtered to obtain filtered abnormal transaction alarm information. Next, context-degraded matching is performed on the field values ​​in the filtered abnormal transaction alarm information. Context-degraded matching refers to starting with a preset number of words in the context information of the field value as the matching starting point, and successively reducing the number of words in the context information of the field value until the matched context information of the field value meets the preset recommendation conditions. Based on the element information corresponding to the abnormal transaction alarm information and the matched context information of the field values ​​that meet the preset recommendation conditions, an alarm information recommendation model is generated. Then, abnormal transaction review rules are generated based on the alarm information recommendation model. The above technical solution realizes automatic matching and judgment of the context information of field values, eliminating the need for manual verification of the context information of field values ​​and improving the efficiency of context information verification.

[0050] Figure 2This is a flowchart illustrating an alarm information processing method provided in an embodiment of the present invention. The method in this embodiment can be combined with various optional solutions in the alarm information processing methods provided in the above embodiments. The alarm information processing method provided in this embodiment has been further optimized. Optionally, obtaining abnormal transaction alarm information includes: obtaining abnormal transaction alarm information from an alarm information table and / or an alarm detail table.

[0051] like Figure 2 As shown, the method includes:

[0052] S210. Obtain abnormal transaction alarm information from the alarm information table and / or alarm details table.

[0053] S220. Extract elements from the abnormal transaction alarm information to obtain element information corresponding to the abnormal transaction alarm information.

[0054] S230. Based on the element information corresponding to the abnormal transaction alarm information, the abnormal transaction alarm information is filtered to obtain the filtered abnormal transaction alarm information.

[0055] S240. Perform context-downgraded matching on the field values ​​in the filtered abnormal transaction alarm information. Context-downgraded matching means taking the context information of the field value with a preset number of words as the starting point for matching, and successively reducing the number of words in the context information of the field value until the context information of the matched field value meets the preset recommendation conditions and the matching process ends.

[0056] S250. Based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​that meet the preset recommendation conditions, an alarm information recommendation model is generated, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0057] In this embodiment of the invention, the alarm information table may include, but is not limited to, the business number of the abnormal transaction, the transaction details of the abnormal transaction, the transaction time of the abnormal transaction, the transaction personnel information of the abnormal transaction, and the monitoring time of the abnormal transaction. The alarm details table may include, but is not limited to, the user information of the abnormal transaction, the amount of the abnormal transaction, and the currency of the abnormal transaction. User information may include, but is not limited to, name, nationality, and user identification number, etc. The alarm information table and the alarm details table can be associated through alarm identifiers.

[0058] In this embodiment of the invention, abnormal transaction alarm information is automatically obtained by reading the alarm information table and / or alarm detail table, which improves the data acquisition rate and lays a data foundation for matching the context information of subsequent field values.

[0059] Figure 3This is a flowchart of an alarm information processing method provided by an embodiment of the present invention. The method of this embodiment can be combined with various optional solutions in the alarm information processing methods provided in the above embodiments. The alarm information processing method provided in this embodiment has been further optimized. Optionally, element extraction is performed on abnormal transaction alarm information to obtain element information corresponding to the abnormal transaction alarm information, including: extracting multiple elements from the abnormal transaction alarm information to obtain element information corresponding to the abnormal transaction alarm information, wherein the element information corresponding to the abnormal transaction alarm information includes field values, list identifiers, and hit names.

[0060] like Figure 3 As shown, the method includes:

[0061] S310, Obtain abnormal transaction alarm information.

[0062] S320. Extract multiple elements from the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information, wherein the element information corresponding to the abnormal transaction alarm information includes field values, list identifiers and hit names.

[0063] S330. Based on the element information corresponding to the abnormal transaction alarm information, the abnormal transaction alarm information is filtered to obtain the filtered abnormal transaction alarm information.

[0064] S340. Perform context-downgraded matching on the field values ​​in the filtered abnormal transaction alarm information. Context-downgraded matching means taking the context information of the field value with a preset number of words as the starting point for matching, and successively reducing the number of words in the context information of the field value until the context information of the matched field value meets the preset recommendation conditions and the matching process ends.

[0065] S350. Based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​that meet the preset recommendation conditions, an alarm information recommendation model is generated, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0066] In this embodiment of the invention, the field value refers to the key information item of the abnormal transaction targeted by the abnormal transaction alarm information, such as "Zhang San"; the hit name refers to the name that matches the field value and triggers the alarm, such as "Zhang San" or other names that match the field value; the list identifier refers to the unique identifier corresponding to the list in the abnormal transaction alarm information, such as the list ID.

[0067] In this embodiment of the invention, by extracting the field values, list identifiers, and hit names from the abnormal transaction alarm information, the extraction of the three elements is achieved, which provides information support for the automatic matching and judgment of the context information of subsequent field values ​​and ensures the accuracy of context information identification.

[0068] Figure 4 This is a flowchart of an alarm information processing method provided by an embodiment of the present invention. The method of this embodiment can be combined with various optional solutions in the alarm information processing methods provided in the above embodiments. The alarm information processing method provided in this embodiment has been further optimized. Optionally, based on the element information corresponding to the abnormal transaction alarm information, the abnormal transaction alarm information is filtered to obtain filtered abnormal transaction alarm information, including: obtaining the start time and end time of the statistical data, and retaining the abnormal transaction alarm information within the start time and end time of the statistical data; limiting the range of false hit samples for the abnormal transaction alarm information within the start time and end time of the statistical data, to obtain abnormal transaction alarm information after limiting the range of false hit samples; grouping and statistically analyzing the abnormal transaction alarm information after limiting the range of false hit samples based on the element information, to obtain grouped and statistically analyzed abnormal transaction alarm information; and filtering the grouped and statistically analyzed abnormal transaction alarm information based on the grouped statistical threshold, to obtain filtered abnormal transaction alarm information.

[0069] like Figure 4 As shown, the method includes:

[0070] S410, Obtain abnormal transaction alarm information.

[0071] S420. Extract elements from the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information.

[0072] S430. Obtain the start time and end time of statistical data, and retain abnormal transaction alarm information within the start time and end time of statistical data.

[0073] In this embodiment of the invention, the start time and end time of statistical data can be preset through an interactive interface.

[0074] For example, if a user sets the start time of statistical data to 20241001 and the end time of statistical data to 20241031, then abnormal transaction alarm information within the time range of 20241001-20241031 can be obtained.

[0075] S440. Limit the range of false hit samples for abnormal transaction alarm information within the start time and end time of the statistical data to obtain abnormal transaction alarm information after limiting the range of false hit samples.

[0076] Specifically, the identifiers of normal transaction objects can be obtained; the abnormal transaction alarm information corresponding to the normal transaction object identifiers can be removed from the abnormal transaction alarm information within the start and end times of the statistical data to obtain the abnormal transaction alarm information after limiting the range of false hits.

[0077] The "normal transaction object identifier" refers to the user identifier for non-money laundering transactions, which can be a user name or transaction number, etc., without specific limitations. It should be noted that by removing abnormal transaction alerts corresponding to normal transaction objects, and retaining abnormal transaction alerts for users with a high probability of money laundering, false positives can be reduced, thus improving the data quality of abnormal transaction alert information.

[0078] S450. Based on the element information, the abnormal transaction alarm information after the range of the false hit sample is limited is grouped and statistically analyzed to obtain the abnormal transaction alarm information after grouping and statistical analysis.

[0079] Specifically, the element information includes multiple element information. Correspondingly, based on the element information, the abnormal transaction alarm information after the range of false hit samples is limited is grouped and statistically analyzed to obtain the abnormal transaction alarm information after grouping and statistical analysis. This includes: dividing the abnormal transaction alarm information with the same element information into an abnormal transaction alarm information group to obtain the abnormal transaction alarm information after grouping and statistical analysis. The abnormal transaction alarm information after grouping and statistical analysis includes abnormal transaction alarm information groups corresponding to multiple element information.

[0080] It should be noted that grouping and statistically analyzing abnormal transaction alarm information based on element information enables the classification of abnormal transaction alarm information. This allows for subsequent filtering of abnormal transaction alarm information using grouping and statistical thresholds, thereby improving the data quality of abnormal transaction alarm information.

[0081] S460. Based on the grouped statistical threshold, the abnormal transaction alarm information after grouped statistics is filtered to obtain the filtered abnormal transaction alarm information.

[0082] For example, the grouping threshold can be 3 or other values. Specifically, if the number of times "Zhang San" appears in the abnormal transaction alarm information group is less than 3, it indicates that the abnormal transaction alarm information corresponding to the abnormal transaction alarm information group is not related to money laundering and can be filtered and deleted.

[0083] S470. Perform context-downgraded matching on the field values ​​in the filtered abnormal transaction alarm information. Context-downgraded matching means taking the context information of the field value with a preset number of words as the starting point for matching, and successively reducing the number of words to match in the context information of the field value until the context information of the matched field value meets the preset recommendation conditions and the matching process ends.

[0084] S480. Based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​that meet the preset recommendation conditions, an alarm information recommendation model is generated, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0085] In this embodiment of the invention, by limiting the start and end time, limiting the range of false hit samples, and filtering by group statistical thresholds, the abnormal transaction alarm information is filtered, thereby improving the data quality of the abnormal transaction alarm information and thus improving the accuracy of context information identification.

[0086] Figure 5 This is a flowchart of an alarm information processing method provided by an embodiment of the present invention. The method of this embodiment can be combined with various optional schemes in the alarm information processing methods provided in the above embodiments. The alarm information processing method provided in this embodiment has been further optimized. Optionally, context degradation matching is performed on the field values ​​in the filtered abnormal transaction alarm information, including: performing one or more of four-word context matching, three-word context matching, two-word context matching, and one-word context matching on the field values ​​in the filtered abnormal transaction alarm information.

[0087] like Figure 5 As shown, the method includes:

[0088] S510, Obtain abnormal transaction alarm information.

[0089] S520. Extract elements from the abnormal transaction alarm information to obtain element information corresponding to the abnormal transaction alarm information.

[0090] S530. Based on the element information corresponding to the abnormal transaction alarm information, the abnormal transaction alarm information is filtered to obtain the filtered abnormal transaction alarm information.

[0091] S540. Perform one or more of the following on the field values ​​in the filtered abnormal transaction alarm information: four-word context matching, three-word context matching, two-word context matching, and one-word context matching.

[0092] S550. Based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​that meet the preset recommendation conditions, an alarm information recommendation model is generated, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0093] Specifically, the process involves obtaining the two words preceding and following the field value from the filtered abnormal transaction alert information; constructing a four-word context information corresponding to the field value based on these two words; if the four-word context information does not meet the preset recommendation criteria, then obtaining the two words preceding and following the field value from the filtered abnormal transaction alert information, or obtaining the one word preceding and following the field value from the filtered abnormal transaction alert information; constructing a three-word context information corresponding to the field value based on these two words; if the three-word context information does not meet the preset recommendation criteria, then... If the preset recommendation conditions are met, then the system retrieves either the two words preceding the value of a field in the filtered abnormal transaction alarm information, or the two words following the value of a field in the filtered abnormal transaction alarm information, or the word preceding the value of a field in the filtered abnormal transaction alarm information and the word following the value of a field in the filtered abnormal transaction alarm information; the two-word context information corresponding to the value of a field is formed based on the word preceding the value of a field and the word following the value of a field, or the two words preceding the value of a field, or the two words following the value of a field; if the two-word context information corresponding to the value of a field does not meet the preset recommendation conditions, then the system retrieves either the word preceding the value of a field in the filtered abnormal transaction alarm information, or the word following the value of a field in the filtered abnormal transaction alarm information; the one-word context information corresponding to the value of a field is formed based on the word preceding the value of a field, or the word following the value of a field.

[0094] In this embodiment of the invention, by performing four-word context matching, three-word context matching, two-word context matching, and one-word context matching on the field values, automatic downgrade matching and judgment of the context information of the field values ​​are achieved, eliminating the need for manual identification of the context information of the field values ​​and improving the efficiency of context information identification.

[0095] Figure 6 This is a schematic diagram of an alarm information processing device provided in an embodiment of the present invention. Figure 6 As shown, the device includes:

[0096] Alarm information acquisition module 610 is used to acquire abnormal transaction alarm information;

[0097] The element information extraction module 620 is used to extract elements from the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information;

[0098] The alarm information filtering module 630 is used to filter the abnormal transaction alarm information based on the element information corresponding to the abnormal transaction alarm information to obtain the filtered abnormal transaction alarm information.

[0099] The context degradation matching module 640 is used to perform context degradation matching on the field values ​​in the filtered abnormal transaction alarm information. Context degradation matching means that the context information of the field value with a preset number of words is used as the starting point for matching, and the number of words matching the context information of the field value is reduced in turn until the context information of the matched field value meets the preset recommendation conditions and the matching process ends.

[0100] The alarm information recommendation model generation module 650 is used to generate an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​that meet the preset recommendation conditions. The alarm information recommendation model is used to generate abnormal transaction review rules.

[0101] In this embodiment of the invention, abnormal transaction alarm information is acquired, and then element extraction is performed on the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information. Then, based on the element information corresponding to the abnormal transaction alarm information, the abnormal transaction alarm information is filtered to obtain filtered abnormal transaction alarm information. Next, context-degraded matching is performed on the field values ​​in the filtered abnormal transaction alarm information. Context-degraded matching refers to starting with a preset number of words in the context information of the field value as the matching starting point, and successively reducing the number of words in the context information of the field value until the matched context information of the field value meets the preset recommendation conditions. Based on the element information corresponding to the abnormal transaction alarm information and the matched context information of the field value that meets the preset recommendation conditions, an alarm information recommendation model is generated. Then, abnormal transaction review rules are generated based on the alarm information recommendation model. The above technical solution realizes automatic matching and judgment of the context information of field values, eliminating the need for manual verification of the context information of field values ​​and improving the efficiency of context information verification.

[0102] In some optional implementations, the alarm information acquisition module 610 may also be specifically used for:

[0103] Obtain abnormal transaction alarm information from the alarm information table and / or alarm details table.

[0104] In some optional implementations, the alarm information table includes the business number of the abnormal transaction, the transaction details of the abnormal transaction, the transaction time of the abnormal transaction, the transaction personnel information of the abnormal transaction, and the monitoring time of the abnormal transaction; the alarm details table includes the user information of the abnormal transaction, the amount of the abnormal transaction, and the currency of the abnormal transaction.

[0105] In some alternative implementations, the feature information extraction module 620 may also be specifically used for:

[0106] Multiple elements are extracted from the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information. The element information corresponding to the abnormal transaction alarm information includes field values, list identifiers, and hit names.

[0107] In some optional implementations, the field value refers to the key information item of the abnormal transaction targeted by the abnormal transaction alarm information; the hit name refers to the name of the alarm that triggers the alarm and matches the field value; and the list identifier refers to the unique identifier corresponding to the list in the abnormal transaction alarm information.

[0108] In some optional implementations, the alarm information filtering module 630 includes:

[0109] The time range limiting unit is used to obtain the start time and end time of statistical data, and retain abnormal transaction alarm information within the start time and end time of the statistical data;

[0110] The false hit sample range limiting unit is used to limit the false hit sample range of abnormal transaction alarm information within the start time and end time of the statistical data, so as to obtain abnormal transaction alarm information after the false hit sample range is limited;

[0111] The grouping and statistics unit is used to perform grouping and statistics on the abnormal transaction alarm information after the range of the false hit sample is limited, based on the element information, to obtain the abnormal transaction alarm information after grouping and statistics.

[0112] The group statistical threshold filtering unit is used to filter the abnormal transaction alarm information after group statistics based on the group statistical threshold to obtain the filtered abnormal transaction alarm information.

[0113] In some alternative implementations, the false hit sample range limiting unit can be specifically used for:

[0114] Obtain the identifier of the normal transaction object;

[0115] The abnormal transaction alarm information corresponding to the normal transaction object is identified, and the abnormal transaction alarm information within the start time and end time of the statistical data is removed to obtain the abnormal transaction alarm information after the range of false hits is limited.

[0116] In some alternative implementations, the grouped statistical unit can specifically be used for:

[0117] Abnormal transaction alarm information with the same element information is divided into an abnormal transaction alarm information group to obtain abnormal transaction alarm information after grouping and statistics. The abnormal transaction alarm information after grouping and statistics includes abnormal transaction alarm information groups corresponding to multiple element information.

[0118] In some alternative implementations, the context degradation matching module 640 includes:

[0119] The multi-word downgrade matching unit is used to perform one or more of the following on the field values ​​in the filtered abnormal transaction alarm information: four-word context matching, three-word context matching, two-word context matching, and one-word context matching.

[0120] In some optional implementations, the multi-word downgrade matching unit can specifically be used for:

[0121] Obtain the two words preceding the field value in the filtered abnormal transaction alarm information and the two words following the field value in the filtered abnormal transaction alarm information;

[0122] The four-word context information corresponding to the value of a field is formed by the two words before the value of the field and the two words after the value of the field.

[0123] If the four-word context information corresponding to the field value does not meet the preset recommendation conditions, then obtain the two words before the field value and the one word after the field value in the filtered abnormal transaction alarm information, or obtain the one word before the field value and the two words after the field value in the filtered abnormal transaction alarm information.

[0124] The three-word context information corresponding to the field value is formed by the two words before the field value and the word after the field value, or by the word before the field value and the two words after the field value.

[0125] If the three-word context information corresponding to the field value does not meet the preset recommendation conditions, then the two words before the field value in the filtered abnormal transaction alarm information are obtained, or the two words after the field value in the filtered abnormal transaction alarm information are obtained, or the word before the field value in the filtered abnormal transaction alarm information and the word after the field value in the filtered abnormal transaction alarm information are obtained.

[0126] The context information of the two words corresponding to the value of a field is formed by the word before the value of the field and the word after the value of the field, or the two words before the value of the field, or the two words after the value of the field.

[0127] If the context information of the two words corresponding to the value of the field does not meet the preset recommendation conditions, then obtain the word before the value of the field in the filtered abnormal transaction alarm information, or obtain the word after the value of the field in the filtered abnormal transaction alarm information.

[0128] The context information of a word corresponding to a field value is formed by the word preceding or following the field value.

[0129] In some optional implementations, the preset recommendation conditions include the number of contextual information values ​​for a field being greater than a preset quantity threshold, or the proportion of contextual information values ​​for a field to the abnormal transaction alarm information group being greater than a preset proportion threshold.

[0130] The alarm information processing device provided in the embodiments of the present invention can execute the alarm information processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0131] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Refer to the following... Figure 7 It illustrates an electronic device suitable for implementing embodiments of the present invention (e.g., Figure 7 The diagram below shows the structure of the terminal device or server 500. The terminal device in this embodiment may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 7 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0132] like Figure 7As shown, electronic device 500 may include a processing unit (e.g., central processing unit, graphics processor, etc.) 501, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 502 or a program loaded from storage device 508 into random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of electronic device 500. The processing unit 501, ROM 502, and RAM 503 are interconnected via bus 504. An edit / output (I / O) interface 505 is also connected to bus 504.

[0133] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows electronic device 500 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 7 An electronic device 500 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0134] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, it performs the functions defined in the methods of the embodiments of the present invention.

[0135] The names of the messages or information exchanged between the multiple devices in the embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0136] The electronic device provided in this embodiment of the invention and the alarm information processing method provided in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0137] This invention provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the alarm information processing method provided in the above embodiments.

[0138] It should be noted that the computer-readable medium described above in this invention can be a computer-readable signal medium, a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0139] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0140] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0141] The aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to:

[0142] Obtain abnormal transaction alert information;

[0143] Extract elements from the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information;

[0144] Based on the element information corresponding to the abnormal transaction alarm information, the abnormal transaction alarm information is filtered to obtain the filtered abnormal transaction alarm information.

[0145] The context-degraded matching is performed on the field values ​​in the filtered abnormal transaction alarm information. The context-degraded matching refers to starting the matching from the context information of the field value with a preset number of words, and successively reducing the number of words to match the context information of the field value until the context information of the matched field value meets the preset recommendation conditions and the matching process ends.

[0146] Based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​that meet the preset recommendation conditions, an alarm information recommendation model is generated, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

[0147] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0148] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0149] The units described in the embodiments of the present invention can be implemented in software or in hardware. The names of the units are not, in some cases, intended to limit the specific unit.

[0150] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0151] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0152] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the alarm information processing method provided in any embodiment of this application.

[0153] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0154] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A method for processing alarm information, characterized in that, include: Obtain abnormal transaction alert information; Extract elements from the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information; Based on the element information corresponding to the abnormal transaction alarm information, the abnormal transaction alarm information is filtered to obtain the filtered abnormal transaction alarm information. The context-degraded matching is performed on the field values ​​in the filtered abnormal transaction alarm information. The context-degraded matching refers to starting the matching from the context information of the field value with a preset number of words, and successively reducing the number of words to match the context information of the field value until the context information of the matched field value meets the preset recommendation conditions and the matching process ends. Based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​that meet the preset recommendation conditions, an alarm information recommendation model is generated, wherein the alarm information recommendation model is used to generate abnormal transaction review rules.

2. The method according to claim 1, characterized in that, The acquisition of abnormal transaction alarm information includes: Obtain abnormal transaction alarm information from the alarm information table and / or alarm details table.

3. The method according to claim 2, characterized in that, The alarm information table includes the business number of the abnormal transaction, the transaction details of the abnormal transaction, the transaction time of the abnormal transaction, the transaction personnel information of the abnormal transaction, and the monitoring time of the abnormal transaction; the alarm details table includes the user information of the abnormal transaction, the amount of the abnormal transaction, and the currency of the abnormal transaction.

4. The method according to claim 1, characterized in that, The step of extracting elements from the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information includes: Multiple elements are extracted from the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information. The element information corresponding to the abnormal transaction alarm information includes field values, list identifiers, and hit names.

5. The method according to claim 4, characterized in that, The field value refers to the key information item in the abnormal transaction targeted by the abnormal transaction alarm information; the hit name refers to the name that triggers the alarm and matches the field value; the list identifier refers to the unique identifier corresponding to the list in the abnormal transaction alarm information.

6. The method according to claim 1, characterized in that, The step of filtering the abnormal transaction alarm information based on the element information corresponding to the abnormal transaction alarm information to obtain the filtered abnormal transaction alarm information includes: Obtain the start time and end time of statistical data, and retain abnormal transaction alarm information within the start time and end time of statistical data; The range of false hit samples is limited for abnormal transaction alarm information within the start time and end time of the statistical data, resulting in abnormal transaction alarm information after the range of false hit samples is limited; Based on the aforementioned element information, the abnormal transaction alarm information after the range of the false hit samples is limited is grouped and statistically analyzed to obtain the abnormal transaction alarm information after grouping and statistical analysis. Based on the grouping statistical threshold, the abnormal transaction alarm information after grouping statistics is filtered to obtain the filtered abnormal transaction alarm information.

7. The method according to claim 6, characterized in that, The step of limiting the range of false positives for abnormal transaction alarm information within the start and end times of the statistical data to obtain abnormal transaction alarm information after limiting the range of false positives includes: Obtain the identifier of the normal transaction object; The abnormal transaction alarm information corresponding to the normal transaction object is identified, and the abnormal transaction alarm information within the start time and end time of the statistical data is removed to obtain the abnormal transaction alarm information after the range of false hits is limited.

8. The method according to claim 6, characterized in that, The element information includes multiple element information. Correspondingly, based on the element information, the abnormal transaction alarm information after limiting the range of false hit samples is grouped and statistically analyzed to obtain the grouped and statistically analyzed abnormal transaction alarm information, including: Abnormal transaction alarm information with the same element information is divided into an abnormal transaction alarm information group to obtain abnormal transaction alarm information after grouping and statistics. The abnormal transaction alarm information after grouping and statistics includes abnormal transaction alarm information groups corresponding to multiple element information.

9. The method according to claim 1, characterized in that, The context-downgrading matching of the field values ​​in the filtered abnormal transaction alarm information includes: The values ​​in the fields of the filtered abnormal transaction alarm information are subjected to one or more of the following: four-word context matching, three-word context matching, two-word context matching, and one-word context matching.

10. The method according to claim 9, characterized in that, The process of performing one or more of the following on the field values ​​in the filtered abnormal transaction alarm information: four-word context matching, three-word context matching, two-word context matching, and one-word context matching: Obtain the two words preceding the field value in the filtered abnormal transaction alarm information and the two words following the field value in the filtered abnormal transaction alarm information; The four-word context information corresponding to the value of a field is formed by the two words before the value of the field and the two words after the value of the field. If the four-word context information corresponding to the field value does not meet the preset recommendation conditions, then obtain the two words before the field value and the one word after the field value in the filtered abnormal transaction alarm information, or obtain the one word before the field value and the two words after the field value in the filtered abnormal transaction alarm information. The three-word context information corresponding to the field value is formed by the two words before the field value and the word after the field value, or by the word before the field value and the two words after the field value. If the three-word context information corresponding to the field value does not meet the preset recommendation conditions, then the two words before the field value in the filtered abnormal transaction alarm information are obtained, or the two words after the field value in the filtered abnormal transaction alarm information are obtained, or the word before the field value in the filtered abnormal transaction alarm information and the word after the field value in the filtered abnormal transaction alarm information are obtained. The context information of the two words corresponding to the value of a field is formed by the word before the value of the field and the word after the value of the field, or the two words before the value of the field, or the two words after the value of the field. If the context information of the two words corresponding to the value of the field does not meet the preset recommendation conditions, then obtain the word before the value of the field in the filtered abnormal transaction alarm information, or obtain the word after the value of the field in the filtered abnormal transaction alarm information. The context information of a word corresponding to a field value is formed by the word preceding or following the field value.

11. The method according to claim 1, characterized in that, The preset recommendation conditions include that the number of contextual information values ​​in the field is greater than a preset threshold, or that the number of words in the contextual information values ​​in the field accounts for a proportion of the number of words in the abnormal transaction alarm information group that is greater than a preset proportion threshold.

12. An alarm information processing device, characterized in that, include: The alarm information acquisition module is used to acquire abnormal transaction alarm information; The element information extraction module is used to extract elements from the abnormal transaction alarm information to obtain the element information corresponding to the abnormal transaction alarm information. The alarm information filtering module is used to filter the abnormal transaction alarm information based on the element information corresponding to the abnormal transaction alarm information, and obtain the filtered abnormal transaction alarm information. The context degradation matching module is used to perform context degradation matching on the field values ​​in the filtered abnormal transaction alarm information. The context degradation matching refers to starting from the context information of the field value with a preset number of words, and successively reducing the number of words to match the context information of the field value until the context information of the matched field value meets the preset recommendation conditions and the matching process ends. The alarm information recommendation model generation module is used to generate an alarm information recommendation model based on the element information corresponding to the abnormal transaction alarm information and the context information of the field values ​​that meet the preset recommendation conditions. The alarm information recommendation model is used to generate abnormal transaction review rules.

13. An electronic device, characterized in that, The system includes a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor, when executing the computer program, implements the alarm information processing method as described in any one of claims 1-11.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the alarm information processing method as described in any one of claims 1-11.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the alarm information processing method as described in any one of claims 1-11.

Images