Management object-oriented risk identification method and device, medium and electronic equipment

Abstract

The invention provides a management object-oriented risk identification method and device, a medium and electronic equipment, and is applied to the technical field of financial risk management, and the method comprises the steps: obtaining the bank transaction data and UnionPay transaction data of a management object, and generating an abnormal sample identification rule; internal business data and external business data are screened and calculated, and corresponding business strategies are constructed; and in combination with an abnormal sample identification rule and a business strategy, identifying a target management object with a risk behavior. According to the method, the transaction data of the bank and the UnionPay transaction data are combined, the transaction behaviors of the management object inside and outside the bank are comprehensively covered, and the abnormal sample identification rule and the internal and external business strategies are utilized to perform deep analysis on the behaviors of the management object from multiple dimensions, so that the identification capability of the risk behaviors of the management object is remarkably improved, and the safety of the management object is improved. And the operation safety and stability of the bank are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of financial risk management, and in particular to a risk identification method, device, medium and electronic equipment for a management object. Background Art

[0002] In recent years, cases caused by moral risks of banks’ management objects have occurred frequently. Some management objects, in pursuit of high standards of material life, have obtained benefits through improper or illegal means, which has seriously infringed the interests of banks and customers. In order to prevent and resolve such moral risks, off-site data analysis has gradually become the main means of risk prevention for banks.

[0003] Existing technologies mainly rely on credit reports and internal behavior data of the managed objects for analysis. However, the data sources of these methods are relatively one-sided and usually have a lag, making it difficult to identify risks in a timely manner. At the same time, existing methods also face multiple challenges, such as: the increasing concealment of illegal operations, the increasingly complex risk environment faced by banks, and the increasing awareness of grassroots employees to evade monitoring.

[0004] Therefore, how to effectively identify the risky behaviors of the management objects has become a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] In view of the above problems, the present invention provides a risk identification method, device, medium and electronic device for management objects that overcome the above problems or at least partially solve the above problems. The technical solution is as follows:

[0006] A risk identification method for a management object, comprising:

[0007] Obtain the bank's transaction data and UnionPay transaction data of multiple management objects;

[0008] Using the bank's transaction data and UnionPay transaction data, obtain abnormal sample identification rules;

[0009] Filter and calculate the internal business data of the plurality of management objects in the transaction data of the bank, and construct an internal business strategy using the internal business data;

[0010] Filter and calculate the external business data of the plurality of management objects in the UnionPay transaction data, and construct an external business strategy using the external business data;

[0011] The target management object with risky behavior is identified from the plurality of management objects by using the abnormal sample identification rule, the internal business policy and the external business policy.

[0012] A risk identification device for management objects, comprising: a management object data acquisition unit, an abnormal sample identification rule acquisition unit, an internal business strategy construction unit, an external business strategy construction unit and a target management object identification unit,

[0013] The management object data obtaining unit is used to obtain the bank's transaction data and UnionPay transaction data of multiple management objects;

[0014] The abnormal sample identification rule obtaining unit is used to obtain abnormal sample identification rules by using the bank's transaction data and the UnionPay transaction data;

[0015] The internal business strategy building unit is used to screen and calculate the internal business data of the plurality of management objects in the transaction data of the bank, and build the internal business strategy using the internal business data;

[0016] The external business strategy building unit is used to screen and calculate the external business data of the plurality of management objects in the UnionPay transaction data, and build an external business strategy using the external business data;

[0017] The target management object identification unit is used to identify the target management object with risky behavior among the multiple management objects by using the abnormal sample identification rule, the internal business policy and the external business policy.

[0018] A computer-readable storage medium stores a program thereon, wherein when the program is executed by a processor, the risk identification method for a management object described in any one of the above items is implemented.

[0019] An electronic device, comprising at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other via the bus; and the processor is used to call program instructions in the memory to execute any of the above-mentioned risk identification methods for management objects.

[0020] By means of the above technical scheme, the risk identification method, device, medium and electronic device for management objects provided by the present invention obtain the bank's transaction data and UnionPay transaction data of multiple management objects; use the bank's transaction data and UnionPay transaction data to obtain abnormal sample identification rules; screen and calculate the internal business data of multiple management objects in the bank's transaction data, and use the internal business data to build internal business strategies; screen and calculate the external business data of multiple management objects in the UnionPay transaction data, and use the external business data to build external business strategies; use abnormal sample identification rules, internal business strategies and external business strategies to identify target management objects with risky behaviors among multiple management objects. The present invention combines the bank's transaction data and UnionPay transaction data to comprehensively cover the transaction behaviors of management objects inside and outside the bank, and uses abnormal sample identification rules and internal and external business strategies to deeply analyze the behaviors of management objects from multiple dimensions, thereby significantly improving the ability to identify risky behaviors of management objects, thereby ensuring the safety and stability of bank operations.

[0021] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0023] Figure 1 A schematic diagram showing a flow chart of an implementation of a risk identification method for a management object provided by an embodiment of the present invention;

[0024] Figure 2 A flow chart showing another implementation of a risk identification method for management objects provided by an embodiment of the present invention;

[0025] Figure 3 A flow chart showing another implementation of a risk identification method for management objects provided by an embodiment of the present invention;

[0026] Figure 4 A schematic diagram showing the structure of a risk identification device for management objects provided by an embodiment of the present invention;

[0027] Figure 5 A schematic structural diagram of an electronic device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0028] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0029] Existing risk behavior warning rules are usually based on single feature analysis, and are often modeled according to a certain link or feature of the transaction (such as transaction time, counterparty, etc.). This method results in a huge amount of data generated for investigation clues, and the risk points are not concentrated enough, which brings difficulties to the actual investigation and implementation. In addition, behavioral feature analysis is more effective in summarizing past cases, but it is not ideal in case prevention. The setting of the "threshold" of risk indicators mostly relies on subjective experience and lacks sufficient data support, so there is a risk of misjudgment and omission.

[0030] Based on this, in an embodiment of the present invention, a risk identification method for management objects is provided. First, after obtaining the bank's transaction data and UnionPay transaction data of multiple management objects, abnormal sample identification rules are formulated through these data. Subsequently, the internal business data in the bank's transaction data is screened and calculated to construct corresponding internal business strategies. At the same time, the external business data in the UnionPay transaction data is screened and calculated to construct external business strategies. Combined with abnormal sample identification rules, internal business strategies and external business strategies, target management objects with risky behaviors are identified. It can be seen that the embodiment of the present invention can comprehensively cover the transaction behaviors of management objects inside and outside the bank, significantly improve risk identification capabilities through multi-dimensional analysis, and ensure safe and stable bank operations.

[0031] like Figure 1 As shown, a flow chart of an implementation of a risk identification method for a management object provided by an embodiment of the present invention is provided, and the method may include:

[0032] S100, obtaining the bank's transaction data and UnionPay transaction data of multiple management objects.

[0033] The management object refers to all targets in a banking enterprise that need to be monitored and analyzed, such as bank account managers.

[0034] Among them, the bank's transaction data refers to the various transaction and business data obtained from within the bank, reflecting the management object's banking business.

[0035] Among them, UnionPay transaction data refers to the data of transactions conducted by the management object through the UnionPay network, including consumption, transfers and withdrawals.

[0036] S110. Utilize the bank's transaction data and UnionPay transaction data to obtain abnormal sample identification rules.

[0037] Among them, the abnormal sample identification rule is to determine whether the management object has abnormal management objects with potential risk behaviors based on the management object’s bank transaction data and UnionPay transaction data.

[0038] Specifically, the embodiment of the present invention can preprocess and feature engineer the bank's transaction data and UnionPay transaction data, and then model them by combining an unsupervised model with a supervised machine learning model to obtain a constructed supervised machine learning model for describing the recognition rules of abnormal samples.

[0039] Optional, based on Figure 1 The method shown, such as Figure 2 As shown, a flowchart of another implementation of a risk identification method for a management object provided by an embodiment of the present invention is shown, and step S110 may include:

[0040] S200, preprocessing and feature engineering the bank's transaction data and UnionPay transaction data respectively, generating a plurality of internal derivative variables corresponding to the bank's transaction data and a plurality of external derivative variables corresponding to the UnionPay transaction data.

[0041] Specifically, the embodiment of the present invention can select sample data of the common management object matched in the transaction data of the bank and the transaction data of UnionPay, and model based on these sample data, wherein the common management object has transaction records in both data sources. For example: As shown in Table 1, assuming that the sample number of managers with transaction data of the bank is 9504, the sample number of managers with transaction data of UnionPay is 6293, and the cross-correlated sample number can be 4507, the embodiment of the present invention can use the cross-correlated 4507 sample data for modeling.

[0042] Table 1

[0043] Data Source Number of samples Number of variables Transaction data of the Bank 9504 184 UnionPay transaction data 6293 2997 Cross-correlation 4507 3181

[0044] Optional, based on Figure 2 The method shown, such as Figure 3 As shown, a flow chart of another implementation of a risk identification method for a management object provided by an embodiment of the present invention is shown, and step S200 may include:

[0045] S300. Fill in missing values ​​in the bank's transaction data according to predefined business logic rules.

[0046] The predefined business logic rules may be specifically as shown in Table 2. For different fields in the transaction data of the bank, corresponding missing value filling methods may be defined respectively. The embodiment of the present invention fills missing values ​​through predefined business logic rules to ensure the integrity of the data set, thereby avoiding data quality problems caused by missing values.

[0047] Table 2

[0048]

[0049]

[0050]

[0051] S310. Based on the multiple original internal variables of the bank's transaction data, multiple internal derivative variables are derived using business logic and statistical methods, and target internal derivative variables corresponding to the bank's transaction data are screened out from the multiple internal derivative variables.

[0052] S320. Based on the multiple original external variables of the UnionPay transaction data, multiple external derivative variables are derived using business logic and statistical methods, and a target external derivative variable corresponding to the UnionPay transaction data is screened out from the multiple original external variables and the multiple external derivative variables.

[0053] Specifically, the embodiment of the present invention can perform feature derivation from multiple feature dimensions based on the original internal variables of the bank's transaction data and the original external variables of UnionPay transaction data, and extract internal derived variables and external derived variables.

[0054] Optionally, the feature dimensions may include time features, transaction amount features, transaction frequency features, account behavior features, trend and cycle features, and aggregate statistical features.

[0055] With respect to time features, the embodiments of the present invention can extract features such as year, month, day, quarter, weekday / weekend, etc. from the transaction date, and calculate the average value, maximum value, minimum value, etc. of the transaction time interval.

[0056] The embodiment of the present invention can calculate the average transaction amount, the maximum transaction amount, the minimum transaction amount, and the standard deviation and coefficient of variation of the transaction amount based on the transaction amount characteristics.

[0057] The embodiment of the present invention can count the number of transactions within a certain period of time (such as day, week, month) and can also calculate the growth rate of daily, weekly or monthly transactions based on the transaction frequency characteristics.

[0058] The embodiment of the present invention can count the number and total amount of large-value transactions and calculate the number and proportion of off-site transactions based on account behavior characteristics.

[0059] The embodiment of the present invention can apply moving average or exponential smoothing to capture the transaction trend reflected by the bank's transaction data and analyze periodic characteristics, such as seasonal fluctuations, with respect to trend and periodic characteristics.

[0060] The embodiment of the present invention calculates rolling statistics of the bank's transaction data, such as mean, sum, and maximum value, based on aggregate statistical features according to a time window (such as 7 days or 30 days).

[0061] The embodiments of the present invention help to improve the prediction accuracy and stability of the model by capturing valuable information in the bank's transaction data and UnionPay transaction data from multiple feature dimensions.

[0062] S210: Based on the multiple internal derived variables and the multiple external derived variables, screen out the internal model input variables and the external model input variables.

[0063] Specifically, the embodiments of the present invention can screen out internal model input variables from multiple internal derivative variables and external model input variables from multiple external derivative variables through business screening and correlation screening.

[0064] Among them, business screening is to select the features most relevant to the problem based on the understanding of business knowledge and domain experience. The embodiment of the present invention can rely on the knowledge of domain experts to select internal and external derived variables that are considered important in theory or experience, and perform variable priority sorting or directly exclude obviously irrelevant variables.

[0065] Among them, correlation screening is to use statistical methods to quantify the correlation between features and target variables, so as to screen out the features with the greatest predictive power. The embodiment of the present invention can calculate the correlation coefficients between internal derived variables and external derived variables and target variables, such as the Pearson correlation coefficient, based on the results of business screening, and then select derived variables with correlations higher than a certain threshold as model input variables.

[0066] Optionally, the input variables may be as shown in Table 3, including 1 internal original variable, 10 internal derived variables, 17 external original variables and 4 external derived variables.

[0067] Table 3

[0068]

[0069]

[0070] S220. Using the sample data corresponding to the management object and the internal model input variables and the external model input variables, the iForest anomaly detection model is used to preliminarily identify the abnormal management object, and add labels to the sample data, wherein the labels are used to indicate whether the sample data is an abnormal sample.

[0071] The iForest model randomly samples data, selects features to construct isolated trees, and repeatedly generates multiple isolated trees until the termination condition is met to form an isolated forest. The path length of each sample is used to mark outliers. The parameter settings of the iForest model are as follows:

[0072]

[0073] The embodiment of the present invention can add labels based on the sample data of abnormal management objects identified by the iForest anomaly detection model. For example, the sample data of abnormal management objects is marked as 1, i.e., abnormal samples, and the sample data of non-abnormal management objects is marked as 0, i.e., non-abnormal samples.

[0074] S230: Use the labeled sample data to train the decision tree model and generate a decision tree visualization result.

[0075] Specifically, the embodiment of the present invention may use the labeled sample data as the input of the decision tree model to train the decision tree model.

[0076] S240: Analyze the decision tree visualization results to generate abnormal sample identification rules.

[0077] Among them, the anomaly identification rules may include at least one of the following rules:

[0078] Rule 1: The amount of large deposits in the past 12 months is > 1120510, and the number of night transactions in the past 6 months is > 1, and the number of large deposits in the past 12 months is > 48.

[0079] Rule 2: The amount of large deposits in the past 12 months is ≤ 1120510, and the proportion of cash withdrawals after large deposits in the past 6 months is > 3.

[0080] Rule 3: The amount of large deposits in the past 12 months is ≤1120510, and the proportion of cash withdrawals after large deposits in the past 6 months is ≤3, and the number of large deposits in the past 12 months is >3, and the proportion of consumption after large deposits in the past month is >22.5%, and the proportion of transaction amounts in the most commonly used transaction channels in the past month is >99.51.

[0081] Rule 4: The amount of large deposits in the past 12 months is ≤1120510, and the proportion of cash withdrawals after large deposits in the past 6 months is ≤3, and the number of large deposits in the past 12 months is ≤3, and the proportion of large transfers due to insurance maturities in the past month is >39.869.

[0082] The embodiment of the present invention combines unsupervised and supervised machine learning methods to identify abnormal management objects. First, the iForest model is used for anomaly detection, and then the samples are labeled according to the detection results. The decision tree model is used to describe the identification rules of abnormal samples to improve interpretability.

[0083] S120. Filter and calculate the internal business data of multiple management objects in the bank's transaction data, and use the internal business data to build an internal business strategy.

[0084] Among them, internal business data refers to data extracted from the bank's transaction data that reflects the business behavior of the management object within the bank. Optionally, internal business data includes large-amount transfer data, transfer data, and withdrawal data. For example, the fields involving internal business data can be shown in Table 4.

[0085] Table 4

[0086]

[0087]

[0088] Among them, internal business strategy is the risk management strategy formulated based on internal business data.

[0089] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, using internal business data to construct an internal business strategy may specifically include:

[0090] Obtain the internal data distribution of each internal business indicator in the internal business data of multiple management objects; determine the internal data screening threshold of the internal business indicator based on the internal data distribution of each internal business indicator; and construct an internal business strategy based on the internal data screening threshold of each internal business indicator.

[0091] The embodiment of the present invention can analyze the distribution of internal business data of each management object on different indicators. By analyzing the data distribution, the main characteristics of the business indicators can be identified, such as the mean, median, standard deviation, distribution form, etc. Based on the understanding of the internal data distribution, by setting appropriate screening thresholds, the management objects with abnormal internal indicators can be quickly identified, and the data can be converted into effective internal business strategies through the screening thresholds.

[0092] Optionally, the internal business policy may be as shown in Table 5.

[0093] Table 5

[0094]

[0095]

[0096] S130, screening and calculating the external business data of multiple management objects in the UnionPay transaction data, and using the external business data to build an external business strategy.

[0097] Among them, external business data refers to data extracted from UnionPay transaction data that reflects the consumption behavior of the management object in other financial institutions or merchants. Optionally, external business data includes large income data, cross-border or securities consumption data, small loan data, and night consumption data. For example, the fields involving external business data can be shown in Table 6.

[0098] Table 6

[0099]

[0100]

[0101] Among them, the external business strategy is a risk management strategy formulated based on external business data.

[0102] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, using external business data to construct an external business strategy may specifically include:

[0103] Obtain the external data distribution of each external business indicator in the external business data of multiple management objects; determine the external data screening threshold of the external business indicator based on the external data distribution of each external business indicator; and construct an external business strategy based on the external data screening threshold of each external business indicator.

[0104] The embodiment of the present invention can analyze the impact of external factors on the business, as well as the performance of various business indicators in different management objects. By analyzing the distribution of external data, the main characteristics of the financial behavior of the management object can be identified. Based on the understanding of the distribution of external data, by setting appropriate screening thresholds, the management objects with abnormal external indicators can be quickly identified, and the data can be converted into effective external business strategies through the screening thresholds.

[0105] Optionally, the external service policy may be as shown in Table 7.

[0106] Table 7

[0107]

[0108]

[0109]

[0110] S140. Utilize abnormal sample identification rules, internal business policies, and external business policies to identify target management objects with risky behaviors from among multiple management objects.

[0111] Specifically, the embodiment of the present invention combines abnormal identification rules, internal business policies and external business policies, and through comprehensive analysis, selects target management objects with risky behaviors for key monitoring and processing.

[0112] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, another optional embodiment provided by the embodiment of the present invention uses abnormal sample identification rules, internal business policies and external business policies to identify target management objects with risky behaviors from multiple management objects, which may specifically include:

[0113] By using abnormal sample identification rules, at least one first abnormal management object is locked among multiple management objects; by using internal business policies and external business policies, at least one second abnormal management object is locked among multiple management objects; and management objects that exist in both at least one first abnormal management object and at least one second abnormal management object are identified as target management objects with risky behaviors.

[0114] The embodiment of the present invention locks the management objects of "(large amount of outgoing transfer and no deposit) or (order cancellation)" through the screening of internal and external business policies, and divides these management objects into three categories. The description of suspicious abnormal characteristics of each category is shown in Table 8.

[0115] Table 8

[0116]

[0117]

[0118] Assume that through the joint screening of the model and the strategy, we have identified a total of 90 abnormal account managers. Among them, the model and the business strategy jointly locked in 9 suspected account managers who were suspected of flying singles. Table 9 is a description of the characteristics of these 9 account managers. Business personnel should give priority to these suspected account managers who are suspected of flying singles.

[0119] Table 9

[0120]

[0121]

[0122] The risk identification method for management objects provided by the present invention comprises: obtaining the bank's transaction data and UnionPay transaction data of multiple management objects; obtaining abnormal sample identification rules by using the bank's transaction data and UnionPay transaction data; screening and calculating the internal business data of multiple management objects in the bank's transaction data, and constructing internal business strategies by using the internal business data; screening and calculating the external business data of multiple management objects in the UnionPay transaction data, and constructing external business strategies by using the external business data; identifying target management objects with risky behaviors among multiple management objects by using abnormal sample identification rules, internal business strategies and external business strategies. The present invention combines the bank's transaction data and UnionPay transaction data, comprehensively covers the transaction behaviors of management objects inside and outside the bank, and uses abnormal sample identification rules and internal and external business strategies to deeply analyze the behaviors of management objects from multiple dimensions, thereby significantly improving the ability to identify risky behaviors of management objects, thereby ensuring the safety and stability of bank operations.

[0123] In order to facilitate understanding of the business strategy construction process provided by the embodiment of the present invention, it is explained here by way of example: by observing the distribution of the screening variables and combining business understanding, the variables with abnormal distribution can be screened out, and the corresponding screening thresholds (such as 95 percentiles, etc.) can be determined. Based on these thresholds, business strategies are formulated to lock in management objects with abnormal distribution. Taking "cash withdrawal transaction amount in the past 6 months", "large amount of deposits in the past 12 months", and "number of large deposits in the past 12 months" as examples, the data description is shown in Table 10.

[0124] Table 10

[0125]

[0126]

[0127] As shown in Table 10, the cash withdrawal transaction amount in the past six months (CP4080): the number of non-empty customers: 126, the screening threshold: 52,850 yuan (95% percentile), the number of locked abnormal customers: 6 (the cash withdrawal transaction amount in the past six months> 52,850). The large amount of deposits in the past 12 months (HP5031): the number of non-empty customers: 678, the screening threshold: 312,803 yuan (90% percentile), the number of locked abnormal customers: 67 (the large amount of deposits in the past 12 months> 312,803). The number of large deposits in the past 12 months (HP5032): the number of non-empty customers: 678, the screening threshold: 39 (95% percentile), the number of locked abnormal customers: 67 (the number of large deposits in the past 12 months> 39).

[0128] Although operations are depicted in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or in a sequential order.Multitasking and parallel processing may be advantageous under certain circumstances.

[0129] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0130] Corresponding to the above method embodiment, the embodiment of the present invention also provides a risk identification device for management objects, whose structure is as follows: Figure 4 As shown, it includes: a management object data obtaining unit 10, an abnormal sample identification rule obtaining unit 20, an internal business policy building unit 30, an external business policy building unit 40 and a target management object identification unit 50.

[0131] The management object data obtaining unit 10 is used to obtain the bank's transaction data and UnionPay transaction data of multiple management objects.

[0132] The abnormal sample identification rule obtaining unit 20 is used to obtain the abnormal sample identification rule by using the bank's transaction data and UnionPay transaction data.

[0133] The internal business strategy building unit 30 is used to screen and calculate the internal business data of multiple management objects in the transaction data of the bank, and build the internal business strategy using the internal business data.

[0134] The external business strategy building unit 40 is used to screen and calculate the external business data of multiple management objects in the UnionPay transaction data, and build the external business strategy using the external business data.

[0135] The target management object identification unit 50 is used to identify the target management object with risky behavior among multiple management objects by using abnormal sample identification rules, internal business policies and external business policies.

[0136] Optionally, the abnormal sample identification rule obtaining unit 20 may include: a derived variable generating subunit, a model input variable screening subunit, an abnormal management object preliminary identification subunit, a decision tree visualization result generating subunit and an abnormal sample identification rule generating subunit.

[0137] A derived variable generation subunit, used to perform preprocessing and feature engineering on the bank's transaction data and UnionPay transaction data, respectively, to generate a plurality of internal derived variables corresponding to the bank's transaction data and a plurality of external derived variables corresponding to UnionPay transaction data;

[0138] The input model variable screening subunit is used to screen out internal input model variables and external input model variables based on multiple internal derived variables and multiple external derived variables;

[0139] The abnormal management object preliminary identification subunit is used to use the sample data corresponding to the management object and the internal model input variables and the external model input variables, use the iForest abnormality detection model to perform preliminary identification of the abnormal management object, and add labels to the sample data, wherein the labels are used to indicate whether the sample data is an abnormal sample;

[0140] A decision tree visualization result generation subunit is used to train the decision tree model using labeled sample data and generate a decision tree visualization result;

[0141] The abnormal sample identification rule generation subunit is used to analyze the decision tree visualization results and generate abnormal sample identification rules.

[0142] Optionally, the derived variable generation subunit can be specifically used to fill in missing values ​​in the bank's transaction data according to predefined business logic rules; based on multiple original internal variables of the bank's transaction data, derive multiple internal derived variables using business logic and statistical methods; based on multiple original external variables of UnionPay transaction data, derive multiple external derived variables using business logic and statistical methods.

[0143] Optionally, the target management object identification unit 50 can be specifically used to use abnormal sample identification rules to lock at least one first abnormal management object among multiple management objects; use internal business policies and external business policies to lock at least one second abnormal management object among multiple management objects; and identify management objects that exist in at least one first abnormal management object and at least one second abnormal management object as target management objects with risky behaviors.

[0144] Optionally, the internal business strategy construction unit 30 can be specifically used to obtain the internal data distribution of each internal business indicator in the internal business data of multiple management objects; determine the internal data screening threshold of the internal business indicator based on the internal data distribution of each internal business indicator; and construct the internal business strategy based on the internal data screening threshold of each internal business indicator.

[0145] Optionally, the external business strategy construction unit 40 can be specifically used to obtain the external data distribution of each external business indicator in the external business data of multiple management objects; determine the external data screening threshold of the external business indicator based on the external data distribution of each external business indicator; and construct an external business strategy based on the external data screening threshold of each external business indicator.

[0146] Optionally, the internal business data includes large-value transfer data, deposit data and order cancellation data, and / or the external business data includes large-value income data, cross-border or securities consumption data, micro-loan data and nighttime consumption data.

[0147] The risk identification device for management objects provided by the present invention is used to: obtain the bank's transaction data and UnionPay transaction data of multiple management objects; use the bank's transaction data and UnionPay transaction data to obtain abnormal sample identification rules; screen and calculate the internal business data of multiple management objects in the bank's transaction data, and use the internal business data to build internal business strategies; screen and calculate the external business data of multiple management objects in the UnionPay transaction data, and use the external business data to build external business strategies; use abnormal sample identification rules, internal business strategies and external business strategies to identify target management objects with risky behaviors among multiple management objects. The present invention combines the bank's transaction data and UnionPay transaction data to comprehensively cover the transaction behaviors of management objects inside and outside the bank, and uses abnormal sample identification rules and internal and external business strategies to deeply analyze the behaviors of management objects from multiple dimensions, thereby significantly improving the ability to identify risky behaviors of management objects, thereby ensuring the safety and stability of bank operations.

[0148] Regarding the device in the above embodiment, the specific manner in which each unit performs the operation has been described in detail in the embodiment of the method, and will not be elaborated here.

[0149] The risk identification device for management objects includes a processor and a memory. The above-mentioned management object data acquisition unit 10, abnormal sample identification rule acquisition unit 20, internal business policy construction unit 30, external business policy construction unit 40 and target management object identification unit 50 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0150] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set. By adjusting the kernel parameters to combine the bank's transaction data and UnionPay transaction data, the transaction behavior of the management object inside and outside the bank can be fully covered. By using abnormal sample identification rules and internal and external business strategies, the behavior of the management object can be deeply analyzed from multiple dimensions, thereby significantly improving the ability to identify the risk behavior of the management object, thereby ensuring the safety and stability of the bank's operations.

[0151] An embodiment of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the risk identification method for management objects is implemented.

[0152] An embodiment of the present invention provides a processor, which is used to run a program, wherein the risk identification method for management objects is executed when the program is running.

[0153] like Figure 5 As shown, an embodiment of the present invention provides an electronic device 1000, which includes at least one processor 1001, at least one memory 1002 connected to the processor 1001, and a bus 1003; wherein the processor 1001 and the memory 1002 communicate with each other through the bus 1003; the processor 1001 is used to call the program instructions in the memory 1002 to execute the above-mentioned risk identification method for management objects. The electronic device in this article can be a server, a PC, a PAD, a mobile phone, etc.

[0154] The present invention also provides a computer program product, which, when executed on an electronic device, is suitable for executing a program that initializes the steps of a risk identification method for a management object.

[0155] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatuses, electronic devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable device to generate a machine, so that the instructions executed by the processor of the computer or other programmable device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0156] In a typical configuration, an electronic device includes one or more processors (CPU), a memory, and a bus. The electronic device may also include an input / output interface, a network interface, and the like.

[0157] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip. The memory is an example of a computer-readable medium.

[0158] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0159] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0160] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0161] In the description of the present invention, it should be understood that the terms "up", "down", "front", "back", "left" and "right" etc. indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description. They do not indicate or imply that the positions or elements referred to must have specific directions, be constructed and operate in specific directions. Therefore, they should not be understood as limitations of the present invention.

[0162] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. It should also be noted that the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0163] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0164] The above are only embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A risk identification method for management objects, characterized in that: include: Obtain the bank's transaction data and UnionPay transaction data of multiple management objects; Using the bank's transaction data and UnionPay transaction data, obtain abnormal sample identification rules; Filter and calculate the internal business data of the plurality of management objects in the transaction data of the bank, and construct an internal business strategy using the internal business data; Filter and calculate the external business data of the plurality of management objects in the UnionPay transaction data, and construct an external business strategy using the external business data; The target management object with risky behavior is identified from the plurality of management objects by using the abnormal sample identification rule, the internal business policy and the external business policy.

2. The method according to claim 1, characterized in that The using the bank's transaction data and UnionPay transaction data to obtain abnormal sample identification rules includes: Preprocessing and feature engineering the bank's transaction data and the UnionPay transaction data respectively to generate a plurality of internal derivative variables corresponding to the bank's transaction data and a plurality of external derivative variables corresponding to the UnionPay transaction data; Based on the plurality of internal derived variables and the plurality of external derived variables, screening out internal model input variables and external model input variables; Using the sample data corresponding to the management object and the internal model input variables and the external model input variables, the iForest anomaly detection model is used to preliminarily identify the abnormal management object, and add a label to the sample data, wherein the label is used to indicate whether the sample data is an abnormal sample; Using the labeled sample data to train the decision tree model, and generating a decision tree visualization result; Analyze the decision tree visualization results and generate abnormal sample identification rules.

3. The method according to claim 2, characterized in that The preprocessing and feature engineering of the bank's transaction data and the UnionPay transaction data are performed respectively to generate a plurality of internal derivative variables corresponding to the bank's transaction data and a plurality of external derivative variables corresponding to the UnionPay transaction data, including: Fill in missing values ​​in the transaction data of the Bank according to predefined business logic rules; Based on the multiple original internal variables of the bank's transaction data, multiple internal derived variables are derived using business logic and statistical methods; Based on the multiple original external variables of the UnionPay transaction data, multiple external derived variables are derived using business logic and statistical methods.

4. The method according to claim 1, characterized in that: The step of using the abnormal sample identification rule, the internal business policy, and the external business policy to identify a target management object with risky behavior from among the multiple management objects includes: Using the abnormal sample identification rule, locking at least one first abnormal management object among the plurality of management objects; Using the internal business policy and the external business policy, locking at least one second abnormal management object among the plurality of management objects; The management object present in both the at least one first abnormal management object and the at least one second abnormal management object is identified as a target management object with risky behavior.

5. The method according to claim 1, characterized in that The using the internal business data to construct an internal business strategy includes: Obtaining internal data distribution of each internal business indicator in the internal business data of the plurality of management objects; Determining an internal data screening threshold of the internal business indicator according to the internal data distribution of each of the internal business indicators; An internal business strategy is constructed according to the internal data screening threshold of each of the internal business indicators.

6. The method according to claim 1, characterized in that The using the external business data to construct an external business strategy includes: Obtaining external data distribution of each external business indicator in the external business data of the plurality of management objects; Determining the external data screening threshold of the external business indicator according to the external data distribution of each of the external business indicators; An external business strategy is constructed according to the external data screening threshold of each of the external business indicators.

7. The method according to any one of claims 1 to 6, characterized in that The internal business data includes large-value transfer data, deposit data and order cancellation data, and / or the external business data includes large-value income data, cross-border or securities consumption data, small loan data and nighttime consumption data.

8. A risk identification device for a management object, characterized in that: include: Management object data acquisition unit, abnormal sample identification rule acquisition unit, internal business strategy construction unit, external business strategy construction unit and target management object identification unit, The management object data obtaining unit is used to obtain the bank's transaction data and UnionPay transaction data of multiple management objects; The abnormal sample identification rule obtaining unit is used to obtain abnormal sample identification rules by using the bank's transaction data and the UnionPay transaction data; The internal business strategy building unit is used to screen and calculate the internal business data of the plurality of management objects in the transaction data of the bank, and build the internal business strategy using the internal business data; The external business strategy building unit is used to screen and calculate the external business data of the plurality of management objects in the UnionPay transaction data, and build an external business strategy using the external business data; The target management object identification unit is used to identify the target management object with risky behavior among the multiple management objects by using the abnormal sample identification rule, the internal business policy and the external business policy.

9. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the risk identification method for a management object as described in any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: The electronic device includes at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other via the bus; the processor is used to call program instructions in the memory to execute the risk identification method for management objects as described in any one of claims 1 to 7.

Images