Bank fraud feature mining method and system based on operation behaviors

Abstract

The invention relates to the technical field of financial risk control, and provides a bank fraud feature mining method and system based on operation behaviors, and the method comprises the following steps: collecting credit business related original data; cleaning and verifying the original data to obtain cleaned and verified data; constructing a feature bottom table based on the cleaned and verified data; and based on the feature bottom table, constructing a fraud behavior evaluation model, and obtaining a credit fraud score of the user corresponding to the input operation behavior. According to the method, operation behavior fraud identification is introduced into the risk control credit field, the characteristics of multiple operation behavior fraud risk scenes and diversified fraud means in the credit field are considered, and a reference basis is provided for a practitioner to decide whether to be reliable or not by depending on the fraud risk index of the operation behavior.

Description

Technical Field

[0001] The present application relates to the field of financial risk control technology, and in particular to a method and system for mining bank fraud features based on operational behavior. Background Art

[0002] In the credit business, it generally includes business scenarios such as marketing acquisition, pre-loan credit, loan disbursement, and post-loan collection. Among them, pre-loan credit and loan disbursement are high-risk links for operational behavior information fraud. Based on the basic data of different links, relevant feature variables are derived to train operational behavior information fraud models for pre-loan monitoring.

[0003] Fraud risks are increasingly showing the characteristics of industrial chain. Around the implementation of fraud, a professional technology development industry has been formed, such as counterfeit applications, false transactions, account theft, etc.; identity packaging and false operation behavior information provision industry, such as intermediary agency, cloud mobile phone, etc.; business loophole discovery and fraud method teaching industry, and people engaged in these industries have a high level of technology. They will try various anti-fraud rules of financial institutions, and then use the technology and information provided by the first two industries to commit fraud. This kind of operation behavior information fraud is sometimes not easy to detect, and the use of artificial intelligence algorithms to identify possible loopholes may slip through the net. Mining methods based on basic data and operation behavior can effectively make up for this shortcoming. Summary of the invention

[0004] The present application provides a method and system for mining bank fraud features based on operational behavior, which can solve the technical problem of missed detection in existing artificial intelligence algorithms for identifying fraudulent behavior in credit business.

[0005] In a first aspect, the present application provides a method for mining bank fraud features based on operational behavior, comprising the following steps:

[0006] Collect original data related to credit business;

[0007] Clean and verify the original data and obtain the cleaned and verified data;

[0008] Based on the cleaned and verified data, construct the feature base table;

[0009] Based on the feature base table, a fraud behavior assessment model is constructed to obtain the user's credit fraud score corresponding to the input operation behavior.

[0010] In conjunction with the first aspect, in one implementation, the collecting of original data related to the credit business specifically includes the following steps:

[0011] Define credit risk control application business scenarios;

[0012] Define the fraud characteristics of operational behaviors in different business scenarios;

[0013] According to the fraud features to be derived, the original data of the corresponding business scenarios are extracted respectively.

[0014] In combination with the first aspect, in one implementation, after extracting the original data of the corresponding business scenarios according to the fraud features to be derived, the method further includes the following steps:

[0015] The method of obtaining the original data, such as obtaining through user filling in or authorization;

[0016] Based on the method of obtaining the original data, confirm the logic of generating feature labels.

[0017] In combination with the first aspect, in one implementation, the cleaning and verifying of the original data to obtain the cleaned and verified data specifically includes the following steps:

[0018] Divide the acquired raw data into basic information data and operation behavior information data;

[0019] Clean the two types of original data, which are divided into basic information type and operation behavior information type, to obtain cleaned data;

[0020] Verify the business requirements of the cleaned data and obtain the verified data.

[0021] In combination with the first aspect, in one implementation, constructing a feature base table based on the cleaned and verified data specifically includes the following steps:

[0022] The basic information and operation behavior information in the cleaned and verified data are stored separately, and the association between the two is established through a unique user identifier;

[0023] The basic information class and operation behavior information class data that have been stored separately are used to construct a basic information table and an operation behavior information table respectively, and the association between the two information tables is established through a unique user identifier.

[0024] In combination with the first aspect, in one implementation, the construction of a fraud behavior assessment model based on the feature base table to obtain a credit fraud score of a user corresponding to the input operation behavior specifically includes the following steps:

[0025] Based on the constructed feature base table, a fraud behavior assessment model is constructed using a logistic regression algorithm to output a fraud score to assist manual judgment of fraud risks in different stages of credit based on operational behaviors;

[0026] The constructed fraud assessment model is encapsulated in code to form a standardized tool that can be used in a generalized manner.

[0027] In combination with the first aspect, in one implementation, the constructing a fraud behavior assessment model based on the constructed feature base table using a logistic regression algorithm and outputting a fraud score specifically includes the following steps:

[0028] Constructing grade labels and processing missing values ​​for the input features in the feature base table, and obtaining the input features with grade labels and processed missing values;

[0029] Use the logistic regression algorithm to screen the input features and obtain the effective input features after screening;

[0030] Based on the effective input features after screening, a logistic regression model is constructed;

[0031] Input the credit-related data to be evaluated in the database into the fraud behavior assessment model to obtain the fraud score.

[0032] In combination with the first aspect, in one implementation, the method of using a logistic regression algorithm to screen the input features and obtain the screened effective input features specifically includes the following steps:

[0033] Traverse all input features, build a model with a single input feature and fraud score, use the IV value of a single input feature as the evaluation standard for whether the variable is effective, sort from high to low, and select the input feature with the best model AUC result as the first round of input features;

[0034] On the basis of the first round of selected input features, add the second input feature, and traverse the remaining input features until the model AUC value obtained by the added input feature reaches the highest, and use the input feature as the second round of selected variables;

[0035] Based on the variables selected in the second round, the third input feature is added, and so on, until the added input feature no longer contributes more than expected to the AUC, and no more input features are added.

[0036] In a second aspect, the present application provides a banking fraud feature mining system based on operation behavior, comprising:

[0037] The original data collection module is used to collect original data related to credit business;

[0038] A data cleaning and verification module, which is in communication with the raw data collection module and is used to clean and verify the raw data and obtain the cleaned and verified data;

[0039] A feature base table construction module, which is in communication with the data cleaning and verification module and is used to construct a feature base table based on the cleaned and verified data;

[0040] The fraud score acquisition module is in communication with the feature base table construction module and is used to construct a fraud behavior assessment model based on the feature base table to obtain the credit fraud score of the user corresponding to the input operation behavior.

[0041] In combination with the first aspect, in one implementation, the raw data collection module includes:

[0042] Business scenario definition unit, used to define credit risk control application business scenarios;

[0043] A fraud feature definition unit, which is in communication with the business scenario definition unit and is used to define fraud features of operation behaviors in different business scenarios;

[0044] The original data acquisition unit is in communication with the fraud feature definition unit and is used to extract the original data of the corresponding business scenarios according to the fraud features to be derived.

[0045] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0046] This application introduces operational behavior fraud identification into the field of risk control credit, providing a reference for practitioners on whether the operational behavior fraud risk indicators are reliable when making decisions, taking into account the characteristics of the credit field where there are many operational behavior fraud risk scenarios and diverse fraud methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a flow chart of the bank fraud feature mining method based on operational behavior in this application;

[0048] Figure 2 This is a functional module block diagram of the bank fraud feature mining system based on operational behavior in this application. DETAILED DESCRIPTION

[0049] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0051] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0052] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0053] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0054] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0055] First, please refer to Figure 1 The present application embodiment provides a banking fraud feature mining method based on operation behavior, comprising the following steps:

[0056] Step S1: Collect original data related to credit business;

[0057] Step S2: Clean and verify the original data to obtain the cleaned and verified data;

[0058] Step S3: constructing a feature base table based on the cleaned and verified data;

[0059] Step S4: Based on the feature base table, a fraud behavior assessment model is constructed to obtain the credit fraud score of the user corresponding to the input operation behavior.

[0060] This application introduces operational behavior fraud identification into the field of risk control credit, providing a reference for practitioners on whether the operational behavior fraud risk indicators are reliable when making decisions, taking into account the characteristics of the credit field where there are many operational behavior fraud risk scenarios and diverse fraud methods.

[0061] In one embodiment, the step S1: collecting original data related to credit business, specifically includes the following steps:

[0062] Step S11: defining the credit risk control application business scenarios; specifically, in the credit business, the business scenarios related to the operation behavior where fraudulent behavior may occur include the pre-loan credit business scenario and the mid-loan payment business scenario;

[0063] Step S12: define the fraud characteristics of operation behaviors in different business scenarios; specifically:

[0064] The fraud characteristics in pre-loan credit business scenarios are mainly batch applications after fake applications;

[0065] The fraud characteristics in the loan withdrawal business scenario are mainly fake applications and account theft attacks.

[0066] Step S13: extracting the original data of the corresponding business scenarios according to the fraud features to be derived, such as gender, age, residential address, operation behavior data, etc. in the pre-loan credit business scenario and the mid-loan payment business scenario;

[0067] Based on step S11, step S12 and step S13, a method of collecting basic user information to construct model features is adopted. First, according to the possible operational fraud risks in different risk control scenarios, basic user information that can be legally obtained in different scenarios is collected, so as to construct model features for operational behaviors. Starting from the basic user data, the problems of difficult data acquisition, low data accuracy and single data dimension are avoided.

[0068] Step S14: obtaining the original data by filling in or authorizing the acquisition, for example, if the acquisition is by user authorization, the missing of the label needs to be considered;

[0069] Step S15: Based on the method of obtaining the original data, confirm the logic of generating feature labels; for example, how to classify residential addresses and household registration addresses, the storage location corresponding to the operation behavior information data obtained by the SDK, and how to derive fraud features based on the original operation behavior information data (for example, based on the original operation behavior data, use the GBDT gradient boosting decision tree to rank feature importance).

[0070] Based on step S13 and step S14, the generation logic of the fraud feature based on the operation behavior information class is obtained, which is a training logic for subsequent model training with the operation behavior information class as input and the fraud feature as output.

[0071] In one embodiment, the step S2: cleaning and verifying the original data to obtain the cleaned and verified data specifically includes the following steps:

[0072] Step S21: Divide the acquired original data into basic information data (address-level labels such as gender, age, education, registered address city, current residence address city, operator address city, GPS address city, etc.) and operation behavior information data (operation behavior features acquired based on the SDK authorized by the user, using the isolation forest based on the SDK authorized by the user, and using GBDT to select labels such as the number of clicks on occupation information, the maximum acquisition time of education level, the shortest acquisition time of residence address, the number of times marital status is modified, and the number of times the contact 2 number is copied and pasted);

[0073] Step S22: clean the two types of original data, namely, the basic information type and the operation behavior information type, to keep the format of a single variable uniform, ensure that the variable logic conforms to the business definition, and obtain the cleaned data;

[0074] Step S23: Verify the business requirements of the cleaned data, specifically, confirm whether the source and generation logic of the original data meet the business requirements.

[0075] Based on step S21, step S22 and step S23, cleaned and verified data is provided for subsequent model training.

[0076] In one embodiment, the step S3: constructing a feature base table based on the cleaned and verified data specifically includes the following steps:

[0077] Step S31: The basic information data (such as residential address and registered address, gender, age, education, registered address city, current residential address city, operator address city, GPS address city and other geological level labels) and operation behavior information data (such as the number of clicks on operation behavior occupation information, the maximum acquisition time of education level, the shortest acquisition time of residential address, the number of marital status modifications, the number of copy and paste times of contact 2 number, the length of stay on the login registration page, the time of entering the information page, the time of leaving the information page, the number of clicks on the detailed address positioning icon, etc.) in the cleaned and verified data are classified and stored by labels, and the association between the two is established through a unique user identifier to ensure that all relevant information of a user can be fully acquired and analyzed;

[0078] Step S32: Construct a feature base table based on the cleaned and verified data, set the data update method, and maintain data consistency; specifically, construct a basic information table and an operation behavior information table for the basic information type and operation behavior information type data that have been stored separately, and establish an association between the two information tables through a unique user identifier to ensure that all relevant information for a user's credit assessment can be fully acquired and analyzed.

[0079] In one embodiment, the step S4: constructing a fraud behavior assessment model based on the feature base table to obtain a credit fraud score of a user corresponding to the input operation behavior specifically includes the following steps:

[0080] Step S41: construct a fraud behavior assessment model based on the constructed feature base table using a logistic regression algorithm, output a fraud score, and assist in manually determining the fraud risk in different credit links based on operational behavior;

[0081] Step S42: Encapsulate the constructed fraud assessment model into code to form a standardized tool that can be used in a generalized manner, so that it can be directly called by production to make timely anti-fraud responses and disposal in the pre-loan and mid-loan stages.

[0082] This application finally encapsulates the calculation process of the above-mentioned model experiment into a standardized function. The user only needs to input the user's credit-related information, such as gender, age, residential address, household registration address, operation behavior characteristics, etc., and the corresponding fraud score can be automatically calculated, which has strong reusability.

[0083] In one embodiment, step S41: constructing a fraud behavior assessment model based on the constructed feature base table using a logistic regression algorithm and outputting a fraud score, specifically includes the following steps:

[0084] Step S411: constructing level labels and processing missing values ​​for the input features in the feature base table, and obtaining the input features with level labels and missing value processing;

[0085] Step S412: using a logistic regression algorithm to screen the input features and obtain the screened valid input features;

[0086] Step S413: constructing a logistic regression model based on the screened effective input features;

[0087] Step S414: Input the credit-related data to be evaluated in the database into the fraud behavior evaluation model to obtain the fraud score.

[0088] In one embodiment, the step S411: constructing a level label and processing missing values ​​for the input features to obtain the input features with the level label and the processed missing values, specifically includes the following steps:

[0089] Based on the basic information filled in by the user, such as gender, age, education level, and various types of addresses, hierarchical labels are constructed, such as age stratification, education level, address city level, etc.;

[0090] Based on the constructed feature base table, the pre-selected model input features are processed for missing values ​​by deletion or median filling to obtain the model input features with level labels and missing value processing.

[0091] In one embodiment, the step S412: using a logistic regression algorithm to screen the input features and obtain the screened valid input features specifically includes the following steps:

[0092] Traverse all input features, build a model with a single input feature and fraud score, use the IV value of a single input feature as the evaluation standard for whether the variable is effective, sort from high to low, and select the input feature with the best model AUC (Area Under the Curve) result as the first round of input feature selection.

[0093] Based on the first round of selected input features, add the second input feature, and traverse the remaining input features. The input feature that can make the model AUC value reach the highest is used as the second round of selected variables.

[0094] Based on the second round, the third variable is added and so on, until the variable no longer makes a significant contribution to the AUC, then no more variables are added.

[0095] In one embodiment, the step S413: constructing a logistic regression model based on the screened effective input features specifically includes the following steps:

[0096] Based on the selected effective variables such as gender, operation behavior compilation kernel version, operation behavior screen brightness, and operation behavior standby time, the overall AUC of the model is calculated, and the selected variables are used to construct a LOGIT model, and the classification effect of the model is evaluated with 0.6 as the cutoff point;

[0097] The AUC and LIFT (lift) of the final model are used to evaluate whether the model effect meets the standard. If it does not meet the standard, manual single variable screening is performed from the perspective of IV and consistency. Finally, a LOGIT (Logistic Regression) model that meets business needs is trained, that is, an operational behavior fraud model.

[0098] Confirm the underlying data processing and storage management methods of the model, and rely on the database on the server to achieve real-time scoring derivation;

[0099] The fraud score output by the model is configured in the decision engine. In the pre-loan stage, manual judgment is made on whether there is intermediary risk based on the fraud score combined with the application time period and frequency. In the mid-loan stage, manual judgment is made on whether there is a group application in batches based on the fraud score combined with changes in operational behavior information and related situations, and the mid-loan risk is assessed.

[0100] Second, please refer to Figure 2 The embodiment of the present application provides a banking fraud feature mining system based on operation behavior, including an original data collection module 100, a data cleaning and verification module 200, a feature base table construction module 300 and a fraud score acquisition module 400. The original data collection module 100 is used to collect original data related to credit business; the data cleaning and verification module 200 is communicated with the original data collection module 100, and is used to clean and verify the original data to obtain the cleaned and verified data; the feature base table construction module 300 is communicated with the data cleaning and verification module 200, and is used to construct a feature base table based on the cleaned and verified data; the fraud score acquisition module 400 is communicated with the feature base table construction module 300, and is used to construct a fraud behavior assessment model based on the feature base table to obtain the credit fraud score of the user corresponding to the input operation behavior.

[0101] In one embodiment, the raw data collection module includes:

[0102] Business scenario definition unit, used to define credit risk control application business scenarios;

[0103] A fraud feature definition unit, which is in communication with the business scenario definition unit and is used to define fraud features of operation behaviors in different business scenarios;

[0104] The original data acquisition unit is in communication connection with the fraud feature definition unit, and is used to extract the original data of the corresponding business scenarios according to the fraud features to be derived. The functional implementation of each module in the above-mentioned bank fraud feature mining system based on operation behavior corresponds to each step in the above-mentioned bank fraud feature mining method embodiment based on operation behavior, and its functions and implementation processes are not repeated here one by one.

[0105] On the third aspect, an embodiment of the present application provides a banking fraud feature mining device based on operational behavior. The banking fraud feature mining device based on operational behavior can be a personal computer (PC), a laptop computer, a server, or other device with data processing capabilities.

[0106] The communication interface includes an input / output (I / O) interface, a physical interface, and a logical interface, etc., which are used to interconnect the devices inside the bank fraud feature mining device based on operation behavior, and an interface used to interconnect the bank fraud feature mining device based on operation behavior with other devices (such as other computing devices or user devices). The physical interface can be an Ethernet interface, an optical fiber interface, an ATM interface, etc.; the user device can be a display, a keyboard, etc.

[0107] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0108] The processor may be a general-purpose processor, which may call the bank fraud feature mining program based on operation behavior stored in the memory and execute the bank fraud feature mining method based on operation behavior provided in the embodiment of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The method executed when the bank fraud feature mining program based on operation behavior is called may refer to the various embodiments of the bank fraud feature mining method based on operation behavior of the present application, which will not be described in detail here.

[0109] In a fourth aspect, an embodiment of the present application also provides a readable storage medium.

[0110] The readable storage medium of the present application stores a bank fraud feature mining program based on operational behavior, wherein when the bank fraud feature mining program based on operational behavior is executed by a processor, the steps of the bank fraud feature mining method based on operational behavior as described above are implemented.

[0111] Among them, the method implemented when the bank fraud feature mining program based on operational behavior is executed can refer to the various embodiments of the bank fraud feature mining method based on operational behavior of this application, and will not be repeated here.

[0112] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0113] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0114] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A banking fraud feature mining method based on operational behavior, characterized in that: The following steps are involved: Collect original data related to credit business; Clean and verify the original data and obtain the cleaned and verified data; Based on the cleaned and verified data, construct the feature base table; Based on the feature base table, a fraud behavior assessment model is constructed to obtain the user's credit fraud score corresponding to the input operation behavior.

2. The banking fraud feature mining method based on operation behavior as claimed in claim 1, characterized in that: The collection of original data related to the credit business specifically includes the following steps: Define credit risk control application business scenarios; Define fraud characteristics of operational behaviors in different business scenarios; According to the fraud features to be derived, the original data of the corresponding business scenarios are extracted respectively.

3. The banking fraud feature mining method based on operation behavior as claimed in claim 2, characterized in that: After extracting the original data of the corresponding business scenarios according to the fraud features to be derived, the following steps are also included: The method of obtaining the original data, such as obtaining through user filling in or authorization; Based on the method of obtaining the original data, confirm the logic of generating feature labels.

4. The banking fraud feature mining method based on operation behavior as claimed in claim 1, characterized in that: The cleaning and verification of the original data to obtain the cleaned and verified data specifically includes the following steps: Divide the acquired raw data into basic information data and operation behavior information data; Clean the two types of original data, which are divided into basic information type and operation behavior information type, to obtain cleaned data; Verify the business requirements of the cleaned data and obtain the verified data.

5. The method for mining bank fraud features based on operational behavior as claimed in claim 1, characterized in that: The feature base table is constructed based on the cleaned and verified data, specifically comprising the following steps: The basic information and operation behavior information in the cleaned and verified data are stored separately, and the association between the two is established through a unique user identifier; The basic information class and operation behavior information class data that have been stored separately are used to construct a basic information table and an operation behavior information table respectively, and the association between the two information tables is established through a unique user identifier.

6. The method for mining bank fraud features based on operational behavior as claimed in claim 1, characterized in that: The method of constructing a fraud behavior assessment model based on the feature base table and obtaining a credit fraud score of a user corresponding to the input operation behavior specifically includes the following steps: Based on the constructed feature base table, a fraud behavior assessment model is constructed using a logistic regression algorithm to output a fraud score to assist manual judgment of fraud risks in different stages of credit based on operational behaviors; The constructed fraud assessment model is encapsulated in code to form a standardized tool that can be used in a generalized manner.

7. The method for mining bank fraud features based on operational behavior as claimed in claim 6, characterized in that: The fraud behavior assessment model is constructed based on the constructed feature base table using a logistic regression algorithm to output a fraud score, specifically including the following steps: Constructing grade labels and processing missing values ​​for the input features in the feature base table, and obtaining the input features with grade labels and processed missing values; Use the logistic regression algorithm to screen the input features and obtain the effective input features after screening; Based on the effective input features after screening, a logistic regression model is constructed; Input the credit-related data to be evaluated in the database into the fraud behavior assessment model to obtain the fraud score.

8. The method for mining bank fraud features based on operational behavior as claimed in claim 7, characterized in that: The method of using a logistic regression algorithm to screen the input features and obtain the screened effective input features specifically includes the following steps: Traverse all input features, build a model with a single input feature and fraud score, use the IV value of a single input feature as the evaluation standard for whether the variable is effective, sort from high to low, and select the input feature with the best model AUC result as the first round of input features; On the basis of the first round of selected input features, add the second input feature, and traverse the remaining input features until the model AUC value obtained by the added input feature reaches the highest, and use the input feature as the second round of selected variables; Based on the variables selected in the second round, the third input feature is added, and so on, until the added input feature no longer contributes more than expected to the AUC, and no more input features are added.

9. A banking fraud feature mining system based on operational behavior, characterized in that: include: The original data collection module is used to collect original data related to credit business; A data cleaning and verification module, which is in communication with the raw data collection module and is used to clean and verify the raw data and obtain the cleaned and verified data; A feature base table construction module, which is in communication with the data cleaning and verification module and is used to construct a feature base table based on the cleaned and verified data; The fraud score acquisition module is in communication with the feature base table construction module and is used to construct a fraud behavior assessment model based on the feature base table to obtain the credit fraud score of the user corresponding to the input operation behavior.

10. The banking fraud feature mining system based on operation behavior as claimed in claim 9, characterized in that: The raw data collection module comprises: Business scenario definition unit, used to define credit risk control application business scenarios; A fraud feature definition unit, which is in communication with the business scenario definition unit and is used to define fraud features of operation behaviors in different business scenarios; The original data acquisition unit is in communication with the fraud feature definition unit and is used to extract the original data of the corresponding business scenarios according to the fraud features to be derived.

Images