Transaction data processing method and device, equipment and medium

Abstract

The invention provides a transaction data processing method and device, equipment and a medium, and the method comprises the steps: inputting a node relation topological graph into a node sub-model when the node relation topological graph is constructed based on a transaction business scene associated with transaction behavior data, and outputting an abnormal behavior classification group to which a target business object belongs by the node sub-model; inputting associated text information associated with the transaction behavior data into a text sub-model, and determining a text classification group to which the target business object belongs by the text sub-model; when a data processing result of the transaction index data is obtained, inputting the data processing result, the abnormal behavior classification group and the text classification group into a business main model, and determining the confidence of a target abnormal behavior type of the target business object belonging to the abnormal behavior classification group by the business main model; and determining a risk level of the target business object based on the confidence of the target abnormal behavior type. According to the invention, the accuracy of risk level determination can be improved in the field of financial payment.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a transaction data processing method, device, equipment and medium in the field of financial payment. Background Art

[0002] Currently, in the field of financial payments, a scoring card model for risk assessment can be constructed based on expert experience. For example, the scoring card model here can output a risk score for assessing the risk level of user A based on the transaction information of a business object (e.g., user A) (e.g., transaction indicators such as transaction amount and number of transactions) and the object data information of the business object itself (e.g., personal indicators such as age, education level, and debt mortgage status).

[0003] However, the inventors have found in practice that for the scorecard model currently used to assess risk levels, it is necessary to set the above different types of indicators (e.g., personal indicators and transaction indicators, etc.) in advance according to expert experience, and manually set corresponding weights and scores for these indicators, so that in actual application, the weights and scores of the various indicators of user A determined by the scorecard model can be quickly weighted and summed to output a risk score for assessing the risk level of user A. Since expert experience has certain subjective limitations, when using the scorecard model constructed based on the expert experience to identify risks, the risk level of user A cannot be effectively and accurately identified, thereby reducing the accuracy of risk level determination. Summary of the invention

[0004] The embodiments of the present application provide a transaction data processing method, apparatus, device and medium, which can provide a new risk identification mechanism, through which the accuracy of risk level determination can be improved.

[0005] On the one hand, an embodiment of the present application provides a transaction data processing method, the method comprising:

[0006] When the transaction behavior data of the target business object is obtained, the transaction business scenario associated with the transaction behavior data is determined, and a node relationship topology diagram associated with the target business object is constructed based on the transaction business scenario; the node relationship topology diagram includes N business nodes, and one business node is determined by one transaction business scenario; N is a positive integer greater than 1;

[0007] When a target training model for predicting the object classification type of a target business object is obtained, the node relationship topology diagram is input into the node sub-model of the target training model, the node sub-model determines the node mapping vector of each business node in N business nodes, and based on the node mapping vector of each business node, outputs the abnormal behavior classification group to which the target business object belongs;

[0008] When the associated text information associated with the transaction behavior data is obtained, the associated text information is input into the text sub-model of the target training model, the text sub-model determines the text mapping vector of the text segmentation in the associated text information, and determines the text classification group to which the target business object belongs based on the text mapping vector;

[0009] When the data processing result of the transaction indicator data associated with the transaction behavior data is obtained, the data processing result, the abnormal behavior classification group and the text classification group are input into the business main model of the target training model, and the business main model determines the confidence that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group. When the abnormal behavior type corresponding to the maximum confidence in the confidence is determined as the target abnormal behavior type, the business main model outputs the confidence of the target abnormal behavior type;

[0010] Based on the confidence level of the target abnormal behavior type, a risk level when the object classification type of the target business object is the target abnormal behavior type is determined.

[0011] On the one hand, an embodiment of the present application provides a transaction data processing device, the device comprising:

[0012] A topology map construction module is used to determine the transaction business scenario associated with the transaction behavior data when the transaction behavior data of the target business object is obtained, and to construct a node relationship topology map associated with the target business object based on the transaction business scenario; the node relationship topology map includes N business nodes, and one business node is determined by one transaction business scenario; N is a positive integer greater than 1;

[0013] A behavior group determination module is used to input the node relationship topology diagram into the node sub-model of the target training model when the target training model for predicting the object classification type of the target business object is obtained, determine the node mapping vector of each business node in the N business nodes by the node sub-model, and output the abnormal behavior classification group to which the target business object belongs based on the node mapping vector of each business node;

[0014] A text group determination module is used to input the associated text information associated with the transaction behavior data into the text sub-model of the target training model when the associated text information is obtained, and the text sub-model determines the text mapping vector of the text segmentation in the associated text information, and determines the text classification group to which the target business object belongs based on the text mapping vector;

[0015] A confidence output module is used to, when obtaining the data processing result of the transaction indicator data associated with the transaction behavior data, input the data processing result, the abnormal behavior classification group and the text classification group into the business main model of the target training model, and the business main model determines the confidence that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group, and when the abnormal behavior type corresponding to the maximum confidence in the confidence is determined as the target abnormal behavior type, the business main model outputs the confidence of the target abnormal behavior type;

[0016] The risk level determination module is used to determine the risk level of the target business object when the object classification type is the target abnormal behavior type based on the confidence level of the target abnormal behavior type.

[0017] The topology map building module includes:

[0018] A data determination unit is used to obtain business transactions that have been executed by the target business object within the target business time period from the distributed data storage system, determine a behavior data set of the target business object within the target business time period based on transaction details information of the business transactions, and use the behavior data in the behavior data set as transaction behavior data of the target business object;

[0019] A data analysis unit, configured to analyze the transaction behavior data, determine a business interaction object having a data interaction relationship with a target business object, and determine N transaction business scenarios of the target business object within a target business time period based on the data interaction relationship between the target business object and the business interaction object;

[0020] A connection relationship determination unit, used to construct N business nodes associated with the target business object based on N transaction business scenarios, and determine the node connection relationship between the N business nodes based on the scenario association between the N transaction business scenarios; one business scenario is used to construct one business node;

[0021] The topology map construction unit is used to construct a node relationship topology map associated with a target business object based on N business nodes and node connection relationships.

[0022] Among them, the N business transaction scenarios include a first transaction scenario and a second transaction scenario; the first transaction scenario is different from the second transaction scenario; the data interaction relationship between the target business object and the business interaction object is determined by the first interaction parameter information and the second interaction parameter information obtained from the transaction behavior data; the first interaction parameter information is determined by the first business transaction between the target business object and the business interaction object in the first transaction scenario; the second interaction parameter information is determined by the second business transaction between the target business object and the business interaction object in the second transaction scenario; the first business transaction and the second business transaction are both transactions in the business transaction;

[0023] A connection relationship determination unit, specifically configured to obtain a first transaction scenario and a second transaction scenario from N business transaction scenarios, and use a business node constructed for the first transaction business scenario as the first business node, and use a business node constructed for the second transaction business scenario as the second business node;

[0024] The connection relationship determination unit is further specifically used to obtain the transaction transfer quantity of the first business transaction from the first interaction parameter information, and obtain the transaction transfer quantity of the second business transaction from the second interaction parameter information, and accumulate the transaction transfer quantity of the first business transaction and the transaction transfer quantity of the second business transaction to obtain the accumulated transaction quantity between the target business object and the business interaction object;

[0025] The connection relationship determination unit is further specifically configured to use the accumulated transaction resource quantity between the target business object and the business interaction object as the edge weight coefficient between the first business node and the second business node when determining the edge connection relationship between the first business node and the second business node based on the data interaction relationship between the target business object and the business interaction object;

[0026] The connection relationship determination unit is further specifically configured to use the edge connection relationship between the first service node and the second service node and the edge weight coefficient between the first service node and the second service node as the node connection relationship between the first service node and the second service node.

[0027] The behavior group determination module includes:

[0028] A target model acquisition unit, used to acquire a target training model for predicting an object classification type of a target business object;

[0029] A service node extraction unit, used for inputting the node relationship topology graph into the node sub-model of the target training model, and when N service nodes are extracted from the node relationship topology graph by the node sub-model, determining a node access sequence associated with service node i among the N service nodes; i is a positive integer less than or equal to N;

[0030] A node mapping vector determining unit, used to perform node vector mapping on a node access sequence associated with a service node i to obtain a node mapping vector of the service node i;

[0031] The classification group output unit is used to output the abnormal behavior classification group to which the target business object belongs based on the node mapping vector of the business node i.

[0032] The service node extraction unit is specifically used to input the node relationship topology map into the node sub-model of the target training model, and the node sub-model extracts N service nodes from the node relationship topology map;

[0033] The service node extraction unit is further specifically used to obtain a node access policy in the node sub-model, obtain a service node i from N service nodes based on the node access policy, and obtain one or more access sequences associated with the service node i based on the node access parameters in the node access policy;

[0034] The service node extraction unit is further specifically used to filter, from one or more access sequences associated with service node i, an access sequence whose sequence length reaches a sequence length threshold indicated by a node access policy, and use the filtered access sequence as a node access sequence associated with service node i among N service nodes.

[0035] The classification group output unit is specifically used to determine the vector distance between the node mapping vector of the service node i and the multiple sample mapping vectors in the node sub-model, and determine the vector similarity between the node mapping vector of the service node i and the multiple sample mapping vectors based on the determined vector distance;

[0036] The classification group output unit is further specifically used to use the sample mapping vector with the maximum vector similarity as the target sample mapping vector in the vector similarity, determine the sample abnormal behavior label information associated with the sample node corresponding to the target sample mapping vector, determine the abnormal behavior type of the target business object when it is at the business node i based on the sample abnormal behavior label information, and determine the sample abnormal group to which the sample abnormal behavior label information belongs as the behavior type group of the abnormal behavior type when the target business object is at the business node i;

[0037] The classification group output unit is further specifically used to determine the abnormal behavior classification group to which the target business object belongs based on the behavior type grouping of the abnormal behavior type when the target business object is at the business node i.

[0038] Wherein, optionally, the node sub-model includes M sample abnormality groups; M is a positive integer greater than or equal to 2; one sample abnormality group corresponds to one group center vector; one group center vector is obtained after clustering the sample mapping vector corresponding to the sample behavior type in one sample abnormality group;

[0039] The classification group output unit is specifically used to obtain a sample abnormal group j from the M sample abnormal groups as a first sample abnormal group; j is a positive integer less than M;

[0040] The classification group output unit is further specifically used to determine a first vector similarity between a node mapping vector of a service node i and a group center vector of a first sample abnormal group;

[0041] The classification group output unit is further specifically used to, if the first vector similarity reaches a vector similarity threshold, use the first sample abnormal group as a behavior type group of the abnormal behavior type when the target business object is at the business node i;

[0042] The classification group output unit is further specifically configured to determine the abnormal behavior classification group to which the target business object belongs based on the behavior type grouping of the abnormal behavior type when the target business object is at the business node i.

[0043] Wherein, optionally, the M sample abnormal groupings include a sample abnormal grouping k; k=j+1; k is a positive integer greater than j and less than or equal to M;

[0044] The classification group output unit is further specifically used to use the sample abnormal group k as the second sample abnormal group if the first vector similarity does not reach the vector similarity threshold; the second sample abnormal group is the next sample abnormal group of the first sample abnormal group;

[0045] The classification group output unit is further specifically used to determine the second vector similarity between the node mapping vector of the service node i and the group center vector of the second sample abnormal group;

[0046] The classification group output unit is further specifically configured to, if the second vector similarity reaches a vector similarity threshold, use the second sample abnormal group as a behavior type group of an abnormal behavior type when the target business object is at the business node i.

[0047] Among them, it is characterized in that the transaction behavior data is determined based on the business transactions that have been executed by the target business object within the target business time period obtained from the distributed data storage system;

[0048] The text grouping determination module includes:

[0049] A text information acquisition unit, used to acquire text information entered by a target business object when executing a business transaction within a target business time period from a distributed data storage system, and use the acquired text information as associated text information associated with the transaction behavior data;

[0050] A word segmentation processing unit is used to input the associated text information into the text sub-model of the target training model, and the text sub-model performs word segmentation processing on the associated text information to obtain text segmentation of the associated text information; the text segmentation includes L segmentations; L is a positive integer;

[0051] A word vector mapping unit is used to select a word from the L word segmentations as a key text word segmentation, perform word vector mapping on the key text word segmentation, and obtain a word segmentation mapping vector of the key text word segmentation, until each word in the L word segmentation is used as a key text word segmentation, and obtain a word segmentation mapping vector for each word segmentation;

[0052] The text mapping vector determining unit is used to determine the text mapping vector of the text word in the associated text information based on the word mapping vector of each word, and determine the text classification group to which the target business object belongs based on the text mapping vector.

[0053] The text mapping vector determination unit is specifically used to select a word from the L words as a key text word, and use each word in the L words as an associated text word;

[0054] The text mapping vector determination unit is further specifically used to perform vector multiplication processing on the word segmentation mapping vector of the key text word segmentation and the word segmentation mapping vector of the associated text word segmentation to obtain a vector multiplication result for indicating the word segmentation relevance between the key text word segmentation and the associated text word segmentation;

[0055] The text mapping vector determination unit is further specifically used to perform weighted summation processing on the word segmentation mapping vector of each word segmentation based on the word segmentation relevance indicated by the vector multiplication result to obtain the mapping update vector of the key text word segmentation;

[0056] The text mapping vector determination unit is also specifically used to obtain a mapping update vector for each segmentation when each of the L segmentations is used as a key text segmentation, and to use the mapping update vector for each segmentation as the text mapping vector for the text segmentation in the associated text information.

[0057] The transaction behavior data is determined based on the business transactions that have been executed by the target business object within the target business time period obtained from the distributed data storage system; the transaction details information of the business transaction includes the target interaction parameter information associated with the target business object;

[0058] Confidence output module, including:

[0059] an indicator data determination unit, configured to use the transaction transfer quantity obtained from the target transaction parameter information as the transaction indicator data of the target business object within the target business time period, perform transaction accumulation processing on the transaction indicator data of the target business object within the target business time period, obtain the transaction accumulation data associated with the target business object, and use the transaction accumulation data as the data processing result of the transaction data associated with the transaction behavior data;

[0060] A model input variable determination unit is used to use the data processing results, the abnormal behavior classification group and the text classification group as model input variables of the business main model in the target training model, and determine the gradient parameters of the model input variables through the business main model;

[0061] The key variable sampling unit is used to sample the key variables for feature binding from the model input variables based on the gradient parameters of the model input variables and the variable sampling strategy in the business main model; the number of key variables is less than the number of model input variables;

[0062] The feature binding unit is used to perform feature conversion on key variables to obtain variable conversion features of the key variables, perform feature binding on the variable conversion features to obtain binding features of the key variables, and based on the binding features, output the confidence level of determining that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group.

[0063] The variable sampling strategy in the business main model includes a gradient parameter threshold for variable selection, and a first variable extraction parameter and a second variable extraction parameter for maintaining the variable sampling ratio;

[0064] A key variable sampling unit is specifically used to select a model input variable whose gradient parameter reaches a gradient parameter threshold from the model input variables, and use the selected model input variable whose gradient parameter reaches the gradient parameter threshold as the first target input variable;

[0065] The key variable sampling unit is further specifically used to sample the first target input variable matching the first variable extraction parameter from the first target input variable, and use the sampled first target input variable matching the first variable extraction parameter as the first key variable;

[0066] The key variable sampling unit is further specifically used to use the model input variables except the first target input variables in the model input variables as the second target input variables, and sample the second target input variables matching the second variable extraction parameters from the second target input variables, and use the sampled second target input variables matching the second variable extraction parameters as the second key variable;

[0067] The key variable sampling unit is further specifically used to use the first key variable and the second key variable as key variables for feature binding.

[0068] Among them, the risk level determination module includes:

[0069] A fitting parameter acquisition unit, used to acquire conversion fitting parameters for performing confidence conversion, and based on the conversion fitting parameters and the confidence of the target abnormal behavior type, obtain an assessment impact for performing risk assessment on the target abnormal behavior type;

[0070] The impact level determination unit is used to use the impact level to which the assessed impact degree belongs as the risk level when the object classification type of the target business object is the target abnormal behavior type.

[0071] Optionally, the device further comprises:

[0072] The sample behavior data acquisition module is used to determine the sample business scenario associated with the sample behavior data when the sample behavior data of the sample business object is acquired, and to construct a sample relationship topology map associated with the sample business object based on the sample business scenario; the sample relationship topology map includes N sample nodes, and one sample node is determined by one sample business scenario; N is a positive integer greater than 1;

[0073] An initial model acquisition module is used to, when the initial training model to be trained is acquired, use the node sub-model in the initial training model as the initial node sub-model, and construct a sample abnormality group associated with the sample business object for training the initial node sub-model based on the sample abnormal behavior label information associated with the sample business object;

[0074] A behavior group prediction module is used to input the sample relationship topology map into the initial node sub-model, determine the sample mapping vector of each sample node in N sample nodes by the initial node sub-model, and predict the predicted behavior classification group to which the target business object belongs based on the sample mapping vector of each sample node;

[0075] The node sub-model training module is used to perform sub-model training on the initial node sub-model based on the predicted behavior classification group and the sample anomaly group, and use the initial node sub-model after sub-model training as the target node sub-model.

[0076] Optionally, the device further comprises:

[0077] A text sub-model determination module, used for taking the text sub-model in the initial training model as the initial text sub-model;

[0078] A sample group determination module is used to determine the text label information of the sample text information as the sample text label information associated with the sample business object when the sample text information associated with the sample behavior data is obtained, and to construct a sample text group for training the initial text sub-model based on the sample text label information;

[0079] A text grouping prediction module is used to input sample text information into an initial text sub-model, determine a sample text mapping vector of a text word in the sample text information by the initial text sub-model, and predict a predicted text classification group to which the sample business object belongs based on the sample text mapping vector;

[0080] The text sub-model training module is used to perform sub-model training on the initial text sub-model based on the predicted text classification group and the sample text classification group, and use the initial text sub-model after sub-model training as the target text sub-model.

[0081] Optionally, the device further comprises:

[0082] A business main model determination module is used to use the sample abnormal behavior label information in the sample abnormal group in the target node sub-model as the sample abnormal behavior type label of the sample abnormal behavior type associated with the sample business object when the business main model in the initial training model is used as the initial business main model;

[0083] A sample variable determination module, used to use the predicted behavior classification group predicted and output by the target node sub-model for the sample business object as the first sample input variable for training the initial business main model, and to use the predicted text classification group predicted and output by the target text sub-model for the sample business object as the second sample input variable for training the initial business main model;

[0084] The sample variable determination module is further used to, when a sample processing result of the sample indicator data associated with the sample behavior data is obtained, use the sample behavior processing result as a third sample input variable for training the initial business main model;

[0085] The sample variable determination module is further used to input the first sample input variable, the second sample input variable and the third sample input variable into the initial business main model, and the initial business main model determines the confidence that the sample business object belongs to the predicted abnormal behavior type in the predicted behavior classification group, and when the predicted abnormal behavior type corresponding to the maximum confidence in the confidence is determined as the target predicted abnormal behavior type, the initial business main model outputs the predicted abnormal behavior type label corresponding to the target predicted abnormal behavior type;

[0086] A business main model training module is used to train the initial business main model based on the predicted abnormal behavior type label and the sample abnormal behavior type label, and use the initial business main model after the main model training as the target business main model;

[0087] The target model determination module is used to use the target node sub-model as the node sub-model of the target training model, the target text sub-model as the text sub-model of the target training model, and the target business main model as the business main model of the target training model, and construct the target training model based on the node sub-model of the target training model, the text sub-model of the target training model and the business main model of the target training model.

[0088] On one hand, an embodiment of the present application provides a computer device, including a memory and a processor, wherein the memory is connected to the processor, the memory is used to store a computer program, and the processor is used to call the computer program so that the computer device executes the method provided in the above aspect of the embodiment of the present application.

[0089] On one hand, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. The computer program is suitable for being loaded and executed by a processor, so that a computer device with a processor executes the method provided in the above aspect of the embodiment of the present application.

[0090] According to one aspect of the present application, a computer program product or computer program is provided, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the method provided in the above aspect.

[0091] The embodiment of the present application provides a new risk identification mechanism (which can also be referred to as a new risk level assessment mechanism), which relies on the currently trained target training model. The target training model here mainly includes a node sub-model, a text sub-model and a business main model. Among them, it can be understood that when the computer device involved in the embodiment of the present application obtains the transaction behavior data of a certain user (i.e., the target business object, for example, user U0), it can determine the transaction business scenario associated with the transaction behavior data, so that a node relationship topology map associated with the target business object (for example, user U0) can be constructed based on the transaction business scenario; the node relationship topology map here can specifically include N business nodes, and one business node is determined by one transaction business scenario; N is a positive integer greater than 1; further, when the computer device obtains the target training model for predicting the object classification type of the target business object, the node relationship topology map can be input into the node sub-model of the target training model, and then the node sub-model can determine the node mapping vector of each business node in the N business nodes, and based on the node mapping vector of each business node, the abnormal behavior classification group to which the target business object (for example, user U0) belongs can be output; further, when the computer device obtains the transaction behavior data associated with the target business object, the node relationship topology map can be input into the node sub-model of the target training model, and then the node sub-model can be used to determine the node mapping vector of each business node, and based on the node mapping vector of each business node, the abnormal behavior classification group to which the target business object (for example, user U0) belongs can be output; further, when the computer device obtains the transaction behavior data associated with the target business object, the node relationship topology map can be input into the node sub-model of the target training model, and then the node mapping vector of each business node can be determined by the node sub-model, and ... When associating text information (for example, transaction note information), the associated text information (for example, transaction note information) is input into the text sub-model of the target training model, and then the text sub-model can determine the text mapping vector of the text segmentation in the associated text information, and determine the text classification group to which the target business object belongs based on the text mapping vector; further, when the computer device obtains the data processing result of the transaction indicator data associated with the transaction behavior data, the data processing result, the abnormal behavior classification group and the text classification group are input into the business main model of the target training model, and then the business main model can determine the confidence that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group. In this way, when the computer device determines the abnormal behavior type corresponding to the maximum confidence in the confidence as the target abnormal behavior type, the business main model outputs the confidence of the target abnormal behavior type; further, the computer device can determine the risk level when the object classification type of the target business object is the target abnormal behavior type based on the confidence of the target abnormal behavior type.It can be seen that the embodiment of the present application can make full use of the transaction behavior data of the above-mentioned user U0 (i.e., the target business object) within a period of time in the model application stage of the currently trained target training model to determine the transaction business scenarios of the user U0 during this period of time, and then construct a node relationship topology map of the user based on the determined transaction business scenarios, so that the node relationship topology map can be given to the node sub-model in the currently trained target training model to determine the node mapping vectors of these business nodes in the node relationship topology map, and then, the node sub-model can roughly classify and output the abnormal behavior group (i.e., the aforementioned abnormal behavior classification group) to which the user belongs based on the determined node mapping vector, which means that at this time, the abnormal behavior group (i.e., the aforementioned abnormal behavior classification group) is the behavior classification result of the node sub-model. In addition, to ensure the accuracy of risk level determination, the present application can also combine the indicator calculation results (i.e., the aforementioned data processing results) calculated based on the transaction indicator data, and the text classification results (i.e., the aforementioned text classification groups) and other multi-party input information obtained by the rough classification of the node sub-model, to accurately classify the probability (i.e., confidence) of each abnormal sub-classification (i.e., each abnormal behavior type) of the user U0 in the current abnormal behavior classification group, and then the abnormal sub-classification with the maximum probability can be used as the target sub-classification (i.e., the target abnormal behavior type), so that the probability of the target sub-classification (i.e., the target abnormal behavior type) output by the target training model can be used to finally determine the risk level when the object classification type of the user U0 is the target sub-classification (i.e., the target abnormal behavior type). In other words, by adopting the embodiment of the present application, the problem of subjective limitations caused by the current reliance on expert experience can be solved from the root, so that the accuracy of risk level determination can be improved by inputting the multi-party input information of the business main model in the process of determining the risk level. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0093] Figure 1 It is an architecture diagram of a transaction data processing system provided by an embodiment of the present application;

[0094] Figure 2 It is a scene interaction diagram for data interaction provided in an embodiment of the present application;

[0095] Figure 3 is a method flow chart of a transaction data processing method provided by an embodiment of the present application;

[0096] Figure 4 It is a schematic diagram of a scenario for constructing a node relationship topology diagram provided by an embodiment of the present application;

[0097] Figure 5 It is a scene schematic diagram of a node sub-model provided in an embodiment of the present application;

[0098] Figure 6 This is a schematic diagram of a scenario in which a text classification group is output through a text sub-model provided in an embodiment of the present application;

[0099] Figure 7 It is a schematic diagram of a scenario in which the confidence level of a target abnormal behavior type is output through a business main model provided by an embodiment of the present application;

[0100] Figure 8 It is a flowchart diagram of a transaction data processing method provided;

[0101] Fig. 9 A schematic diagram of a scenario for performing model training on a node sub-model in an initial training model provided by an embodiment of the present application;

[0102] Fig.10 It is a structural schematic diagram of a transaction data processing device provided in an embodiment of the present application;

[0103] Fig.11 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0104] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0105] 1. Distributed data storage system: a system that enables computers distributed in various corners of the network to provide resources to each other and interact. In the distributed network included in the distributed data storage system, each computer is in an independent and equal position, and can be used as a server to provide services and resources to other computers, or as a service requester to relieve the traffic pressure of the central server. Among them, the distributed network involved in the embodiment of the present application may include data storage nodes for providing data storage services in the same area or in different areas.

[0106] 2. Data storage node: a node device deployed in a distributed network to provide data storage services (e.g., data caching services). It should be understood that in an embodiment of the present application, the business data of business transactions performed by business objects (i.e., customers or users) in different regions can be stored (e.g., data cached) by these data storage nodes deployed in the distributed network. In an embodiment of the present application, these data storage nodes deployed in the distributed network can be collectively referred to as data storage devices. It should be understood that the databases corresponding to these data storage devices can be cache databases, which can be used to constitute a distributed database in the distributed network. The distributed database here can be used to temporarily cache the business data recently collected by the corresponding users (i.e., business objects) authorized to upload by different business terminals in different business scenarios.

[0107] 3. Central service node, a node device deployed in a distributed data storage system to provide data persistence storage services. In the embodiment of the present application, the central service node deployed in the distributed network can be referred to as a central service device. It can be understood that the database corresponding to the central service device is a central database, which can be used to persistently collect business data collected by corresponding users (i.e., business objects) authorized to upload by different business terminals in different business scenarios over a long period of time.

[0108] 4. Business data: is data collected by a business terminal when a user (i.e., business object) performs payment-related operations for each business transaction in different business scenarios. It should be understood that for any business object in different business scenarios, the business data here may specifically include the transaction behavior data generated by each business object when executing the corresponding business transaction, the transaction note information (e.g., text note information) annotated by each business object when executing the corresponding business transaction, and the transaction indicator data (e.g., transaction amount, number of transactions, transaction account information, etc.) required for each business object to participate in the transaction when executing the corresponding business transaction.

[0109] It should be understood that in the embodiments of the present application, in order to ensure the accuracy of the risk level division in the risk identification process, the embodiments of the present application propose a target training model that can be obtained through the current training to provide a new risk identification mechanism, which can then improve the prediction accuracy when predicting the object classification type of a certain business object through this risk identification mechanism.

[0110] 5. Target training model: A network model obtained by successively training each sub-model (e.g., node sub-model, text sub-model) and the business main model in the initial training model. The trained target training model can accurately predict the object classification type of a certain business object (i.e., target business object). For the convenience of distinction, the embodiment of the present application may refer to the node sub-model, text sub-model, and business main model in the model training phase as the initial node sub-model, initial text sub-model, and initial business main model, respectively, and may refer to the node sub-model, text sub-model, and business main model in the model application phase as the target node sub-model, target text sub-model, and target business main model, respectively.

[0111] 5.1) Node sub-model, where the node sub-model is a node embedding algorithm using Node2Vec algorithm (i.e., a node embedding algorithm for generating node embedding vectors), through which the nodes in the graph can be mapped to a low-dimensional space for vector representation. For example, the embodiment of the present application can use the Node2Vec algorithm to perform vector mapping on the node access sequences of these business nodes in the node relationship topology graph determined by different business scenarios to obtain the node mapping vectors of these business nodes in the low-dimensional space.

[0112] Among them, it can be understood that the Node2Vec algorithm can learn the probability of occurrence of each business node in its neighborhood based on the Skip-Gram model (i.e., a network model for capturing node semantic relationships between nodes) to generate a node embedding vector. For example, in an embodiment of the present application, for each business node in the above-mentioned node relationship topology diagram, a node access sequence of each business node can be generated using random walk measurement, and then, these node access sequences can be further used as inputs to the Skip-Gram model, so that the probability of occurrence of each node in its neighborhood can be predicted by the Skip-Gram model, and then the node embedding vector (i.e., the above-mentioned node mapping vector) of the corresponding business node in the low-dimensional space can be generated by the predicted probability of occurrence of each node in its neighborhood.

[0113] 5.2) Text sub-model, where the text sub-model is specifically a language training model for text classification, and the language training model can be specifically a Transformer-based bidirectional encoder representation (e.g., BERT, BidirectionalEncoder Representations fromTransformer) model. In an embodiment of the present application, the context information of the currently input text information (e.g., associated text information associated with transaction behavior data) can be learned through the text sub-model (e.g., Transformer-based bidirectional encoder representation model). The context information here can be specifically used to reflect the correlation between text segmentations in the associated text information.

[0114] 5.3) Business main model. The business main model here can be a distributed gradient boosting model based on a decision tree algorithm. For example, the distributed gradient boosting model based on a decision tree algorithm can be a LightGBM (Light Gradient Boosting Machine) model. The use of the LightGBM model can not only reduce the current large-scale data input in parallel, but also the use of the computing memory of the computer device running the business main model, and can also achieve linear acceleration in data calculation.

[0115] For further understanding, please refer to Figure 1 , Figure 1 is an architecture diagram of a transaction data processing system provided in an embodiment of the present application. Figure 1 As shown, the transaction data processing system may include a central service device 101a, a data storage device 100a, a data storage device 100b, a data storage device 100c, a business service device 1a, a business service device 1b, a business service device 1c, a business terminal cluster 10a, a business terminal cluster 10b, and a business terminal cluster 10c.

[0116] Among them, it is understandable that Figure 1 The central service device 101a, data storage device 100a, data storage device 100b, and data storage device 100c shown may be node devices deployed in a distributed data storage system. The central service device 101a here may be the central service node mentioned above, and similarly, the data storage device 100a, data storage device 100b, and data storage device 100c here may be data storage nodes in the distributed network mentioned above.

[0117] It is understood that the data storage node here can be connected with Figure 1 The service terminals in each service terminal cluster shown in the figure perform data interaction, for example, the data storage node here (for example, Figure 1 The data storage device 100b shown in the figure can be used to receive and cache different service terminals (for example, Figure 1 The service data uploaded by the service terminal in the service terminal cluster 10b shown in the figure can also be received and cached by different service terminals (for example, Figure 1 The service terminals in the service terminal cluster 10a shown in FIG. Figure 1 The service data uploaded by the service terminals in the service terminal cluster 10c shown in FIG.

[0118] Among them, it can be understood that the business terminals in the business terminal cluster 10a can specifically include business terminals 11a, ... business terminals 11n, and each business terminal in the business terminal cluster 10a can be used to collect business data when the corresponding user (i.e., business object) performs different business transactions in different business scenarios. Similarly, the business terminals in the business terminal cluster 10b can specifically include business terminals 12a, ... business terminals 12n, and each business terminal in the business terminal cluster 10b can also be used to collect business data when the corresponding user (i.e., business object) performs different business transactions in different business scenarios. By analogy, the business terminals in the business terminal cluster 10c can specifically include business terminals 13a, ... business terminals 13n, and each business terminal in the business terminal cluster 10c can also be used to collect business data when the corresponding user (i.e., business object) performs different business transactions in different business scenarios.

[0119] It should be understood that in order to reduce the number of business service devices located in different areas, for the central service node (for example, Figure 1 The concurrent access pressure of the central service device 101a) shown in the figure, the embodiment of the present application proposes that for an enterprise or business organization used to perform risk analysis, the business data of a user (i.e., business object) currently to be subjected to risk analysis within a period of time can be requested nearby through the corresponding business service device.

[0120] For example, for a business service device that currently needs to perform risk analysis on a customer (i.e., a user) in a certain area (e.g., Figure 1 For the business service device 1b shown in the figure, it can first send a request to a data storage node (for example, Figure 1 The data storage device 100b shown in the figure requests the business data of a certain user (i.e., business object) to be analyzed for risk within a specific time period (i.e., target business time period, for example, the past 30 days). Figure 1 The business service device 1b shown in the figure is located in a data storage node (for example, Figure 1If the data storage device 100b shown in the figure does not request the business data of this user (i.e., business object) within a specific time period (i.e., target business time period, for example, the past 30 days), it can further request the business data of this user (i.e., business object) currently to be risk analyzed within a specific time period (i.e., target business time period, for example, the past 30 days) from other data storage nodes (e.g., data storage device 100a) located in the adjacent area. Similarly. If the business service device (e.g., Figure 1 If the business service device 1b) does not request the business data of a certain user (i.e., business object) to be risk analyzed within a specific time period (i.e., target business time period, for example, the past 30 days) in other time storage nodes (e.g., data storage node 100a) located in the adjacent area, then it can further request the business data of a certain user (i.e., business object) to be risk analyzed within a specific time period (i.e., target business time period, for example, the past 30 days) to the central service node (i.e., Figure 1 The central service device 101a shown in the figure requests the business data of the user (ie, the business object) currently to be risk analyzed within a specific time period (ie, the target business time period, for example, the past 30 days).

[0121] It should be understood that the above-mentioned business service device 1a, business service device 1b and business service device 1c can be risk analysis devices in the risk analysis system. It can be understood that any risk analysis device in the risk analysis system can be an independent server, or a server cluster or distributed system composed of multiple servers, or a server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and basic cloud computing services such as big data and artificial intelligence platforms. This application does not limit the device type of the risk analysis device in the risk analysis system.

[0122] Among them, it can be understood that the business terminals in different business terminal clusters that interact with data storage nodes can specifically include: smart phones (such as Android phones, iOS phones, etc.), desktop computers, tablets, portable personal computers, mobile Internet devices (Mobile Internet Devices, MID) and wearable devices (such as smart watches, smart bracelets, etc.), vehicle-mounted devices and other electronic devices. The embodiments of the present application do not limit the terminal types of business terminals in different business terminal clusters.

[0123] For further understanding, please refer to Figure 2 , Figure 2 is a scene interaction diagram for data interaction provided by an embodiment of the present application. Figure 2The distributed data storage system 2a shown can specifically be the above Figure 1 The corresponding embodiment is a distributed data storage system composed of a central service device 101a, a data storage device 100a, a data storage device 100b and a data storage device 100c.

[0124] It should be understood that the business service device 2b involved in the embodiment of the present application may specifically be the risk analysis device deployed in the risk analysis system as described above. For example, the business service device 2b may specifically be the risk analysis device deployed in the risk analysis system as described above. Figure 1 The data storage device 100b in the corresponding embodiment. Figure 2 The user U1 shown is a user (ie, a target business object) currently to be subjected to risk analysis and is determined by the enterprise or organization corresponding to the business service device 2b.

[0125] like Figure 2 As shown, the business service device 2b can send a business data acquisition request to a node device in the distributed data storage system through step S1. It should be understood that the business data acquisition request here is used to indicate a node device in the distributed data storage system (for example, a data storage node located in the same area as the business service device 2b, for example, Figure 2 The data storage device 100c) shown searches for business data of business transactions performed by user U1 within X time period.

[0126] It should be understood that if the data storage device 100c finds the business data of the business transaction executed by the user U1 within the X period of time in the cache database maintained by itself, it can further execute Figure 2 In step S2 shown, the business data of the business transaction executed by the user U1 within the time length X is returned to the business service device 2b, so that the business service device 2b can call the currently trained target training model including the node sub-model, the text sub-model and the business main model based on the received business data of the business transaction executed by the user U1 within the time length X, to predict and output the confidence level when the object classification type of the user U1 is the target abnormal behavior type (for example, Figure 2 The confidence level 20a shown in FIG. 20a) can be used to predict the output of the target training model (for example, Figure 2 The confidence level 20a shown in FIG. 2 is used to quantify the risk score for risk assessment. It should be understood that the risk score here can be used to determine the risk level of the user U1 (for example, Figure 2 Risk level shown in 20b).

[0127] Optionally, it is understood that if the data storage device 100c does not find the business data of the business transaction performed by the user U1 within the X period of time in the cache database maintained by itself, the business service device 2b can send the business data to other data storage nodes (for example, Figure 2 The data storage device 100b) shown searches for the business data of the business transactions performed by the user U1 within a period of X time.

[0128] It should be understood that if Figure 2 The data storage device 100b shown searches for local data within a portion of the duration (for example, R duration, where the value of duration R is less than the value of duration X) of the business data of the business transaction performed by the user U1 within the duration X in the cache database maintained by itself. In order to avoid repeated acquisition of business data within the same duration (for example, R duration), the business service device 2b can further send data to other data storage nodes (for example, Figure 2 The data storage device 100a) shown searches for the business data of the business transactions performed by the user U1 within the remaining time (for example, (XR) time). If found, the business data of the business transactions performed by the user U1 within the remaining time (for example, (XR) time) can be returned to the business service device 2b.

[0129] It should be understood that if the data storage device 100a does not find the business data of the business transaction performed by the user U1 within the remaining time (for example, (XR) time) in the cache database maintained by itself, then Figure 2 The central service device 101a shown in the figure searches for the business data of the business transactions executed by the user U1 within the remaining time (for example, (XR) time), so that the business data of the business transactions executed by the user U1 within the remaining time (for example, (XR) time) found in the central database corresponding to the central service device 101a can be returned to the business service device 2b, so that when the business data of the business transactions executed by the user U1 within the entire X time is obtained, further execution can be performed in the business service device 2b. Figure 2 Steps S11 to S42 are shown.

[0130] Among them, Figure 2As shown, the business data of the business transaction performed by the user U1 during the entire X-duration may specifically include the transaction behavior data of the user U1 when performing the corresponding business transaction, and the associated text information added by the user U1 when performing the corresponding business transaction. For example, the associated text information here may be specifically determined by multimedia data information including text, audio, video, pictures, etc. For example, the associated text information here may include one or more of the text note information, voice text information, and video text information directly entered in the text display area when a certain user performs a business transaction. For example, the voice text information here may be obtained after voice conversion of the audio, etc. entered in the voice entry area associated with the text display area when performing the business transaction; the video text information here may be obtained after semantic conversion of the video, etc. entered in the video entry area associated with the text display area when performing the business transaction.

[0131] It can be understood that the transaction behavior data here may include the operation data collected when the user U1 performs payment-related operations in different transaction business scenarios. For example, the payment-related operations here may specifically include red envelope payment scenarios (for example, Figure 2 The red envelope transfer operation performed in the business scenario A) shown in the figure, the red envelope transfer operation performed in the business payment scenario (for example, Figure 2 The commercial transfer operation performed in the business scenario B) shown in the figure, the personal transfer payment scenario (for example, Figure 2 The personal transfer operation in the business scenario C) shown in the figure, the online shopping scenario (for example, Figure 2 The commodity purchase payment operation performed in the business scenario D) shown in the figure, the commodity purchase payment operation performed in the scan code payment scenario (for example, Figure 2 The scan code payment operation performed in the business scenario E) shown in the figure, and the resource exchange scenario (for example, Figure 2 In the business scenario F) shown, multiple account opening and closing operations are performed through the same terminal device.

[0132] It can be seen that the embodiment of the present application can further perform the following steps when analyzing the transaction behavior data of the user U1 from the business data obtained from the distributed data storage system: Figure 2 Step S11 shown is to determine based on these transaction behavior data Figure 2 The transaction business scenario shown is a business transaction performed by user U1 within the above X days.

[0133] It can be understood that the transaction business scenarios here may at least include the above-mentioned business scenario A, business scenario B, business scenario C, business scenario D, business scenario E and business scenario F. Further, the business service device 2b may execute step S12 to construct the obtained business scenario based on these transaction business scenarios. Figure 2 The node relationship topology diagram shown. In the node relationship topology diagram, business node A is a node constructed by the above business scenario A, business node B is a node constructed by the above business scenario B, business node C is a node constructed by the above business scenario C, business node D is a node constructed by the above business scenario D, business node E is a node constructed by the above business scenario E, and business node F is a node constructed by the above business scenario F.

[0134] like Figure 2 As shown, the service node device 2b can further execute step S13, input the node relationship topology diagram into the node sub-model M1 in the currently trained target training model, and then execute Figure 2 The step S14 shown is to output the abnormal behavior classification group to which the user U1 belongs. It should be understood that the abnormal behavior classification group here can be the classification result obtained by the node sub-model M1 performing a rough classification on the object classification type of the user U1.

[0135] like Figure 2 As shown, when the business service device 2b obtains the associated text information from the business data of the user U1, it further executes step S21 to input the associated text information into the text sub-model M2 in the target training model, and then the text sub-model M2 can be used to execute Figure 2 Step S22 shown is to output the text classification group to which the user U1 belongs. It should be understood that the text classification group here can be the classification result obtained by the text sub-model M2 for roughly classifying the object classification type of the user U1. For example, the classification result here (i.e., the text classification group) can specifically include a legal user text classification group and an illegal text classification group. Among them, the legal text classification group refers to the text classification group determined by the text sub-model M2 when determining that the associated text information is legal text information. Similarly, the illegal text classification group refers to the text classification group determined by the text sub-model M2 when determining that the associated text information is illegal text information (for example, some risk text sequences composed of numbers, letters, and symbols, etc.). In an embodiment of the present application, when the target business object is determined to belong to the abnormal text classification group by the node sub-model, the text classification group determined by the text sub-model (for example, a legal user text classification group or an illegal text classification group) and the data processing results obtained by the indicator calculation can be further combined to dig deeper and analyze the specific object classification type to which the target business object belongs.

[0136] like Figure 2As shown, when the business service device 2b obtains the transaction index from the business data of the user U1, it can further execute step S31 to calculate the index of the transaction index data, and then the index calculation result (i.e. Figure 2 The data processing result shown in FIG. 1 is input into the business main model M3 in the target training model. Figure 2 As shown, at the same time, the embodiment of the present application can also input the abnormal behavior classification group output by the node sub-model M1 through step S14 and the text classification group output by the text sub-model M2 through step S22 into the business main model M3 in the target training model, so that the business main model M3 can further perform Figure 2 The step S41 shown can output the confidence 20a that the user U1 belongs to the target abnormal behavior type in the abnormal behavior classification group. It should be understood that the target abnormal behavior type here is the sub-classification result obtained after the business master model M3 performs sub-classification on the user U1. It should be understood that the abnormal behavior classification group here can contain one or more abnormal behavior types (that is, each abnormal behavior type here can be regarded as a sub-classification), and the target abnormal behavior type here is the abnormal behavior type corresponding to the maximum confidence determined by the business master model M3 after selecting the confidence of each abnormal behavior type.

[0137] Optionally, it can be understood that in the embodiments of the present application, Figure 2 The business service device 2b shown can also be a node in a distributed system, wherein the distributed system can be the blockchain system corresponding to the above-mentioned risk analysis system, and the blockchain system can be another distributed system formed by connecting the multiple nodes through network communication. Among them, the nodes can form a point-to-point network, and the point-to-point protocol is an application layer protocol running on the Transmission Control Protocol (TCP) protocol. For ease of understanding, the concept of blockchain will be explained below: Blockchain is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism and encryption algorithm. It is mainly used to organize data in chronological order and encrypt it into an account book so that it cannot be tampered with or forged. At the same time, data can be verified, stored and updated. When the business service device 2b is connected to the blockchain system to become a blockchain node, due to the tamper-proof and anti-counterfeiting characteristics of the blockchain, the embodiment of the present application can be used to determine the risk level of the user U1 determined by the business service device 2b (for example, Figure 2 When the risk level 20b shown in FIG. 2 is written to the blockchain ledger of the blockchain maintained by the user, the risk level of the user U1 written into the blockchain ledger (for example, Figure 2 The authenticity and security of the risk level 20b) shown in the risk analysis system can be ensured, so that any other institution or enterprise that newly accesses the blockchain system corresponding to the risk analysis system can quickly and reliably obtain the risk levels of all target business objects that have been risk-identified from the blockchain.

[0138] It should be noted that when the computer device in the embodiment of the present application obtains the user's personal data information, behavioral data information, transaction notes information, transaction indicator information and other business data, it can display a prompt interface or pop-up window. The prompt interface or pop-up window is used to prompt the user that the personal data information, behavioral data information, transaction notes information, transaction indicator information and other business data are currently being collected. Only after the user issues a confirmation operation on the prompt interface or pop-up window, the relevant steps of data acquisition are started, otherwise the process ends.

[0139] It is understandable that in the specific implementation of this application, it may involve obtaining business data of users, enterprises, institutions and other objects (for example, personal data information, behavioral data information, transaction notes information and transaction indicator information). When the above embodiments of this application are applied to specific products or technologies, it is necessary to obtain the permission or consent of users, enterprises, institutions and other objects, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0140] For further information, see Figure 3 , Figure 3 is a method flow chart of a transaction data processing method provided by an embodiment of the present application. The method can be executed by a business service device for risk analysis, where the business service device can be the above-mentioned Figure 2 The business service device 2b in the corresponding embodiment. The transaction data processing method may at least include the following steps S101 to S105:

[0141] Step S101, when the transaction behavior data of the target business object is obtained, a transaction business scenario associated with the transaction behavior data is determined, and a node relationship topology diagram associated with the target business object is constructed based on the transaction business scenario;

[0142] The node relationship topology diagram includes N business nodes, where one business node is determined by one transaction business scenario; N is a positive integer greater than 1;

[0143] Specifically, the business service device can obtain the business transactions that have been executed by the target business object within the target business time period from the distributed data storage system, and can determine the behavior data set of the target business object within the target business time period based on the transaction details information of the business transactions, and then use the behavior data in the behavior data set as the transaction behavior data of the target business object; further, the business service device can perform data analysis on the transaction behavior data to determine the business interaction object that has a data interaction relationship with the target business object, and then determine N transaction business scenarios of the target business object within the target business time period based on the data interaction relationship between the target business object and the business interaction object; further, the business service device can construct N business nodes associated with the target business object based on the N transaction business scenarios, and can determine the node connection relationship between the N business nodes based on the scenario correlation between the N transaction business scenarios; it should be understood that one business scenario here can be used to construct one business node; further, the business service device can construct a node relationship topology diagram associated with the target business object based on the N business nodes and the node connection relationship.

[0144] For further understanding, please refer to Figure 4 , Figure 4 It is a schematic diagram of a scenario for constructing a node relationship topology diagram provided in an embodiment of the present application. It should be understood that in the embodiment of the present application, one or more users who currently need to be risk assessed can be collectively referred to as target business objects. For ease of understanding, the target business object is used here. Figure 4 The user U1 shown is an example of a user who currently needs to be risk assessed. In this way, when the business service device obtains the transaction behavior data of the user U1 within a certain period of time (i.e., the target business time period, for example, the past 30 days), the transaction behavior data of the user U1 can be analyzed to find all the interaction objects that have a data interaction relationship with the user U1 (i.e., the target business object) within this period of time (i.e., the target business time period, for example, the past 30 days).

[0145] It should be understood that in the embodiment of the present application, the data interaction relationship currently analyzed can be used to describe the interaction objects with which the user U1 (i.e., the target business object) actually interacts with data in different business scenarios. For ease of understanding, the embodiment of the present application can refer to each interaction object that has a data interaction relationship with the user U1 (i.e., the target business object) as a business interaction object. The business interaction objects here specifically include Figure 4 Shown are user U0, user U2, ... user U3.

[0146] It should be understood that the data interaction relationship analyzed in the embodiment of the present application may include one or more interaction relationships, and the specific number of the interaction relationships analyzed is not limited here. Figure 4 As shown, multiple interaction relationships may specifically include Figure 4 The interactive relationship U10, the interactive relationship U12, ..., the interactive relationship U13 are shown. For ease of understanding, the interactive relationship U10, the interactive relationship U12, and the interactive relationship U13 are taken as examples.

[0147] The interaction relationship U10 is used to record the business scenario of the interaction object (i.e., user U0) that actually interacts with the user U1. For example, the business scenario here can specifically include the personal transfer payment scenario when user U1 performs a personal transfer operation to user U0, and the commercial payment scenario when user U1 performs an online commercial transfer operation to user U0. Figure 4 Taking the transaction business scenario T shown in FIG. 1 as an example, at this time, the commercial payment scenario associated with the user U1 can be Figure 4 Transaction business scenario V shown.

[0148] The interaction relationship U12 is used to record the business scenario of another interaction object (i.e., user U2) that actually interacts with the user U1. For example, the business scenario here can specifically include the red envelope payment scenario when user U1 performs a red envelope transfer operation to user U0, and the scan code payment scenario when user U2 performs a scan code payment operation to user U1 through a scan code operation. Figure 4 Taking the transaction business scenario X1 shown in the figure as an example, at this time, the scan code payment scenario associated with the user U1 can be Figure 4 Transaction business scenario X2 is shown.

[0149] The interaction relationship U13 is used to record the business scenario of another interaction object (i.e., user U3) that actually interacts with the user U1. For example, the business scenario here may specifically include a business payment scenario in which user U1 repeatedly opens and closes accounts through the same terminal device when purchasing items from user U3. For ease of understanding, the business payment scenario in which user U1 repeatedly opens and closes accounts through the same terminal device is used as an example. Figure 4 Take the transaction business scenario X3 as an example.

[0150] Furthermore, the business service equipment can be based on Figure 4The data interaction relationships shown in the figure determine all business scenarios of the user U1 (i.e., the target business object) within this period of time (i.e., the target business time period, for example, the past 30 days), and then these determined business scenarios can be collectively referred to as transaction business scenarios. The number of transaction business scenarios here can be specifically N, that is, these N transaction business scenarios can at least include Figure 4 The transaction business scenario T, transaction business scenario V, transaction business scenario X1, transaction business scenario X2 and transaction business scenario X3 are shown.

[0151] It should be understood that Figure 4 As shown, the business service device can further construct N business nodes associated with the user U1 (ie, the target business object) based on the determined N transaction business scenarios. Figure 4 As shown, the N service nodes may at least include a service node T, a cross-service node V, a service node X1, a service node X2, and a service node X3.

[0152] It can be understood that the business node T here is constructed with the transaction business scenario T as the node, and similarly, the business node V is constructed with the transaction business scenario V as the node. Similarly, the business node X1 is constructed with the transaction business scenario X1 as the node; the business node X2 is constructed with the transaction business scenario X2 as the node; and the business node X3 is constructed with the transaction business scenario X3 as the node.

[0153] Then, the business service device can determine the node connection relationship between the N business nodes based on the scene correlation between the N transaction business scenes. For example, for ease of understanding, any two business scenes (such as the first business scene and the second business scene) with scene correlation in the N transaction business scenes are taken as an example to illustrate the specific process of determining the node connection relationship between the N business nodes.

[0154] It is understandable that the first transaction scenario here is different from the second transaction scenario. For ease of understanding, the first business transaction is taken as the example. Figure 4 The transaction business scenario T shown (for example, the above-mentioned personal transfer payment scenario), the second transaction business scenario is Figure 4 Taking the transaction business scenario V shown (for example, the above-mentioned commercial payment scenario) as an example, at this time, the data interaction relationship between user U1 (i.e., the target business object) and user U0 (i.e., the business interaction object) can be specifically determined by the first interaction parameter information and the second interaction parameter information obtained from the transaction behavior data of user U1.

[0155] Among them, the first interaction parameter information may be determined by the first business transaction between user U1 (i.e., the target business object) and user U0 (i.e., the business interaction object) in the first business scenario. The first business transaction here may specifically refer to one or more personal transfer transactions between user U1 and user U0. The number of personal transfer transactions included in the first business transaction will not be specifically limited here. For example, the first interaction parameter information may include the transfer amount of each personal transfer transaction recorded when the user U1 performs multiple personal transfer operations to user U0 within the target business time period (e.g., the nearly 30 days mentioned above) in the transaction business scenario T (e.g., the above-mentioned personal transfer payment scenario), the number of transfer operations when the transfer amount reaches the single limit threshold, and the frequency of transfer operations within the target business time period, etc.

[0156] Similarly, the second interaction parameter information may be determined by the second business transaction between user U1 (i.e., the target business object) and user U0 (i.e., the business interaction object) in the second business scenario. The second business transaction here may specifically refer to one or more commercial transfer transactions between user U1 and user U0. The number of commercial transfer transactions included in the second business transaction will not be specifically limited here. For example, the second interaction parameter information may include the transfer amount of each commercial transfer transaction recorded when the user U1 performs multiple commercial transfer operations to user U0 in the above target business time period (e.g., the above nearly 30 days) under the transaction business scenario V (e.g., the above commercial payment scenario), the number of transfer operations when the transfer amount reaches the single limit threshold, and the frequency of transfer operations in the target business time period, etc.

[0157] Based on this, the business service device involved in the embodiment of the present application can be Figure 4 Get the first transaction scenario (i.e. Figure 4 The transaction business scenario T shown, for example, the above-mentioned personal transfer payment scenario) and the second transaction scenario (i.e. Figure 4 The transaction business scenario V shown, for example, the commercial payment scenario mentioned above), can then be the first transaction business scenario (i.e. Figure 4 The transaction business scenario T shown in the figure, for example, the above-mentioned personal transfer payment scenario) is constructed as the business node obtained as the first business node (for example, Figure 4 The business node T shown in FIG. 1 is a second transaction business scenario (i.e. Figure 4 The transaction business scenario V shown in the figure, for example, the above-mentioned commercial payment scenario) is constructed as the business node as the second business node (for example, Figure 4The business node V shown in the figure can then obtain the transaction transfer quantity of these personal transfer transactions (i.e., the above-mentioned first business transactions) executed between user U1 and user U0 from the above-mentioned first interaction parameter information (for example, the transfer amount of each personal transfer transaction and the number of transfers of the personal transfer transactions). At the same time, the embodiment of the present application can also obtain the transaction transfer quantity of these commercial transfer transactions (i.e., the above-mentioned second business transactions) executed between user U1 and user U0 from the above-mentioned second interaction parameter information (for example, the transfer amount of each commercial transfer transaction and the number of transfers of the commercial transfer transactions).

[0158] Among them, for ease of understanding, here we take the transaction transfer quantity of the first business transaction as the transfer amount of each personal transfer transaction (for example, the transfer amount of the first personal transfer transaction is 1,000 yuan, and the transfer amount of the second personal transfer transaction is 2,000 yuan), and the transaction transfer quantity of the second business transaction as the transfer amount of each commercial transfer transaction (for example, the transfer amount of the first commercial transfer transaction is 5,000 yuan, and the transfer amount of the second commercial transfer transaction is 6,000 yuan) as an example, so that the transaction transfer quantity of the first business transaction and the transaction transfer quantity of the second business transaction can be further accumulated to obtain the accumulated transaction quantity between user U1 (i.e., the target business object) and user U0 (i.e., the business interaction object) (for example, 1,000+2,000+5,000+6,000=140,000 yuan).

[0159] Further, the embodiment of the present application can be based on the target business object (for example, Figure 4 The user U1 shown in the figure and the business interaction object (for example, Figure 4 The data interaction relationship between the user U0 shown in the figure determines the first service node (for example, Figure 4 The service node T shown) and the second service node (eg, Figure 4 When the edge connection relationship between the business nodes V shown in FIG. 1 is further connected, the target business object (for example, Figure 4 The user U1 shown in the figure and the business interaction object (for example, Figure 4 The accumulated transaction resource quantity (for example, 1000+2000+5000+6000=140000 yuan) between the user U0 shown in FIG. 1 is used as the first service node (for example, Figure 4 The service node T shown) and the second service node (eg, Figure 4 The edge weight coefficients between the business nodes V shown (for example, Figure 4 The weight W1 shown in FIG. 1 is used to calculate the edge connection relationship between the first service node and the second service node and the edge weight coefficient between the first service node and the second service node, so that the edge connection relationship between the first service node and the second service node and the edge weight coefficient between the first service node and the second service node can be used as the node connection relationship between the first service node and the second service node. Figure 4 In the node relationship topology diagram shown, there is a node connection relationship between the service node T and the service node V. The value of the weight W1 can be the above-mentioned cumulative transaction resource quantity, or can be a normalization coefficient after normalizing the above-mentioned cumulative transaction resource quantity, which will not be limited here.

[0160] Similarly, in the embodiment of the present application, when the service node V is used as the first service node and the service node X1 is used as the second service node, the edge connection relationship between the first service node (for example, the service node V) and the second service node (for example, the service node X1) and the edge weight coefficient (for example, Figure 4 The weight W2 shown in FIG. 1 is used as the node connection relationship between the first service node (for example, service node V) and the second service node (for example, service node X1), so that Figure 4 The node relationship topology diagram shows that there is a node connection relationship between the service node V and the service node X1. The specific implementation method of determining the weight W2 can refer to the description of the specific process of determining the weight W1 above, which will not be further described here.

[0161] By analogy, in the embodiment of the present application, when the service node V is used as the first service node and the service node X2 is used as the second service node, the edge connection relationship between the first service node (for example, the service node V) and the second service node (for example, the service node X2) and the edge weight coefficient (for example, Figure 4 The weight W3 shown in FIG. 1 is used as the node connection relationship between the first service node (eg, service node V) and the second service node (eg, service node X2), so that Figure 4 In the node relationship topology diagram shown, there is a node connection relationship between the service node V and the service node X2. Similarly, in the embodiment of the present application, when the service node V is used as the first service node and the service node X3 is used as the second service node, the edge connection relationship between the first service node (for example, the service node V) and the second service node (for example, the service node X3) and the edge weight coefficient (for example, Figure 4 The weight W4 shown in FIG. 4 is used as the node connection relationship between the first service node (for example, service node V) and the second service node (for example, service node X3), so that Figure 4The node relationship topology diagram shows that there is a node connection relationship between service node V and service node X3. The specific implementation of determining weights W3 and W4 can also refer to the description of the specific process of determining weight W1, which will not be described here.

[0162] Step S102, when a target training model for predicting the object classification type of a target business object is obtained, the node relationship topology diagram is input into the node sub-model of the target training model, the node sub-model determines the node mapping vector of each business node in N business nodes, and based on the node mapping vector of each business node, outputs the abnormal behavior classification group to which the target business object belongs;

[0163] Specifically, the business service device can obtain a target training model for predicting the object classification type of the target business object; further, the business service device can input the node relationship topology map into the node sub-model of the target training model, and then when the node sub-model extracts N business nodes from the node relationship topology map, it can determine the node access sequence associated with the business node i among the N business nodes; i is a positive integer less than or equal to N; it should be understood that the business node i here can be a business node among the N business nodes currently extracted. Further, the business service device can perform node vector mapping on the node access sequence associated with the business node i to obtain the node mapping vector of the business node i; further, the business service device can output the abnormal behavior classification group to which the target business object belongs based on the node mapping vector of the business node i.

[0164] For further understanding, please refer to Figure 5 , Figure 5 is a schematic diagram of a scene of a node sub-model provided in an embodiment of the present application. Figure 5 The node relationship topology shown Figure 5 a is an example of the node relationship topology diagram constructed by the above step S101. Figure 5 As shown, when the business service device connects the node relationship topology Figure 5 aEnter the above Figure 5 When the node sub-model M1 is shown, the node relationship topology can be obtained from the node sub-model M1 (that is, the target node sub-model obtained after the model training of the initial node sub-model as described above). Figure 5 a extracts N business nodes, which can be Figure 5 The service node T, service node V, service node X1, service node X2 and service node X3 are shown. It should be understood that from the node relationship topology Figure 5 The N business nodes extracted by a can be stored in Figure 5In the service node set 5b shown, the node order of the service nodes in the service node set 5b is disrupted.

[0165] It should be understood that in the embodiment of the present application, when the business service device topologically Figure 5 aEnter the above Figure 5 After the node sub-model M1 shown in FIG. 1 is obtained, the node access strategy (for example, a biased random walk strategy) in the node sub-model M1 (that is, the target node sub-model obtained after the model training of the initial node sub-model) can be used to determine the node access strategy from a certain service node currently located in the service node cluster 5b (for example, Figure 5 The service node T shown is the node transition probability of the service node i) accessing the next node in its neighborhood.

[0166] In this way, when the node transfer probability of the business node T when accessing from the business node T to the business node V is determined based on the node access parameters in the node access strategy (for example, the node revisit parameter p and the internal and external wandering parameter q), it can be determined based on the node transfer probability (for example, the node transfer probability 1) that the business node T will be accessed to the business node V.

[0167] For ease of understanding, Figure 5 As shown, for the service node T currently obtained from the service node cluster 5b is the service node i, when the service node i is changed from the service node T to the service node V through the node access parameter in the node access policy, the node transfer probability of the service node T here can be the above-mentioned node transfer probability 1. At this time, the node transfer probability 1 can be recorded as a TX .

[0168] The character T is used to represent the service node T currently serving as the service node i, and the character X is used to represent the next service node to be visited of the service node T currently serving as the service node i. For ease of understanding, the next service node to be visited of the service node T currently serving as the service node i is taken as Figure 5 Take the service node V shown as an example.

[0169] Further, such as Figure 5 As shown, if the business service equipment is based on Figure 5The TV edge shown has been accessed from service node T to service node V. Then, when the current service node i is changed from service node T to service node i, the service node V can be further used as the next service node of the service node i (for example, service node i', i.e., the new service node i). Then, based on the node access parameters in the node access policy (for example, node revisit parameter p and internal and external roaming parameter q), the node transition probability of the service node V when accessing the next service node from service node V (for example, node transition probability 2) can be further determined. It should be understood that the node transition probability of the service node V here (for example, node transition probability 2) is a combination of the node access probability of the service node V (for example, (T, X)) and the weight coefficients between other service nodes having edge connection relationships with the service node V (for example, W VX ) are jointly determined by

[0170] In other words, in an embodiment of the present application, for any given business node (i.e., business node i), one of the neighboring nodes of the current business node can be randomly sampled as the next business node, so that the node access probability of the next business node (i.e., the new business node i) to further access the next business node to be visited can be controlled by the node access parameters in the node access policy, and then the node access probability of the next business node (i.e., the new business node i) and the weight coefficient on the edge that has an edge connection relationship with the current next business node (i.e., the new business node i) can be used to recalculate the node access probability of further accessing the next business node to be visited.

[0171] For example, for a service node V, at this time, the node transition probability 2 of the service node V can be recorded as a VX Here the node transition probability 2 (i.e. a VX ) can be expressed by the following formula (1):

[0172] a VX =b(T,X)*W VX Formula (1)

[0173] Among them, the node transfer probability a VX The character V in is used to represent the current service node V, and the character X is the next service node to be visited of the current service node V. In this way, when the current service node V is used as the new service node i, the parameter b(T, X) in formula (1) can be used to describe the node transition probability of the service node V accessing a service node to be visited in its neighborhood (for example, the service node to be visited X). At this time, the node access probability b(T, X) of the service node V determined by the node access parameter in the above node access strategy can be Figure 5The a1, a2, a3 and a4 shown in the node relationship topology diagram. Wherein, the parameter W in the formula (1) VX It can be used to describe the weight coefficient between the service node V and the service node having an edge connection relationship with the service node V. That is, the weight coefficient here can specifically include the weight coefficients distributed in the above Figure 4 The node relationship topology graph shown includes the weight coefficient W1 on edge TV, the weight coefficient W2 on edge TX1, the weight coefficient W3 on edge TX2, and the weight coefficient W4 on edge TX4.

[0174] For ease of understanding, further, please refer to the following formulas (2) to (4). In the embodiment of the present application, the node access strategy for the service node V can be described by the following formula (2):

[0175] If d TX =0, then b(T, X) = 1 / p Formula (2)

[0176] If d TX =1, then b(T, X) = 1 Formula (3)

[0177] If d TX =2, then b(T, X) = 1 / q Formula (4)

[0178] Among them, the parameter d in formula (2) to formula (4) is TX It is used to describe the relationship topology between the service node V and the next service node to be visited by the service node V (for example, the service node to be visited X). Figure 5 a is the shortest access distance. For example, in formula (2), d TX = 0, it means that the next service node to be visited (for example, service node X to be visited) of the service node V can be controlled by the above node return parameter p, that is, service node T. At this time, X = T, a1 = b (T, X) = 1 / p. Similarly, in formula (3), d TX =1, it means that the above-mentioned internal and external roaming parameter q can control the next service node to be visited of the service node V (for example, the service node to be visited X) to be also the adjacent service node of the service node T (for example, Figure 5 The service node X1 shown in the figure, at this time X = X1, a2 = b (T, X) = 1. Similarly, in formula (4), d TX = 2, it means that the above-mentioned internal and external roaming parameter q can control the next service node to be visited by the service node V (for example, the service node to be visited X) to be a non-adjacent service node of the service node T (for example, Figure 5 The service node X2 or service node X3 shown in the figure), at this time X=X1 or X=X3, and a3=a4=b(T,X)=1 / q.

[0179] It can be understood that, for the node revisit parameter p, the possibility of a walk returning to the last vertex can be controlled by the node revisit parameter p. That is, when a walk starts from a vertex (i.e., the starting point, for example, Figure 5 The business node T shown in FIG. 1 goes to the next vertex (eg, Figure 5 When the business node V shown in the figure is used, the node return parameter p can be used to control the return from the current vertex (for example, Figure 5 The business node V shown in FIG. 10A ) then goes back to the previous vertex (for example, Figure 5 If the value of the node revisit parameter p is set relatively large, the probability of a walk from the current vertex back to the previous vertex will be smaller, that is, the walk will go farther and farther, and deviate more and more from the previous vertex, so that the purpose of walking in the field of a certain starting point or walking in a deeper field away from a certain starting point can be achieved.

[0180] It can be understood that the inner and outer walk parameter q is used to control whether a walk is inward or outward. When the value of the inner and outer walk parameter q is larger, the random walk will tend to approach the vertex (for example, Figure 5 The node of the service node T shown (for example, Figure 5 The service node X1 shown in the figure, that is, the wandering area is more inclined to the neighborhood of the vertex, and thus the breadth-first search (BFS) can be implemented. On the contrary, when the value of the inner and outer wandering parameter q is smaller, the random walk tends to be away from the vertex (for example, Figure 5 Therefore, the internal and external walk parameters q determine the random walk area, and the node revisit parameter p determines the random walk method. After combining the two, the node visit sequence of each business node can be obtained through several biased walks (for example, for the business node T as the starting point (that is, the above business node i), we can get Figure 5 The node access sequence of the business node T shown in the figure) can then be used to obtain more comprehensive structural information and homogeneity of these business nodes on the node relationship graph through the node access sequence of each business node.

[0181] It can be seen that the embodiment of the present application can obtain Figure 5 After the node access strategy in the node sub-model M1 shown, the service node i is further obtained from N service nodes based on the node access strategy (for example, Figure 5The service node T shown as the starting point can be used to obtain one or more access sequences associated with the service node i based on the node access parameters in the node access strategy (for example, the above-mentioned internal and external roaming parameters q and node return visit parameters p) (for example, Figure 5 Node access sequence 51a, node access sequence 52a, node access sequence 53a and node access sequence 54a shown). Further, the embodiment of the present application can filter out access sequences when the sequence length reaches the sequence length threshold indicated by the node access policy from one or more access sequences associated with the service node i, and then the filtered access sequence can be used as the node access sequence associated with the service node i among the N service nodes.

[0182] Further, such as Figure 5 As shown, the embodiment of the present application can access the node sequence associated with the service node i (for example, Figure 5 The node access sequence 51a, the node access sequence 52a, the node access sequence 53a and the node access sequence 54a shown in FIG. 1 are subjected to node vector mapping to obtain Figure 5 The sequence conversion vector 1, sequence conversion vector 2, sequence conversion vector 3 and sequence conversion vector 4 are shown. Then, the embodiment of the present application can perform vector integration (for example, vector splicing) on ​​these sequence conversion vectors 1, sequence conversion vector 2, sequence conversion vector 3 and sequence conversion vector 4, so as to obtain Figure 5 The node mapping vector of the business node i is shown; further, the embodiment of the present application can accurately predict the abnormal behavior classification group to which the output target business object belongs based on the node mapping vector of the business node i.

[0183] It should be understood that the embodiment of the present application can convert the relatively sparse node encoding vector (i.e., node embedding vector) of each business node in the node relationship topology diagram into a relatively dense feature input vector (i.e., a sequence conversion vector corresponding to multiple node access sequences) through the node sub-model M1, and then the relatively dense feature input vector (i.e., the new node embedding vector) can be embedded from the high-dimensional space to the low-dimensional space, and then the deeper structural information and homogeneity between these business nodes in the node relationship topology diagram can be fully utilized to map the node mapping vector of each business node, so that the object classification type of the current target business object can be identified through the node mapping vectors of these mapped business nodes (for example, the object classification type here can be roughly classified into the above-mentioned abnormal behavior classification group).

[0184] Specifically, it can be understood that in the embodiment of the present application, the business service device can achieve coarse classification by means of vector similarity. For example, the business service device can determine the vector distance between the node mapping vector of the business node i and the multiple sample mapping vectors in the node submodel, and then determine the vector similarity between the node mapping vector of the business node i and the multiple sample mapping vectors based on the determined vector distance; then, the business service device can use the sample mapping vector with the maximum vector similarity as the target sample mapping vector in the vector similarity, determine the sample abnormal behavior label information associated with the sample node corresponding to the target sample mapping vector, and can determine the abnormal behavior type of the target business object when it is at the business node i based on the sample abnormal behavior label information, and determine the sample abnormal group to which the sample abnormal behavior label information belongs as the behavior type group of the abnormal behavior type when the target business object is at the business node i; further, the business service device can determine the abnormal behavior classification group to which the target business object belongs based on the behavior type group of the abnormal behavior type when the target business object is at the business node i.

[0185] Optionally, in an embodiment of the present application, the business service device can also implement rough classification by vector clustering. For example, the node sub-model includes M sample abnormal groups; M is a positive integer greater than or equal to 2; one sample abnormal group corresponds to a group center vector; a group center vector is obtained after clustering the sample mapping vector corresponding to the sample behavior type in a sample abnormal group, the business service device can obtain the sample abnormal group j as the first sample abnormal group from the M sample abnormal groups; j is a positive integer less than M; further, the business service device can determine the first vector similarity between the node mapping vector of the business node i and the group center vector of the first sample abnormal group; if the first vector similarity reaches the vector similarity threshold, the first sample abnormal group can be further used as the behavior type group of the abnormal behavior type when the target business object is at the business node i; further, the business service device can be based on the behavior type group of the abnormal behavior type when the target business object is at the business node i, and determine it as the abnormal behavior classification group to which the target business object belongs.

[0186] Optionally, M sample anomaly groups include sample anomaly group k; k=j+1; k is a positive integer greater than j and less than or equal to M. At this time, the business service device can also use the sample anomaly group k as the second sample anomaly group when it is determined that the first vector similarity does not reach the vector similarity threshold; the second sample anomaly group is the next sample anomaly group of the first sample anomaly group; in this way, the business service device can determine the second vector similarity between the node mapping vector of the business node i and the group center vector of the second sample anomaly group; further, if the second vector similarity reaches the vector similarity threshold, the second sample anomaly group is used as a behavior type group of the abnormal behavior type when the target business object is at the business node i.

[0187] Optionally, it can also be understood that if the second vector similarity also reaches the vector similarity threshold, it can be determined that the target business object belongs to the non-abnormal behavior classification group (for example, the target business object can be temporarily determined as a legal behavior classification group, so that in a subsequent new round of model training, the target business object classified in the legal behavior classification group can be used as a sample business object, and the business data of the sample business object can be used as sample business data to participate in the subsequent model training of the new initial network model).

[0188] It should be understood that in the embodiment of the present application, when the business service device outputs the legal behavior classification group to which the target business object belongs based on the node mapping vector of each business node, it can be determined that the target business object belongs to a legal business object, and then there is no need to continue to perform the following steps S103-S105. Conversely, when the business service device outputs the abnormal behavior classification group to which the target business object belongs based on the node mapping vector of each business node, it can be determined that the target business object belongs to an illegal business object, and then the following steps S103-S105 can be continued to be performed, so as to fully explore and analyze which abnormal behavior type in the abnormal behavior classification group the target business object belongs to.

[0189] Step S103, when the associated text information associated with the transaction behavior data is obtained, the associated text information is input into the text sub-model of the target training model, the text sub-model determines the text mapping vector of the text segmentation in the associated text information, and determines the text classification group to which the target business object belongs based on the text mapping vector;

[0190] The transaction behavior data here is determined based on the business transactions that have been executed by the target business object within the target business time period obtained from the distributed data storage system; for example, the transaction behavior data here is determined based on the business data of these business transactions obtained from the distributed data storage system; specifically, the business service device can obtain from the distributed data storage system the text information entered when the target business object executes the business transaction within the target business time period (it should be understood that the text information here can be the transaction note information noted when performing the above-mentioned payment-related operations for each business transaction), and the obtained text information can be used as associated text information associated with the transaction behavior data; further, the business server can The associated text information is input into the text sub-model of the target training model, and the text sub-model performs word segmentation processing on the associated text information to obtain text word segmentations of the associated text information; wherein the text word segmentations here include L word segmentations; L is a positive integer; further, the business service device can select a word from the L word segmentations as a key text word segmentation, perform word vector mapping on the key text word segmentation, and obtain a word segmentation mapping vector of the key text word segmentation, until each of the L word segmentations is used as a key text word segmentation, and a word segmentation mapping vector of each word segmentation is obtained; further, the business service device can determine the text mapping vector of the text word segmentation in the associated text information based on the word segmentation mapping vector of each word segmentation, and determine the text classification group to which the target business object belongs based on the text mapping vector.

[0191] For further understanding, please refer to Figure 6 , Figure 6 is a schematic diagram of a scenario in which a text classification group is output through a text sub-model provided in an embodiment of the present application. The text sub-model here can be specifically Figure 6 The text sub-model M2 is shown. Figure 6 As shown, when the business service device inputs the acquired text information 6a (eg, the above-mentioned text remark information) associated with the user U1 into the text sub-model M2, the text sub-model M2 can obtain the text mapping vector of the text segmentation in the text information 6a.

[0192] The text sub-model M2 may include at least Figure 6 The input layer, K feature encoding layers and text classification layer are shown. Figure 6 The input layer shown can be used to perform word segmentation processing on the text information 6a to obtain text segmentations in the text information 6a (i.e., the associated text information). It should be understood that the text segmentations in the text information 6a may include L segmentations, where the L segmentations may specifically include Figure 6The shown segmentation 1, segmentation 2, segmentation 3, ..., segmentation L. It should be understood that the embodiment of the present application can obtain the segmentation mapping vector of each segmentation through the input layer encoding of the text sub-model M2.

[0193] For ease of understanding, the embodiment of the present application takes the key text segmentation selected from L segmentations as segmentation 1 as an example. At this time, the business service device can perform word vector mapping on segmentation 1 as the key text segmentation, and then obtain the word embedding vector of segmentation 1 (for example, Figure 6 At the same time, the service server can determine the word position vector of the word segment 1 in the text information 6a through the text sub-model M2 (for example, Figure 6 The position vector 1 shown in the figure), at this time, the main business model M1 can perform vector concatenation processing on the word vector 1 and the position vector 1 to use the concatenated vector as the word segmentation mapping vector of the word segmentation 1 (for example, Figure 6 Vector E1 shown).

[0194] Similarly, when each of the L segmented words is used as a key text segmented word, the segmented word mapping vector of each segmented word is obtained. Figure 6 As shown, the word segmentation mapping vector of word segmentation 2 can be Figure 6 The vector E2 shown, the word segmentation mapping vector of word segmentation 3 can be Figure 6 The vector E3 shown, and the word segmentation mapping vector of the word L can be Figure 6 The vector EL shown.

[0195] Further, such as Figure 6 As shown, after obtaining the word segmentation mapping vector of each word segmentation, the business service device can Figure 6 The K feature encoding layers shown perform correlation encoding on these word segmentation mapping vectors to encode the mapping update vector of each word segmentation. Figure 6 As shown, the mapping update vector of word segmentation 1 can be Figure 6 The mapping update vector of the vector C1 shown in the figure and word segmentation 2 can be Figure 6 The vector C2 shown, the mapping update vector of word segmentation 3 can be Figure 6 The vector C3 shown, and the mapping update vector of the word segment L can be Figure 6 The vector CL shown. Further, the business server can update the vector based on the mapping of each word segment to determine Figure 6 The text mapping vector of the text word segmentation in the text information 6a (i.e., the associated text information) shown in FIG. Figure 6The classifier in the text classification layer shown in the figure quickly determines the text classification group to which the user U1 (i.e., the target business object) belongs. Specifically, the classifier in the text classification layer can use the sample classification group to which the corresponding sample text vector belongs as the text classification group to which the target business object associated with the text mapping vector belongs based on the vector similarity between the text mapping vector and the sample text vector in the text sub-model.

[0196] It can be understood that, for any one of the K feature coding layers (for example, Figure 6 For the first feature encoding layer shown in Figure 6 Select a word from the L words shown as the key text word (for example, Figure 6 As shown in the segmentation 1), each of the L segmentations can be used as an associated text segmentation to further determine the key text segmentation (for example, Figure 6 The correlation between the segmentation 1) shown in the figure and each associated text segmentation in the text information 6a is used to implement the key text segmentation (for example, Figure 6 Re-encoding of the segmentation 1) shown.

[0197] Specifically, the first feature coding layer can be used to perform vector multiplication processing on the segmentation mapping vector of the key text segmentation and the segmentation mapping vector of the associated text segmentation, and then a vector multiplication result indicating the segmentation relevance between the key text segmentation and the associated text segmentation can be obtained; further, the first feature coding layer can perform weighted summation processing on the segmentation mapping vector of each segmentation based on the segmentation relevance indicated by the vector multiplication result to obtain a re-encoded vector of the key text segmentation. It should be understood that the re-encoded vector of the key text segmentation output by the first feature coding layer can be further used as a new hierarchical mapping vector and given to the second feature coding layer, so that the second feature coding layer can obtain a new re-encoded vector according to the relevance encoding method of the re-encoded vector obtained above, until each of the K feature coding layers is relevance encoded, and the latest re-encoded vector can be used as the mapping update vector of the key text segmentation. For example, after the segmentation mapping vector of the above-mentioned layer 1 is relevance encoded K times by the K feature coding layers, the mapping update vector of the above-mentioned layer 1 obtained can be the above-mentioned vector C1.

[0198] In other words, in the embodiment of the present application, the text sub-model can be specifically formed by stacking multiple layers of transformer encoder modules (i.e., encoding modules), that is, a layer of transformer encoder modules is Figure 6A feature coding layer shown. It should be understood that in the embodiment of the present application, each layer of the encoder module is composed of a multi-head attention layer (i.e., muti-head-attention) and a forward feedback layer (i.e., feed-forword). In the text sub-model M2, a maximum of 24 feature coding layers can be included. At this time, each feature coding layer can have 16 attentions (i.e., 16 attention layers). Optionally, in the text sub-model M2, at least 12 feature coding layers can be included, and each feature coding layer can have 12 attentions (i.e., 12 attention layers). For ease of understanding, the text sub-model M2 is taken as an example to include 12 feature coding layers. In this way, for each attention in these attention layers (i.e., 12 attentions) in each layer of feature coding layer, the target word (i.e., key text participle) can be re-encoded through the relevance of the target word (i.e., key text participle) to all the words in the sentence (i.e., the above-mentioned associated text participles).

[0199] The calculation of each attention may specifically include the following steps: first, the correlation between words may be calculated; second, the calculated correlation may be normalized; and finally, the encoding of the target word may be obtained by weighted summing the normalized correlation and the encoding of all words.

[0200] It should be understood that when calculating the relevance between words through attention, the three weight matrices of the attention can first be used to perform a linear transformation on the input sequence vector (for example, a 512*768-dimensional word segmentation mapping vector) to generate three new sequence vectors of query, key and value respectively. Then, the query vector of each word can be multiplied by the key vectors of all words in the sequence to obtain the relevance between words, and then this relevance is normalized through softmax. Finally, the normalized relevance can be used as a weight and weighted summed with the value to obtain a new encoding of each word (that is, the above-mentioned re-encoded vector).

[0201] It should be understood that in the embodiment of the present application, the specific process of the business service device determining the text mapping vector of the text segmentation in the associated text information based on the segmentation mapping vector of each segmentation can be described as: the business service device can select a segmentation from L segmentations as a key text segmentation, and use each of the L segmentations as an associated text segmentation; further, the business service device can perform vector multiplication processing on the segmentation mapping vector of the key text segmentation and the segmentation mapping vector of the associated text segmentation to obtain a vector multiplication result indicating the segmentation relevance between the key text segmentation and the associated text segmentation; further, the business service device can perform weighted summation processing on the segmentation mapping vector of each segmentation based on the segmentation relevance indicated by the vector multiplication result to obtain a mapping update vector of the key text segmentation; further, the business service device can obtain a mapping update vector for each segmentation when each of the L segmentations is used as a key text segmentation, and use the mapping update vector of each segmentation as the text mapping vector of the text segmentation in the associated text information.

[0202] Step S104, when the data processing result of the transaction indicator data associated with the transaction behavior data is obtained, the data processing result, the abnormal behavior classification group and the text classification group are input into the business main model of the target training model, and the business main model determines the confidence that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group, and when the abnormal behavior type corresponding to the maximum confidence in the confidence is determined as the target abnormal behavior type, the business main model outputs the confidence of the target abnormal behavior type;

[0203] Among them, the transaction behavior data is determined based on the business transactions that have been executed by the target business object within the target business time period obtained from the distributed data storage system; the transaction details information of the business transaction includes the target interaction parameter information associated with the target business object; at this time, the business service device can use the transaction transfer quantity obtained from the target transaction parameter information as the transaction indicator data of the target business object within the target business time period, and perform transaction accumulation processing on the transaction indicator data of the target business object within the target business time period to obtain the transaction accumulation data associated with the target business object, and use the transaction accumulation data as the data processing result of the transaction data associated with the transaction behavior data; further, the business server can use the data processing results, abnormal behavior classification groups and text classification groups as the model of the business main model in the target training model type input variables, and the gradient parameters of the model input variables can be determined by the business main model; further, the business service device can sample the key variables for feature binding from the model input variables based on the gradient parameters of the model input variables and the variable sampling strategy in the business main model; the number of variables of the key variables is less than the number of variables of the model input variables; further, the business server can perform feature conversion on the key variables to obtain variable conversion features of the key variables, perform feature binding on the variable conversion features to obtain binding features of the key variables, and based on the binding features, output the confidence level of determining that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group, and then when the abnormal behavior type corresponding to the maximum confidence level in the confidence level is determined as the target abnormal behavior type, the confidence level of the target abnormal behavior type can be output by the business main model.

[0204] For further understanding, please refer to Figure 7 , Figure 7 is a schematic diagram of a scenario in which the confidence level of a target abnormal behavior type is output through a business master model provided by an embodiment of the present application. It should be understood that the business master model here can be Figure 7 In the embodiment of the present application, after the business service device 70a obtains the business data 7a associated with the user U1 (i.e., the target business object) from the distributed data storage system, it can further obtain the transaction indicator data associated with the transaction behavior data of the user U1 from the business data 7a (for example, the transfer amount of each business transaction mentioned above), and then can obtain the transaction indicator data associated with the transaction behavior data of the user U1 from the business data 7a. Figure 7 The indicator calculation component shown performs indicator calculation on the currently acquired transaction indicator data (for example, accumulates the transfer amount), and then the calculated indicator calculation result (for example, the total transaction transfer amount obtained by accumulating the amount) can be used as Figure 7 The data processing results shown are input into the business main model M3. Figure 7As shown, the business service device 70a can also input the abnormal behavior classification group output by the node sub-model M1 based on the transaction behavior data 72a and the text classification group output by the text sub-model M2 based on the associated text information 73a into the business main model M3 when inputting the data processing result into the business main model M3, so as to output the confidence 7b that the user U1 belongs to the target abnormal behavior type in the abnormal behavior classification group through the business main model M3.

[0205] Among them, it can be understood that the specific implementation method of the node sub-model M1 outputting the abnormal behavior classification group based on the transaction behavior data 72a can refer to the description of the specific process of outputting the abnormal behavior classification group through the node sub-model in the above step S102, which will not be repeated here. Similarly, the specific implementation method of the text sub-model M2 outputting the text classification group based on the associated text information 73a can refer to the description of the specific process of outputting the text classification group through the text sub-model in the above step S103, which will not be repeated here.

[0206] like Figure 7 The business master model M3 shown may include Figure 7 The one-sided gradient sampling layer and the mutually exclusive feature binding layer shown. The one-sided gradient sampling layer refers to the variable sampling strategy indicated by the business service device 70a through one-sided gradient sampling (i.e., GOSS, Gradient-based One-Side Sampling) to fundamentally reduce the number of model input variables currently input into the business main model M3, and then, while ensuring the sampling ratio, the gradient parameters of these model input variables that meet the sampling ratio can be used as much as possible to accurately screen out the key variables for feature binding from a large number of model input variables.

[0207] It should be understood that in the embodiment of the present application, the variable sampling strategy in the business main model includes a gradient parameter threshold for variable selection, and a first variable extraction parameter and a second variable extraction parameter for maintaining the variable sampling ratio; at this time, the business service device obtains the key variables for feature binding from the model input variables based on the gradient parameters of the model input variables and the variable sampling strategy in the business main model. The specific process can be described as: the business service device can select model input variables whose gradient parameters reach the gradient parameter threshold from the model input variables, and then can use the selected model input variables whose gradient parameters reach the gradient parameter threshold as the first target input variable.

[0208] It should be understood that the first target input variable here refers to the input variable with a larger gradient that is roughly screened out from the model input variables. It should be understood that according to the definition of calculating information gain, the input variable (i.e., instance) with a large gradient parameter will have a greater impact on the calculation of information gain. Therefore, in the process of downsampling through the unilateral gradient sampling layer, we can retain these input variables with large gradient parameters as much as possible (for example, we can extract the input variables that match the first variable extraction parameter (e.g., a%, a=85) from these input variables with large gradient parameters, i.e., the first target input variables, as the first key variables). Further, in the embodiment of the present application, among all the model input variables of the input business main model M3, some input variables with smaller gradient parameters remaining except the first target input variables can be used as the second target input variables, and then some input variables with smaller gradient parameters (i.e., instances) can be further randomly removed from the second target input variables (input variables with smaller gradient parameters). For example, the input variables that match the second variable extraction parameter (e.g., b%, b=5) can be extracted from the second target input variables as the second key variables, so that more input variables with larger gradient parameters can be sampled while ensuring that the sampling rate (i.e., the above-mentioned 85%) remains unchanged.

[0209] In other words, the business service device involved in the embodiment of the present application can sample the first target input variable from the first target input variable to obtain the first target input variable that matches the first variable extraction parameter, and can use the sampled first target input variable that matches the first variable extraction parameter as the first key variable; further, the business service device can use the model input variables between the model input variables except the first target input variable as the second target input variable, and can sample the second target input variable that matches the second variable extraction parameter from the second target input variable, and then can use the sampled second target input variable that matches the second variable extraction parameter as the second key variable; further, the business service device can use the first key variable and the second key variable as key variables for feature binding.

[0210] It should be understood that Figure 7The mutually exclusive feature binding layer shown can be used to implement mutually exclusive feature binding (i.e., Exclusive Feature Bundling, EFB). It should be understood that for each key variable sampled by the above-mentioned unilateral gradient sampling layer, considering the mutual exclusivity between the variable features of each key variable (i.e., the variable features of each key variable rarely have non-zero values ​​at the same time), therefore, the mutually exclusive feature binding layer can be used to perform feature binding on these variable features in the sparse feature space, and then the binding features obtained by the feature binding can be used to determine the confidence that the user U1 (i.e., the target business object) belongs to each abnormal behavior type in the abnormal behavior classification group.

[0211] For example, if the number of abnormal behavior classification types in the abnormal behavior classification group is 7, the business main model can predict the confidence level of each abnormal behavior type among the 7 abnormal behavior types that the user U1 belongs to.

[0212] For ease of understanding, here we take the variable features of three key variables as an example to explain the specific process of feature binding. For example, suppose the three key variables with a feature dimension of 1*5 are key variable 1 (i.e., vector (00003)), key variable 2 (i.e., vector (20000)), and key variable 3 (i.e., vector (00010)). At this time, through Figure 7 The mutually exclusive feature binding layer shown can merge the vector features on the same vector feature dimension. For example, the vector features of the three key variables on the first vector feature dimension can be merged to obtain the merged vector feature 2 of the three key variables on the first vector feature dimension. Similarly, with this type, the merged vector feature 0 of the three key variables on the second vector feature dimension can be merged, the merged vector feature 0 of the three key variables on the third vector feature dimension can be merged, the merged vector feature 1 of the three key variables on the fourth vector feature dimension can be merged, and the merged vector feature 3 of the three key variables on the fifth vector feature dimension can be merged. In other words, at this time, the binding feature obtained by splicing the merged vector features of the three key variables on each vector feature dimension can be a vector (20013).

[0213] In this way, the business service device 70a can determine the abnormal behavior type corresponding to the maximum confidence level among these confidence levels as the target abnormal behavior type, and Figure 7 The business master model M3 shown outputs the confidence that the user U1 belongs to the target abnormal behavior type in the abnormal behavior classification group (for example, Figure 7 The confidence level 7b) is shown so that step S105 can be further performed subsequently.

[0214] Step S105: determining the risk level of the target business object when the object classification type is the target abnormal behavior type based on the confidence level of the target abnormal behavior type.

[0215] Specifically, the business service device can obtain the conversion fitting parameters for confidence conversion, and can obtain the assessment impact for risk assessment of the target abnormal behavior type based on the conversion fitting parameters and the confidence of the target abnormal behavior type; further, the business service device can use the impact level of the assessment impact as the risk level when the object classification type of the target business object is the target abnormal behavior type.

[0216] For example, in the embodiment of the present application, the business service device can convert the confidence p0 into a score within the scoring range of 0-1000 based on the model prediction result obtained by the subclassification of the business master model (i.e., the probability when the object classification type of the target business object is the target abnormal behavior type, which can also be called confidence) through the weight conversion formula (e.g., score = A + B * ln (p0 / 1-p0)), and then the converted score can be used to more accurately and effectively distinguish users at different risk levels. Among them, parameters A and B are the conversion fitting parameters involved in the embodiment of the present application.

[0217] It should be understood that in the above-mentioned risk analysis system, after determining the risk levels of the target business objects that need to be evaluated, risk control can be performed on these target business objects based on their risk levels. For example, the payment behaviors of these target business objects can be reasonably regulated in various business scenarios involved in the above-mentioned payment finance field to achieve payment optimization of the payment behaviors of these target business objects.

[0218] It can be seen from this that the embodiment of the present application can make full use of the transaction behavior data of the above-mentioned target business object within a period of time in the model application stage of the currently trained target training model to determine the transaction business scenarios of the target business object within this period of time, and then construct a node relationship topology map of the user based on the determined transaction business scenarios, so that the node relationship topology map can be given to the node sub-model in the currently trained target training model to determine the node mapping vectors of these business nodes in the node relationship topology map, and then, the node sub-model can roughly classify and output the abnormal behavior group (i.e., the aforementioned abnormal behavior classification group) to which the user belongs based on the determined node mapping vector, which means that at this time, the abnormal behavior group (i.e., the aforementioned abnormal behavior classification group) is the behavior classification result of the node sub-model. In addition, to ensure the accuracy of risk level determination, the present application can also combine the indicator calculation results (i.e., the aforementioned data processing results) calculated based on the transaction indicator data, and the text classification results (i.e., the aforementioned text classification group) output by the text sub-model, and other multi-party input information, to accurately classify the probability (i.e., confidence) of each abnormal sub-classification (i.e., each abnormal behavior type) of the target business object belonging to the current abnormal behavior classification group, and then the abnormal sub-classification with the maximum probability can be used as the target sub-classification (i.e., the target abnormal behavior type), so that the target training model can output the probability of the target sub-classification (i.e., the target abnormal behavior type) to finally determine the risk level when the object classification type of the target business object is the target sub-classification (i.e., the target abnormal behavior type). In other words, by adopting the embodiment of the present application, the problem of subjective limitations caused by the current reliance on expert experience can be solved from the root, so that the accuracy of the level determination can be improved by inputting the multi-party input information of the business main model in the process of determining the risk level.

[0219] For further understanding, please refer to Figure 8 , Figure 8 is a flowchart of a transaction data processing method provided, the method can be executed by a business service device, and the business service device here can be the above Figure 2 The business service device 2b in the corresponding embodiment. The transaction data processing method may at least include the following steps S201-S219. The specific process of steps S201-S214 is mainly used to describe how to perform model training on the initial training model to be trained, so that the object classification type of a current user (i.e., the above-mentioned target business object) can be quickly and accurately predicted through the target training model obtained by training.

[0220] Step S201, when sample behavior data of a sample business object is obtained, a sample business scenario associated with the sample behavior data is determined, and a sample relationship topology graph associated with the sample business object is constructed based on the sample business scenario; the sample relationship topology graph includes N sample nodes, and one sample node is determined by one sample business scenario; N is a positive integer greater than 1;

[0221] Step S202, when the initial training model to be trained is obtained, the node sub-model in the initial training model is used as the initial node sub-model, and based on the sample abnormal behavior label information associated with the sample business object, a sample abnormal group associated with the sample business object for training the initial node sub-model is constructed;

[0222] Step S203, inputting the sample relationship topology graph into the initial node sub-model, determining the sample mapping vector of each sample node among the N sample nodes by the initial node sub-model, and predicting the predicted behavior classification group to which the target business object belongs based on the sample mapping vector of each sample node;

[0223] Step S204, based on the predicted behavior classification group and the sample abnormality grouping, sub-model training is performed on the initial node sub-model, and the initial node sub-model after sub-model training is used as the target node sub-model.

[0224] It should be understood that steps S201 to S204 are the specific process of performing sub-model training on the node sub-model (i.e., the initial node sub-model) in the currently acquired initial training model during the model training phase. That is, the embodiment of the present application can construct a node relationship topology graph of each sample business object among these sample business objects by using sample behavior data of a large number of sample business objects acquired from a distributed data storage system.

[0225] To facilitate distinction, the embodiment of the present application collectively refers to the node relationship topology diagram of each sample business object obtained in the model training stage as a sample relationship topology diagram, and then the initial node sub-model can be trained through these constructed sample relationship topology diagrams, so as to accurately determine the abnormal behavior classification groups of the currently acquired sample business objects through the trained initial node sub-model (i.e., the target node sub-model).

[0226] For further understanding, please refer to Fig. 9 , Fig. 9 The present invention provides a schematic diagram of a scenario for training a node sub-model in an initial training model. Fig. 9 The distributed data storage system shown can be Figure 2 The distributed data storage system 2a in the corresponding embodiment.

[0227] It should be understood that the distributed data storage system involved in the embodiments of the present application can be used to store the business data of a large number of customers (i.e., a large number of users) authorized to be uploaded by business terminals in different business scenarios. It should be understood that the distributed data storage system here may specifically include a central service device corresponding to a central database for persistent data storage (for example, the above-mentioned Figure 2 The central server 101a) shown in the figure and the data storage nodes in the distributed database for data caching, for example, the data storage nodes here can be used to cache the business data of some users authorized to upload within the past D (for example, 2 days).

[0228] It should be understood that in order to ensure the cache pressure of these data cache nodes in the distributed data storage system, the embodiment of the present application can also, when the node cache space of the data cache node reaches the node cache threshold, perform a cache operation on the data cache node (for example, the above-mentioned Figure 2 For ease of understanding, the data cache node whose node cache space reaches the node cache threshold is taken as the above-mentioned Figure 2 Taking the data storage device 100b shown as an example, some business data that has been historically cached in the data storage device 100b for a long time (for example, the cache time reaches a cache time threshold, such as 1 week) can be removed. In this way, when a new user needs to store his or her business data within the past 2 days, a new round of data caching can be performed through the data storage device 100b after space clearing.

[0229] It should be understood that before the data storage device 100b performs space cleaning, the business data that needs to be cleared and has a long cache time (for example, the cache time reaches the cache time threshold, for example, 1 week) can be persistently stored in the central service device, so that the business data of a large number of users obtained from the central service device of the distributed data storage system can be collectively referred to as sample business data of sample business objects used to train the current version of the network model (i.e., the initial training model). The sample business objects here can include multiple users, and the multiple users here can specifically include Fig. 9 Shown are user U0, user U1, ..., user Un.

[0230] It can be noted that the sample business data here may specifically include the initial node sub-model to be participated in (for example, Fig. 9 The node sub-model M1′ shown in FIG. 1 is used to perform model training on the sample behavior data, and the initial text sub-model (eg, Fig. 9The sample text information of the text sub-model M2′ shown in the figure for model training, and the sample text information to be used for the initial business main model (for example, Fig. 9 The business main model M3') shown is the sample indicator data for model training.

[0231] Specifically, Fig. 9 The sample business data of the sample business objects shown may specifically include sample business data 91a of user U0, sample business data 91b of user U1, ..., sample business data 91n of user Un. It should be understood that in the embodiment of the present application, when the business service device obtains the sample business data of these sample business objects, it can further execute step S91 to construct a sample relationship topology map of these sample business objects based on the sample behavior data of these sample business objects, and then execute step S92 to input the sample relationship topology map into the node sub-model M1' (i.e., the initial node sub-model) to be trained, so that the node sub-model M1' (i.e., the initial node sub-model) can be trained as a sub-model (also referred to as model training) through step S93, and the node sub-model M1' obtained after the sub-model training can be referred to as the currently trained target node sub-model (i.e., Fig. 9 The node sub-model M1 shown in FIG. 1 is a node sub-model M2 shown in FIG. 1 . It should be understood that the specific construction process of the sample relationship topology diagram of the sample business objects constructed by the business service device in the node sub-model training phase can be referred to in the above Figure 3 The description of the specific process of constructing the node relationship topology diagram in the corresponding embodiment will not be repeated here.

[0232] Furthermore, the business service device can also use the currently trained target node sub-model (i.e. Fig. 9 The node sub-model M1 shown executes Fig. 9 Step S94 shown in the figure, then the target node sub-model (i.e. Fig. 9 The predicted behavior classification group (i.e., the predicted behavior rough classification result) output by the node sub-model M1) is given as an input variable to Fig. 9 The business main model M3' to be trained is shown. It should be understood that in the model training node of the node sub-model, the business service device predicts and outputs the prediction behavior classification group through the node sub-model M1', which can be seen in the above Figure 3 The description of the specific process of outputting abnormal behavior classification groups through the currently trained node sub-model (i.e., the target node sub-model) in the corresponding embodiment will not be repeated here.

[0233] It should be understood that in the embodiments of the present application, in order to facilitate distinction, during the model training stage of the node sub-model, the abnormal behavior classification groups predicted and output by the initial node sub-model can be collectively referred to as predicted behavior classification groups. Furthermore, during the model training stage of the node sub-model, the predicted behavior classification groups of these sample business objects predicted by the node sub-model M1' can be combined with the sample abnormality groups of the corresponding sample prediction objects currently labeled to calculate the grouping loss function between the predicted behavior classification group and the sample abnormality group of each sample prediction object. It should be understood that the embodiments of the present application can determine the node loss function of the initial node sub-model by calculating the grouping loss function between the predicted behavior classification group and the sample abnormal grouping of these sample prediction objects, so that the initial node sub-model can be trained (i.e., the above-mentioned sub-model training) through the node loss function of the initial node sub-model, until the node loss function of the initial node sub-model reaches the node loss function threshold, it is determined that the initial node sub-model meets the model convergence condition, and then the initial node sub-model that meets the model convergence condition can be called the initial node sub-model after sub-model training, so that the initial node sub-model that meets the model convergence condition can be used as the trained initial node sub-model (i.e., the above-mentioned target node sub-model), so that the following step S209 can be further executed.

[0234] Step S205, using the text sub-model in the initial training model as the initial text sub-model;

[0235] Step S206, when sample text information associated with the sample behavior data is obtained, text label information of the sample text information is determined as sample text label information associated with the sample business object, and sample text groups for training the initial text sub-model are constructed based on the sample text label information;

[0236] Step S207, inputting the sample text information into the initial text sub-model, determining the sample text mapping vector of the text segmentation in the sample text information by the initial text sub-model, and predicting the predicted text classification group to which the sample business object belongs based on the sample text mapping vector;

[0237] Step S208, based on the predicted text classification group and the sample text classification group, sub-model training is performed on the initial text sub-model, and the initial text sub-model after sub-model training is used as the target text sub-model.

[0238] It should be understood that the above steps S205 to S208 describe how to perform model training on the text sub-model in the initial training model during the model training phase of the initial training model. Fig. 9As shown, when the business service device obtains the sample text information of these sample business objects, it can further execute step S95 to input the sample text information into the text sub-model M2' (i.e., the initial text sub-model) to be trained, so that through step S96, the text sub-model M2' (i.e., the initial text sub-model) can be subjected to sub-model training (also referred to as model training), and the text sub-model M2' (i.e., the initial text sub-model) obtained after the sub-model training can be referred to as the currently trained target text sub-model (i.e., Fig. 9 The text sub-model M2 shown).

[0239] Furthermore, the business service device can also use the currently trained target text sub-model (i.e. Fig. 9 The text sub-model M2 shown executes Fig. 9 Step S97 shown in the figure can then be composed of the target text sub-model (i.e. Fig. 9 The predicted text classification group (i.e., the predicted text classification result) output by the text sub-model M2) shown in FIG. 1 is used as another input variable to Fig. 9 The main business model M3' to be trained is shown.

[0240] It should be understood that in the embodiments of the present application, in order to facilitate distinction, the embodiments of the present application may, during the model training stage of the text sub-model, collectively refer to the text classification groups predicted and output by the initial text sub-model as predicted text classification groups, and further, during the model training stage of the text sub-model, the predicted text classification groups of these sample business objects predicted by the text sub-model M2' may be combined with the sample text classification groups of the corresponding sample prediction objects currently annotated to calculate the grouping loss function between the predicted text classification group and the sample text classification group of each sample prediction object. It should be understood that the embodiments of the present application can determine the text loss function of the initial text sub-model by calculating the grouping loss function between the predicted text classification group and the sample text classification group of these sample prediction objects, so that the initial text sub-model can be trained (i.e., the above-mentioned sub-model training) through the text loss function of the initial text sub-model, until the text loss function of the initial text sub-model reaches the text loss function threshold, it is determined that the initial text sub-model meets the model convergence condition, and then the initial text sub-model that meets the model convergence condition can be called the initial text sub-model after sub-model training, so that the initial text sub-model that meets the model convergence condition can be used as the trained initial text sub-model (i.e., the above-mentioned target text sub-model), so that the following step S209 can be further executed later.

[0241] Step S209, when the business main model in the initial training model is used as the initial business main model, the sample abnormal behavior label information in the sample abnormal group in the target node sub-model is used as the sample abnormal behavior type label of the sample abnormal behavior type associated with the sample business object;

[0242] Step S210, using the predicted behavior classification group predicted and output by the target node sub-model for the sample business object as the first sample input variable for training the initial business main model, and using the predicted text classification group predicted and output by the target text sub-model for the sample business object as the second sample input variable for training the initial business main model;

[0243] Step S211, when a sample processing result of sample indicator data associated with sample behavior data is obtained, the sample behavior processing result is used as a third sample input variable for training an initial business main model;

[0244] Step S212, inputting the first sample input variable, the second sample input variable and the third sample input variable into the initial business main model, the initial business main model determines the confidence that the sample business object belongs to the predicted abnormal behavior type in the predicted behavior classification group, and when the predicted abnormal behavior type corresponding to the maximum confidence in the confidence is determined as the target predicted abnormal behavior type, the initial business main model outputs the predicted abnormal behavior type label corresponding to the target predicted abnormal behavior type;

[0245] Step S213, based on the predicted abnormal behavior type label and the sample abnormal behavior type label, the initial business main model is trained as the target business main model;

[0246] like Fig. 9 As shown, when the business service device obtains the sample processing result of the sample indicator data through step S98, it can further input the sample processing result as an input variable into Fig. 9 The business main model M3' (i.e., the initial business main model) shown in FIG. 1 can then be subjected to main model training (also referred to as model training) on ​​the business main model M3' (i.e., the initial business main model) through step S99, and the business main model M3' (i.e., the initial business main model) obtained after the main model training can be referred to as the currently trained target business main model (i.e., Fig. 9 Business main model M3 shown).

[0247] It should be understood that in the embodiments of the present application, in order to facilitate distinction, the embodiments of the present application may, during the model training stage of the business main model, collectively refer to the target abnormal behavior types predicted and output by the initial business main model as target predicted abnormal behavior types, and then, during the model training stage of the business main model, the predicted abnormal behavior type labels corresponding to these target predicted abnormal behavior types predicted by the business main model M3' and the currently labeled sample abnormal behavior type labels may be used to calculate the classification loss function between each predicted abnormal behavior type label and the sample abnormal behavior type label. It should be understood that the embodiments of the present application can determine the main loss function of the initial business main model by calculating the classification loss function between the predicted abnormal behavior type labels and the sample abnormal behavior type labels of these sample prediction objects, so that the initial text sub-model can be trained (i.e., the above-mentioned main model training) through the main loss function of the initial business main model, until the main loss function of the initial business main model reaches the main loss function threshold, it is determined that the initial business main model meets the model convergence condition, and then the initial business main model that meets the model convergence condition can be called the initial business main model after sub-model training, so that the initial business main model that meets the model convergence condition can be used as the trained initial business main model (i.e., the above-mentioned target business main model).

[0248] Step S214, using the target node sub-model as the node sub-model of the target training model, using the target text sub-model as the text sub-model of the target training model, and using the target business main model as the business main model of the target training model, constructing the target training model based on the node sub-model of the target training model, the text sub-model of the target training model and the business main model of the target training model.

[0249] Step S215, when the transaction behavior data of the target business object is obtained, the transaction business scenario associated with the transaction behavior data is determined, and a node relationship topology diagram associated with the target business object is constructed based on the transaction business scenario; the node relationship topology diagram includes N business nodes, and one business node is determined by one transaction business scenario; N is a positive integer greater than 1;

[0250] Step S216, when the target training model for predicting the object classification type of the target business object is obtained, the node relationship topology diagram is input into the node sub-model of the target training model, the node sub-model determines the node mapping vector of each business node in the N business nodes, and based on the node mapping vector of each business node, outputs the abnormal behavior classification group to which the target business object belongs;

[0251] Step S217, when the associated text information associated with the transaction behavior data is obtained, the associated text information is input into the text sub-model of the target training model, the text sub-model determines the text mapping vector of the text segmentation in the associated text information, and determines the text classification group to which the target business object belongs based on the text mapping vector;

[0252] Step S218, when the data processing result of the transaction indicator data associated with the transaction behavior data is obtained, the data processing result, the abnormal behavior classification group and the text classification group are input into the business main model of the target training model, and the business main model determines the confidence that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group, and when the abnormal behavior type corresponding to the maximum confidence in the confidence is determined as the target abnormal behavior type, the business main model outputs the confidence of the target abnormal behavior type;

[0253] Step S219: determining the risk level when the object classification type of the target business object is the target abnormal behavior type based on the confidence level of the target abnormal behavior type.

[0254] Among them, steps S215 to S219 are the model application process of the currently trained target training model, and the specific implementation of steps S215 to S219 can be referred to above. Figure 3 The description of the specific process of step S101 to step S105 in the corresponding embodiment will not be repeated here.

[0255] It can be seen that the embodiment of the present application can perform model training on the currently acquired initial training model before applying the target training model, and then the initial training model after model training can be used as the target training model to predict the object classification type of a certain user through the target prediction model. For example, the object classification type here can specifically be a target abnormal behavior type determined from one or more abnormal behavior types included in the above-mentioned abnormal behavior classification group. It can be understood that in the model training stage of the initial training model, it can roughly include sub-model training of a sub-model (for example, a node sub-model) in the initial training model and sub-model training of another sub-model (for example, a text sub-model) in the initial training model. Then, after completing the model training of these two sub-models, the predicted behavior classification result (i.e., the above-mentioned predicted behavior classification group) output by the target node sub-model obtained after sub-model training of the sub-model (for example, the node sub-model) and the output of the target text sub-model obtained after sub-model training of another sub-model (for example, the text sub-model) can be comprehensively utilized. The predicted text classification results (i.e. the above-mentioned predicted text classification group) and the sample processing results obtained after the indicator calculation of the sample indicator data associated with the above-mentioned sample behavior data are used to perform main model training on the business main model in the initial training model (i.e. the above-mentioned initial business main model) to train the above-mentioned target business main model for accurately predicting that the output sample business object belongs to the target predicted abnormal behavior type in the predicted behavior classification group, and then the currently trained target business main model, target node sub-model and target text sub-model can be used as the target training model for subsequently predicting the object classification type of a certain user (i.e. the target business object). This means that after completing the model training of the initial training model through the above-mentioned sample business data (for example, sample behavior data, sample text information and sample indicator data), the trained initial training model can be further used as the target training model, and then in the model application stage of the currently trained target training model, the transaction behavior data of the above-mentioned target business object within a period of time can be fully utilized to determine the transaction business scenarios of the target business object within this period of time, and then the node relationship topology map of the user can be constructed based on the determined transaction business scenarios, so that the node relationship topology map can be given to the node sub-model in the currently trained target training model to determine the node mapping vectors of these business nodes in the node relationship topology map, and then, the node sub-model can roughly classify and output the abnormal behavior group (that is, the aforementioned abnormal behavior classification group) to which the user belongs based on the determined node mapping vector, which means that at this time, the abnormal behavior group (that is, the aforementioned abnormal behavior classification group) is the behavior classification result of the node sub-model.In addition, to ensure the accuracy of risk level determination, the present application can also, when the behavior classification results of the node sub-model are obtained by coarse classification (i.e., a specific abnormal behavior classification group), simultaneously combine the indicator calculation results calculated based on the transaction indicator data (i.e., the aforementioned data processing results), and the text classification results (i.e., the aforementioned text classification group) output by the text sub-model through coarse classification, and other multiple input information to accurately classify the probability (i.e., confidence) that the target business object belongs to each abnormal sub-classification (i.e., each abnormal behavior type) in the current abnormal behavior classification group, and then the abnormal sub-classification with the largest probability can be used as the target sub-classification (i.e., the target abnormal behavior type), so that the probability of the target sub-classification (i.e., the target abnormal behavior type) output by the target training model can be used to finally determine the risk level of the target business object when its object classification type is the target sub-classification (i.e., the target abnormal behavior type). In other words, the embodiment of the present application uses the latest sample business data to train the initial training model, which can ensure that the target training model obtained by the latest training can identify various types of abnormal behavior types as accurately as possible. In this way, it can not only solve the problem of subjective limitations caused by the current reliance on expert experience from the root, but also in the process of determining the risk level, by inputting multi-party input information of the business main model (that is, the above-mentioned target business main model) in the trained target training model, to improve the accuracy of the level determination.

[0256] For further information, see Fig.10 , Fig.10 1 is a schematic diagram of the structure of a transaction data processing device provided in an embodiment of the present application. The transaction data processing device may be a computer program (including program code) running in a computer device, for example, the business data processing device is an application software; the transaction data processing device may be used to execute Figure 3 or Figure 8 As shown in the method. Fig.10 As shown, the transaction data processing device 1 may include: a topology map construction module 11, a behavior group determination module 12, a text group determination module 13, a confidence output module 14 and a risk level determination module 15;

[0257] The topology map construction module 11 is used to determine the transaction business scenario associated with the transaction behavior data when the transaction behavior data of the target business object is obtained, and to construct a node relationship topology map associated with the target business object based on the transaction business scenario; the node relationship topology map includes N business nodes, and one business node is determined by one transaction business scenario; N is a positive integer greater than 1;

[0258] The behavior group determination module 12 is used to input the node relationship topology diagram into the node sub-model of the target training model when the target training model for predicting the object classification type of the target business object is obtained, determine the node mapping vector of each business node in the N business nodes by the node sub-model, and output the abnormal behavior classification group to which the target business object belongs based on the node mapping vector of each business node;

[0259] A text group determination module 13 is used to input the associated text information into the text sub-model of the target training model when the associated text information associated with the transaction behavior data is obtained, determine the text mapping vector of the text segmentation in the associated text information by the text sub-model, and determine the text classification group to which the target business object belongs based on the text mapping vector;

[0260] The confidence output module 14 is used to input the data processing result, the abnormal behavior classification group and the text classification group into the business main model of the target training model when the data processing result of the transaction indicator data associated with the transaction behavior data is obtained, and the business main model determines the confidence that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group, and when the abnormal behavior type corresponding to the maximum confidence in the confidence is determined as the target abnormal behavior type, the business main model outputs the confidence of the target abnormal behavior type;

[0261] The risk level determination module 15 is used to determine the risk level when the object classification type of the target business object is the target abnormal behavior type based on the confidence level of the target abnormal behavior type.

[0262] The specific implementation methods of the topology map construction module 11, the behavior group determination module 12, the text group determination module 13, the confidence output module 14 and the risk level determination module 15 can be found in the above Figure 3 The description of step S101 to step S105 in the corresponding embodiment will not be repeated here.

[0263] The topology map construction module 11 includes: a data determination unit 111, a data analysis unit 112, a connection relationship determination unit 113 and a topology map construction unit 114;

[0264] The data determination unit 111 is used to obtain the business transactions executed by the target business object in the target business time period from the distributed data storage system, determine the behavior data set of the target business object in the target business time period based on the transaction details information of the business transactions, and use the behavior data in the behavior data set as the transaction behavior data of the target business object;

[0265] A data analysis unit 112 is used to perform data analysis on the transaction behavior data, determine a business interaction object having a data interaction relationship with the target business object, and determine N transaction business scenarios of the target business object within a target business time period based on the data interaction relationship between the target business object and the business interaction object;

[0266] The connection relationship determination unit 113 is used to construct N business nodes associated with the target business object based on the N transaction business scenarios, and determine the node connection relationship between the N business nodes based on the scenario association between the N transaction business scenarios; one business scenario is used to construct one business node;

[0267] The topology map construction unit 114 is used to construct a node relationship topology map associated with the target business object based on N business nodes and node connection relationships.

[0268] The specific implementation of the data determination unit 111, the data analysis unit 112, the connection relationship determination unit 113 and the topology map construction unit 114 can be found in the above Figure 3 The description of the specific process of constructing the node relationship topology diagram in the corresponding embodiment will not be repeated here.

[0269] Among them, the N business transaction scenarios include a first transaction scenario and a second transaction scenario; the first transaction scenario is different from the second transaction scenario; the data interaction relationship between the target business object and the business interaction object is determined by the first interaction parameter information and the second interaction parameter information obtained from the transaction behavior data; the first interaction parameter information is determined by the first business transaction between the target business object and the business interaction object in the first transaction scenario; the second interaction parameter information is determined by the second business transaction between the target business object and the business interaction object in the second transaction scenario; the first business transaction and the second business transaction are both transactions in the business transaction;

[0270] The connection relationship determination unit 113 is specifically configured to obtain a first transaction scenario and a second transaction scenario from N business transaction scenarios, and use the business node constructed for the first transaction business scenario as the first business node, and use the business node constructed for the second transaction business scenario as the second business node;

[0271] The connection relationship determination unit 113 is further specifically configured to obtain the transaction transfer quantity of the first business transaction from the first interaction parameter information, and obtain the transaction transfer quantity of the second business transaction from the second interaction parameter information, and accumulate the transaction transfer quantity of the first business transaction and the transaction transfer quantity of the second business transaction to obtain the accumulated transaction quantity between the target business object and the business interaction object;

[0272] The connection relationship determination unit 113 is further specifically configured to use the accumulated transaction resource quantity between the target business object and the business interaction object as the edge weight coefficient between the first business node and the second business node when determining the edge connection relationship between the first business node and the second business node based on the data interaction relationship between the target business object and the business interaction object;

[0273] The connection relationship determining unit 113 is further specifically configured to use the edge connection relationship between the first service node and the second service node and the edge weight coefficient between the first service node and the second service node as the node connection relationship between the first service node and the second service node.

[0274] The behavior group determination module 12 includes: a target model acquisition unit 121, a service node extraction unit 122, a node mapping vector determination unit 123 and a classification group output unit 124;

[0275] A target model acquisition unit 121 is used to acquire a target training model for predicting an object classification type of a target business object;

[0276] The service node extraction unit 122 is used to input the node relationship topology map into the node sub-model of the target training model, and when N service nodes are extracted from the node relationship topology map by the node sub-model, determine the node access sequence associated with the service node i among the N service nodes; i is a positive integer less than or equal to N;

[0277] A node mapping vector determining unit 123, configured to perform node vector mapping on a node access sequence associated with a service node i to obtain a node mapping vector of the service node i;

[0278] The classification group output unit 124 is used to output the abnormal behavior classification group to which the target business object belongs based on the node mapping vector of the business node i.

[0279] The specific implementation of the target model acquisition unit 121, the service node extraction unit 122, the node mapping vector determination unit 123 and the classification group output unit 124 can be found in the above Figure 3 or Figure 8 The description of the specific process of outputting abnormal behavior classification groups through the node sub-model in the corresponding embodiment will not be repeated here.

[0280] The service node extraction unit 122 is specifically used to input the node relationship topology graph into the node sub-model of the target training model, and the node sub-model extracts N service nodes from the node relationship topology graph;

[0281] The service node extraction unit 122 is further specifically used to obtain a node access policy in the node sub-model, obtain a service node i from N service nodes based on the node access policy, and obtain one or more access sequences associated with the service node i based on the node access parameters in the node access policy;

[0282] The service node extraction unit 122 is further specifically used to filter, from one or more access sequences associated with the service node i, an access sequence whose sequence length reaches a sequence length threshold indicated by the node access policy, and use the filtered access sequence as a node access sequence associated with the service node i among the N service nodes.

[0283] The classification group output unit 124 is specifically used to determine the vector distance between the node mapping vector of the service node i and the multiple sample mapping vectors in the node sub-model, and determine the vector similarity between the node mapping vector of the service node i and the multiple sample mapping vectors based on the determined vector distance;

[0284] The classification group output unit 124 is further specifically used to use the sample mapping vector with the maximum vector similarity as the target sample mapping vector in the vector similarity, determine the sample abnormal behavior label information associated with the sample node corresponding to the target sample mapping vector, determine the abnormal behavior type of the target business object when it is at the business node i based on the sample abnormal behavior label information, and determine the sample abnormal group to which the sample abnormal behavior label information belongs as the behavior type group of the abnormal behavior type when the target business object is at the business node i;

[0285] The classification group output unit 124 is further specifically configured to determine the abnormal behavior classification group to which the target business object belongs based on the behavior type grouping of the abnormal behavior type when the target business object is at the business node i.

[0286] Wherein, optionally, the node sub-model includes M sample abnormality groups; M is a positive integer greater than or equal to 2; one sample abnormality group corresponds to one group center vector; one group center vector is obtained after clustering the sample mapping vector corresponding to the sample behavior type in one sample abnormality group;

[0287] The classification group output unit 124 is specifically used to obtain a sample abnormal group j from the M sample abnormal groups as a first sample abnormal group; j is a positive integer less than M;

[0288] The classification group output unit 124 is further specifically used to determine a first vector similarity between a node mapping vector of a service node i and a group center vector of a first sample abnormal group;

[0289] The classification group output unit 124 is further specifically configured to, if the first vector similarity reaches a vector similarity threshold, use the first sample abnormal group as a behavior type group of an abnormal behavior type when the target business object is at the business node i;

[0290] The classification group output unit 124 is further specifically configured to determine the abnormal behavior classification group to which the target business object belongs based on the behavior type grouping of the abnormal behavior type when the target business object is at the business node i.

[0291] Wherein, optionally, the M sample abnormal groupings include a sample abnormal grouping k; k=j+1; k is a positive integer greater than j and less than or equal to M;

[0292] The classification group output unit 124 is further specifically configured to use the sample abnormal group k as the second sample abnormal group if the first vector similarity does not reach the vector similarity threshold; the second sample abnormal group is the next sample abnormal group of the first sample abnormal group;

[0293] The classification group output unit 124 is further specifically used to determine the second vector similarity between the node mapping vector of the service node i and the group center vector of the second sample abnormal group;

[0294] The classification group output unit 124 is further specifically configured to, if the second vector similarity reaches a vector similarity threshold, use the second sample abnormal group as a behavior type group of an abnormal behavior type when the target business object is at the business node i.

[0295] It can be understood that the classification group output unit 124 here can determine the abnormal behavior classification group to which the current object (i.e., the target business object) belongs by obtaining vector similarity through vector distance calculation. Optionally, the classification group output unit 124 here can also determine the abnormal behavior classification group to which the current object (i.e., the target business object) belongs by vector clustering calculation, and the specific implementation method of determining the abnormal behavior classification group to which the current object (i.e., the target business object) belongs will not be limited here.

[0296] The transaction behavior data is determined based on the business transactions that have been executed by the target business object within the target business time period obtained from the distributed data storage system;

[0297] The text grouping determination module 13 includes: a text information acquisition unit 131, a word segmentation processing unit 132, a word vector mapping unit 133 and a text mapping vector determination unit 134;

[0298] The text information acquisition unit 131 is used to acquire text information entered by the target business object when executing a business transaction within a target business time period from the distributed data storage system, and use the acquired text information as associated text information associated with the transaction behavior data;

[0299] The word segmentation processing unit 132 is used to input the associated text information into the text sub-model of the target training model, and the text sub-model performs word segmentation processing on the associated text information to obtain text segmentation of the associated text information; the text segmentation includes L segmentations; L is a positive integer;

[0300] A word vector mapping unit 133 is used to select a word from the L word segments as a key text word segment, perform word vector mapping on the key text word segment, and obtain a word segment mapping vector of the key text word segment, until each word in the L word segment is used as a key text word segment, and obtain a word segment mapping vector for each word segment;

[0301] The text mapping vector determining unit 134 is used to determine the text mapping vector of the text word in the associated text information based on the word mapping vector of each word, and determine the text classification group to which the target business object belongs based on the text mapping vector.

[0302] The specific implementation of the text information acquisition unit 131, the word segmentation processing unit 132, the word vector mapping unit 133 and the text mapping vector determination unit 134 can be found in the above Figure 3 or Figure 8 The description of the specific process of determining the text classification group in the corresponding embodiment will not be repeated here.

[0303] The text mapping vector determination unit 134 is specifically used to select a word from the L words as a key text word, and use each word in the L words as an associated text word;

[0304] The text mapping vector determining unit 134 is further specifically used to perform vector multiplication processing on the word segmentation mapping vector of the key text word segmentation and the word segmentation mapping vector of the associated text word segmentation to obtain a vector multiplication result indicating the word segmentation relevance between the key text word segmentation and the associated text word segmentation;

[0305] The text mapping vector determining unit 134 is further specifically configured to perform weighted summation processing on the word segmentation mapping vector of each word segmentation based on the word segmentation relevance indicated by the vector multiplication result to obtain a mapping update vector of the key text word segmentation;

[0306] The text mapping vector determination unit 134 is also specifically used to obtain a mapping update vector for each segmentation when each of the L segmentations is used as a key text segmentation, and use the mapping update vector of each segmentation as the text mapping vector of the text segmentation in the associated text information.

[0307] The transaction behavior data is determined based on the business transactions that have been executed by the target business object within the target business time period obtained from the distributed data storage system; the transaction details information of the business transaction includes the target interaction parameter information associated with the target business object;

[0308] The confidence output module 14 includes: an indicator data determination unit 141, a model input variable determination unit 142, a key variable sampling unit 143 and a feature binding unit 144;

[0309] The indicator data determining unit 141 is used to use the transaction transfer quantity obtained from the target transaction parameter information as the transaction indicator data of the target business object in the target business time period, perform transaction accumulation processing on the transaction indicator data of the target business object in the target business time period, obtain the transaction accumulation data associated with the target business object, and use the transaction accumulation data as the data processing result of the transaction data associated with the transaction behavior data;

[0310] A model input variable determination unit 142 is used to use the data processing results, the abnormal behavior classification group and the text classification group as model input variables of the business main model in the target training model, and determine the gradient parameters of the model input variables through the business main model;

[0311] The key variable sampling unit 143 is used to sample the model input variables based on the gradient parameters of the model input variables and the variable sampling strategy in the business main model to obtain the key variables for feature binding; the number of key variables is less than the number of model input variables;

[0312] The feature binding unit 144 is used to perform feature conversion on the key variables to obtain variable conversion features of the key variables, perform feature binding on the variable conversion features to obtain binding features of the key variables, and based on the binding features, output the confidence level of determining that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group.

[0313] The specific implementation of the indicator data determination unit 141, the model input variable determination unit 142, the key variable sampling unit 143 and the feature binding unit 144 can be found in the above Figure 3 or Figure 8 The description of the specific process of outputting the confidence that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group in the corresponding embodiment will not be further repeated here.

[0314] The variable sampling strategy in the business main model includes a gradient parameter threshold for variable selection, and a first variable extraction parameter and a second variable extraction parameter for maintaining the variable sampling ratio;

[0315] The key variable sampling unit 143 is specifically used to select the model input variable whose gradient parameter reaches the gradient parameter threshold from the model input variables, and use the selected model input variable whose gradient parameter reaches the gradient parameter threshold as the first target input variable;

[0316] The key variable sampling unit 143 is further specifically used to sample the first target input variable matching the first variable extraction parameter from the first target input variable, and use the sampled first target input variable matching the first variable extraction parameter as the first key variable;

[0317] The key variable sampling unit 143 is further specifically used to use the model input variables except the first target input variables in the model input variables as the second target input variables, and sample the second target input variables matching the second variable extraction parameters from the second target input variables, and use the sampled second target input variables matching the second variable extraction parameters as the second key variables;

[0318] The key variable sampling unit 143 is further specifically configured to use the first key variable and the second key variable as key variables for feature binding.

[0319] The specific implementation of the key variable sampling unit 143 can be found in the above Figure 3 The description of the specific process of obtaining the key variables in the corresponding embodiment will not be repeated here.

[0320] The risk level determination module 15 includes: a fitting parameter acquisition unit 151 and an impact level determination unit 152;

[0321] A fitting parameter acquisition unit 151 is used to acquire a conversion fitting parameter for performing confidence conversion, and obtain an assessment impact for performing risk assessment on the target abnormal behavior type based on the conversion fitting parameter and the confidence of the target abnormal behavior type;

[0322] The impact level determination unit 152 is configured to use the impact level to which the assessed impact degree belongs as the risk level when the object classification type of the target business object is the target abnormal behavior type.

[0323] The specific implementation of the fitting parameter acquisition unit 151 and the impact level determination unit 152 can be found in the above Figure 3 or Figure 8The description of the specific process of determining the risk level in the corresponding embodiment will not be repeated here.

[0324] Wherein, optionally, the device 1 further includes: a sample behavior data acquisition module 16, an initial model acquisition module 17, a behavior grouping prediction module 18 and a node sub-model training module 19;

[0325] The sample behavior data acquisition module 16 is used to determine the sample business scenario associated with the sample behavior data when the sample behavior data of the sample business object is acquired, and to construct a sample relationship topology map associated with the sample business object based on the sample business scenario; the sample relationship topology map includes N sample nodes, and one sample node is determined by one sample business scenario; N is a positive integer greater than 1;

[0326] The initial model acquisition module 17 is used to, when the initial training model to be trained is acquired, use the node sub-model in the initial training model as the initial node sub-model, and construct a sample abnormality group associated with the sample business object for training the initial node sub-model based on the sample abnormal behavior label information associated with the sample business object;

[0327] The behavior group prediction module 18 is used to input the sample relationship topology diagram into the initial node sub-model, determine the sample mapping vector of each sample node in the N sample nodes by the initial node sub-model, and predict the predicted behavior classification group to which the target business object belongs based on the sample mapping vector of each sample node;

[0328] The node sub-model training module 19 is used to perform sub-model training on the initial node sub-model based on the predicted behavior classification group and the sample abnormality grouping, and use the initial node sub-model after sub-model training as the target node sub-model.

[0329] The specific implementation of the sample behavior data acquisition module 16, the initial model acquisition module 17, the behavior grouping prediction module 18 and the node sub-model training module 19 can be found in the above Figure 8 The description of the specific process of training the target node sub-model in the corresponding embodiment will not be repeated here.

[0330] Optionally, the device 1 further comprises: a text sub-model determination module 20, a sample group determination module 21, a text group prediction module 22 and a text sub-model training module 23;

[0331] A text sub-model determination module 20, used to use the text sub-model in the initial training model as the initial text sub-model;

[0332] The sample group determination module 21 is used to determine the text label information of the sample text information as the sample text label information associated with the sample business object when the sample text information associated with the sample behavior data is obtained, and construct a sample text group for training the initial text sub-model based on the sample text label information;

[0333] The text grouping prediction module 22 is used to input the sample text information into the initial text sub-model, determine the sample text mapping vector of the text segmentation in the sample text information by the initial text sub-model, and predict the predicted text classification group to which the sample business object belongs based on the sample text mapping vector;

[0334] The text sub-model training module 23 is used to perform sub-model training on the initial text sub-model based on the predicted text classification group and the sample text classification group, and use the initial text sub-model after sub-model training as the target text sub-model.

[0335] The specific implementation of the text sub-model determination module 20, the sample group determination module 21, the text group prediction module 22 and the text sub-model training module 23 can be found in the above Figure 8 The description of the specific process of training the target text sub-model in the corresponding embodiment will not be repeated here.

[0336] Optionally, the device 1 further includes: a business main model determination module 24, a sample variable determination module 25, a business main model training module 26 and a target model determination module 27;

[0337] A business main model determination module 24 is used to use the sample abnormal behavior label information in the sample abnormal group in the target node sub-model as the sample abnormal behavior type label of the sample abnormal behavior type associated with the sample business object when the business main model in the initial training model is used as the initial business main model;

[0338] A sample variable determination module 25 is used to use the predicted behavior classification group predicted and output by the target node sub-model for the sample business object as a first sample input variable for training the initial business main model, and to use the predicted text classification group predicted and output by the target text sub-model for the sample business object as a second sample input variable for training the initial business main model;

[0339] The sample variable determination module 25 is further configured to, when a sample processing result of the sample indicator data associated with the sample behavior data is obtained, use the sample behavior processing result as a third sample input variable for training the initial business main model;

[0340] The sample variable determination module 25 is further used to input the first sample input variable, the second sample input variable and the third sample input variable into the initial business main model, and the initial business main model determines the confidence that the sample business object belongs to the predicted abnormal behavior type in the predicted behavior classification group, and when the predicted abnormal behavior type corresponding to the maximum confidence in the confidence is determined as the target predicted abnormal behavior type, the initial business main model outputs the predicted abnormal behavior type label corresponding to the target predicted abnormal behavior type;

[0341] The business main model training module 26 is used to perform main model training on the initial business main model based on the predicted abnormal behavior type label and the sample abnormal behavior type label, and use the initial business main model after the main model training as the target business main model;

[0342] The target model determination module 27 is used to use the target node sub-model as the node sub-model of the target training model, the target text sub-model as the text sub-model of the target training model, and the target business main model as the business main model of the target training model, and construct the target training model based on the node sub-model of the target training model, the text sub-model of the target training model and the business main model of the target training model.

[0343] The specific implementation of the business main model determination module 24, the sample variable determination module 25, the business main model training module 26 and the target model determination module 27 can be found in the above Figure 8 The description of the specific process of constructing the target training model in the corresponding embodiment will not be repeated here. In addition, the description of the same beneficial effects obtained by the same method will not be repeated.

[0344] For further information, see Fig.11 , Fig.11 Schematic diagram of the structure of a computer device provided in an embodiment of the present application. Fig.11 As shown, the computer device 1000 may be the above Figure 2The business service device 2b in the corresponding embodiment will not be limited here. The computer device 1000 may include: a processor 1001, a network interface 1004 and a memory 1005. In addition, the computer device 1000 may also include: a user interface 1003, and at least one communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. Among them, the user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or it may be a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 1005 may optionally also be at least one storage device located away from the aforementioned processor 1001. As Fig.11 As shown, the memory 1005 as a computer-readable storage medium may include an operating system, a network communication module, a user interface module, and a device control application program.

[0345] The network interface 1004 in the computer device 1000 can also provide a network communication function. Fig.11 In the computer device 1000 shown in the figure, the network interface 1004 can provide a network communication function; the user interface 1003 is mainly used to provide an input interface for the user; and the processor 1001 can be used to call the device control application stored in the memory 1005 to execute the above Figure 3 or Figure 8 The description of the transaction data processing method in the corresponding embodiment can also be performed as described above. Fig.10 The description of the transaction data processing device 1 in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated here either.

[0346] In addition, it should be pointed out here that: the embodiment of the present application also provides a computer-readable storage medium, and the computer-readable storage medium stores a computer program executed by the transaction data processing device 1 mentioned above, and the computer program includes computer instructions. When the processor executes the computer instructions, it can execute the above-mentioned Figure 3 or Figure 8The description of the transaction data processing method in the corresponding embodiment will therefore not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer-readable storage medium embodiment involved in this application, please refer to the description of the method embodiment of this application. As an example, computer instructions can be deployed on a computing device for execution, or on multiple computing devices located at one location, or on multiple computing devices distributed at multiple locations and interconnected by a communication network. Multiple computing devices distributed at multiple locations and interconnected by a communication network can constitute a blockchain system.

[0347] In addition, it should be noted that: the embodiment of the present application also provides a computer program product or a computer program, which may include computer instructions, and the computer instructions may be stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor may execute the computer instructions, so that the computer device executes the above Figure 3 or Figure 8 The description of the transaction data processing method in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer program product or computer program embodiment involved in this application, please refer to the description of the method embodiment of this application.

[0348] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0349] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A transaction data processing method, characterized in that: The method comprises: When the transaction behavior data of the target business object is obtained, a transaction business scenario associated with the transaction behavior data is determined, and a node relationship topology diagram associated with the target business object is constructed based on the transaction business scenario; the node relationship topology diagram includes N business nodes, and one business node is determined by one transaction business scenario; N is a positive integer greater than 1; When a target training model for predicting the object classification type of the target business object is obtained, the node relationship topology diagram is input into a node sub-model of the target training model, a node mapping vector of each of the N business nodes is determined by the node sub-model, and based on the node mapping vector of each business node, the abnormal behavior classification group to which the target business object belongs is output; When the associated text information associated with the transaction behavior data is obtained, the associated text information is input into the text sub-model of the target training model, the text sub-model determines the text mapping vector of the text segmentation in the associated text information, and determines the text classification group to which the target business object belongs based on the text mapping vector; When a data processing result of the transaction indicator data associated with the transaction behavior data is obtained, the data processing result, the abnormal behavior classification group and the text classification group are input into the business main model of the target training model, and the business main model determines the confidence that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group, and when the abnormal behavior type corresponding to the maximum confidence in the confidence is determined as the target abnormal behavior type, the business main model outputs the confidence of the target abnormal behavior type; Based on the confidence of the target abnormal behavior type, a risk level when the object classification type of the target business object is the target abnormal behavior type is determined.

2. The method according to claim 1, characterized in that When the transaction behavior data of the target business object is obtained, a transaction business scenario associated with the transaction behavior data is determined, and a node relationship topology diagram associated with the target business object is constructed based on the transaction business scenario, including: Acquire the business transactions executed by the target business object in the target business time period from the distributed data storage system, determine the behavior data set of the target business object in the target business time period based on the transaction details information of the business transactions, and use the behavior data in the behavior data set as the transaction behavior data of the target business object; Performing data analysis on the transaction behavior data to determine a business interaction object having a data interaction relationship with the target business object, and determining N transaction business scenarios of the target business object within the target business time period based on the data interaction relationship between the target business object and the business interaction object; Based on the N transaction business scenarios, N business nodes associated with the target business object are constructed, and based on the scenario relevance between the N transaction business scenarios, a node connection relationship between the N business nodes is determined; one business scenario is used to construct one business node; Based on the N business nodes and the node connection relationships, a node relationship topology graph associated with the target business object is constructed.

3. The method according to claim 2, characterized in that The N business transaction scenarios include a first transaction scenario and a second transaction scenario; the first transaction scenario is different from the second transaction scenario; the data interaction relationship between the target business object and the business interaction object is determined by the first interaction parameter information and the second interaction parameter information obtained from the transaction behavior data; the first interaction parameter information is determined by the first business transaction between the target business object and the business interaction object in the first transaction scenario; the second interaction parameter information is determined by the second business transaction between the target business object and the business interaction object in the second transaction scenario; the first business transaction and the second business transaction are both transactions in the business transaction; The constructing N business nodes associated with the target business object based on the N transaction business scenarios, and determining the node connection relationship between the N business nodes based on the scenario relevance between the N transaction business scenarios, includes: Acquire the first transaction scenario and the second transaction scenario from the N business transaction scenarios, use the business node constructed for the first transaction business scenario as the first business node, and use the business node constructed for the second transaction business scenario as the second business node; Acquire the transaction transfer quantity of the first business transaction from the first interaction parameter information, and acquire the transaction transfer quantity of the second business transaction from the second interaction parameter information, accumulate the transaction transfer quantity of the first business transaction and the transaction transfer quantity of the second business transaction, and obtain the accumulated transaction quantity between the target business object and the business interaction object; When determining the edge connection relationship between the first business node and the second business node based on the data interaction relationship between the target business object and the business interaction object, the accumulated transaction resource quantity between the target business object and the business interaction object is used as the edge weight coefficient between the first business node and the second business node; The edge connection relationship between the first service node and the second service node and the edge weight coefficient between the first service node and the second service node are used as the node connection relationship between the first service node and the second service node.

4. The method according to claim 1, characterized in that When the target training model for predicting the object classification type of the target business object is obtained, the node relationship topology diagram is input into the node sub-model of the target training model, the node sub-model is used to determine the node mapping vector of each business node in the N business nodes, and based on the node mapping vector of each business node, the abnormal behavior classification group to which the target business object belongs is output, including: Acquire a target training model for predicting the object classification type of the target business object; Inputting the node relationship topology graph into the node sub-model of the target training model, and when the node sub-model extracts the N service nodes from the node relationship topology graph, determining a node access sequence associated with a service node i among the N service nodes; i is a positive integer less than or equal to N; Performing node vector mapping on the node access sequence associated with the service node i to obtain a node mapping vector of the service node i; Based on the node mapping vector of the business node i, the abnormal behavior classification group to which the target business object belongs is output.

5. The method according to claim 4, characterized in that The step of inputting the node relationship topology graph into the node sub-model of the target training model, and when the node sub-model extracts the N service nodes from the node relationship topology graph, determining a node access sequence associated with a service node i among the N service nodes, comprises: Inputting the node relationship topology graph into the node sub-model of the target training model, and extracting the N service nodes from the node relationship topology graph by the node sub-model; Obtaining a node access policy in the node submodel, obtaining a service node i from the N service nodes based on the node access policy, and obtaining one or more access sequences associated with the service node i based on the node access parameters in the node access policy; Among one or more access sequences associated with the service node i, an access sequence whose sequence length reaches a sequence length threshold indicated by the node access policy is screened, and the screened access sequence is used as a node access sequence associated with the service node i among the N service nodes.

6. The method according to claim 4, characterized in that The step of outputting the abnormal behavior classification group to which the target business object belongs based on the node mapping vector of the business node i includes: Determine a vector distance between a node mapping vector of the service node i and a plurality of sample mapping vectors in the node submodel, and determine a vector similarity between the node mapping vector of the service node i and the plurality of sample mapping vectors based on the determined vector distance; In the vector similarity, the sample mapping vector with the maximum vector similarity is used as the target sample mapping vector, the sample abnormal behavior label information associated with the sample node corresponding to the target sample mapping vector is determined, and the abnormal behavior type of the target business object when it is at the business node i is determined based on the sample abnormal behavior label information, and the sample abnormal group to which the sample abnormal behavior label information belongs is determined as the behavior type group of the abnormal behavior type when the target business object is at the business node i; Based on the behavior type grouping of the abnormal behavior type when the target business object is at the business node i, the abnormal behavior classification group to which the target business object belongs is determined.

7. The method according to claim 4, characterized in that The node sub-model includes M sample abnormal groups; M is a positive integer greater than or equal to 2; one sample abnormal group corresponds to one group center vector; one group center vector is obtained by clustering the sample mapping vector corresponding to the sample behavior type in one sample abnormal group; The step of outputting the abnormal behavior classification group to which the target business object belongs based on the node mapping vector of the business node i includes: Obtaining a sample abnormal group j from the M sample abnormal groups as a first sample abnormal group; j is a positive integer less than M; Determine a first vector similarity between a node mapping vector of the service node i and a group center vector of the first sample abnormal group; If the first vector similarity reaches a vector similarity threshold, the first sample abnormal group is used as a behavior type group of an abnormal behavior type when the target business object is at the business node i; Based on the behavior type grouping of the abnormal behavior type when the target business object is at the business node i, determine the abnormal behavior classification group to which the target business object belongs.

8. The method according to claim 7, characterized in that The M sample abnormal groups include sample abnormal group k; k=j+1; k is a positive integer greater than j and less than or equal to M; The method further comprises: If the first vector similarity does not reach the vector similarity threshold, the sample abnormal group k is used as the second sample abnormal group; the second sample abnormal group is the next sample abnormal group of the first sample abnormal group; Determine a second vector similarity between the node mapping vector of the service node i and the group center vector of the second sample abnormal group; If the second vector similarity reaches the vector similarity threshold, the second sample abnormal group is used as a behavior type group of the abnormal behavior type when the target business object is at the business node i.

9. The method according to claim 1, characterized in that: The transaction behavior data is determined based on the business transactions executed by the target business object within the target business time period obtained from the distributed data storage system; When the associated text information associated with the transaction behavior data is obtained, the associated text information is input into the text sub-model of the target training model, the text sub-model determines the text mapping vector of the text segmentation in the associated text information, and the text classification group to which the target business object belongs is determined based on the text mapping vector, including: Acquire, from the distributed data storage system, text information entered by the target business object when executing the business transaction within the target business time period, and use the acquired text information as associated text information associated with the transaction behavior data; The associated text information is input into the text sub-model of the target training model, and the text sub-model performs word segmentation processing on the associated text information to obtain text segmentations of the associated text information; the text segmentations include L segmentations; L is a positive integer; Select a word from the L word segmentations as a key text word segmentation, perform word vector mapping on the key text word segmentation, and obtain a word segmentation mapping vector of the key text word segmentation, until each word in the L word segmentation is used as the key text word segmentation, and obtain the word segmentation mapping vector of each word segmentation; Based on the word segmentation mapping vector of each word segmentation, a text mapping vector of the text word segmentation in the associated text information is determined, and based on the text mapping vector, a text classification group to which the target business object belongs is determined.

10. The method according to claim 9, characterized in that The determining, based on the word segmentation mapping vector of each word segmentation, the text mapping vector of the text word segmentation in the associated text information comprises: Select a word from the L word segmentations as the key text segmentation, and use each of the L word segmentations as the associated text segmentation; Performing vector multiplication processing on the word segmentation mapping vector of the key text word segmentation and the word segmentation mapping vector of the associated text word segmentation to obtain a vector multiplication result indicating the word segmentation relevance between the key text word segmentation and the associated text word segmentation; Based on the word segmentation relevance indicated by the vector multiplication result, weighted summing processing is performed on the word segmentation mapping vector of each word segmentation to obtain the mapping update vector of the key text word segmentation; When each of the L segmented words is used as the key text segmented word, a mapping update vector of each segmented word is obtained, and the mapping update vector of each segmented word is used as the text mapping vector of the text segmented word in the associated text information.

11. The method according to claim 1, characterized in that: The transaction behavior data is determined based on the business transactions executed by the target business object within the target business time period obtained from the distributed data storage system; the transaction details information of the business transaction includes the target interaction parameter information associated with the target business object; When the data processing result of the transaction indicator data associated with the transaction behavior data is obtained, the data processing result, the abnormal behavior classification group and the text classification group are input into the business master model of the target training model, and the business master model determines the confidence that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group, including: The transaction transfer quantity obtained from the target transaction parameter information is used as the transaction index data of the target business object in the target business time period, and the transaction accumulation processing is performed on the transaction index data of the target business object in the target business time period to obtain the transaction accumulation data associated with the target business object, and the transaction accumulation data is used as the data processing result of the transaction data associated with the transaction behavior data; Using the data processing result, the abnormal behavior classification group and the text classification group as model input variables of the business main model in the target training model, and determining the gradient parameters of the model input variables through the business main model; Based on the gradient parameters of the model input variables and the variable sampling strategy in the business main model, key variables for feature binding are sampled from the model input variables; the number of variables of the key variables is less than the number of variables of the model input variables; Perform feature conversion on the key variable to obtain variable conversion features of the key variable, perform feature binding on the variable conversion features to obtain binding features of the key variable, and based on the binding features, output a confidence level that determines that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group.

12. The method according to claim 11, characterized in that The variable sampling strategy in the business main model includes a gradient parameter threshold for variable selection, and a first variable extraction parameter and a second variable extraction parameter for maintaining a variable sampling ratio; The step of obtaining key variables for feature binding from the model input variables based on the gradient parameters of the model input variables and the variable sampling strategy in the business main model includes: Selecting a model input variable whose gradient parameter reaches the gradient parameter threshold from the model input variables, and using the selected model input variable whose gradient parameter reaches the gradient parameter threshold as the first target input variable; Sampling the first target input variable to obtain a first target input variable that matches the first variable extraction parameter from the first target input variable, and using the sampled first target input variable that matches the first variable extraction parameter as a first key variable; The model input variables except the first target input variable in the model input variables are used as second target input variables, and second target input variables matching the second variable extraction parameters are sampled from the second target input variables, and the sampled second target input variables matching the second variable extraction parameters are used as second key variables; The first key variable and the second key variable are used as key variables for feature binding.

13. The method according to claim 1, characterized in that The determining, based on the confidence of the target abnormal behavior type, the risk level when the object classification type of the target business object is the target abnormal behavior type, includes: Acquire conversion fitting parameters for performing confidence conversion, and obtain an assessment impact for performing risk assessment on the target abnormal behavior type based on the conversion fitting parameters and the confidence of the target abnormal behavior type; The impact level to which the assessed impact degree belongs is used as the risk level when the object classification type of the target business object is the target abnormal behavior type.

14. The method according to claim 1, characterized in that The method further comprises: When sample behavior data of a sample business object is obtained, a sample business scenario associated with the sample behavior data is determined, and a sample relationship topology graph associated with the sample business object is constructed based on the sample business scenario; the sample relationship topology graph includes N sample nodes, and one sample node is determined by one sample business scenario; N is a positive integer greater than 1; When an initial training model to be trained is obtained, a node sub-model in the initial training model is used as an initial node sub-model, and based on sample abnormal behavior label information associated with the sample business object, a sample abnormal group associated with the sample business object for training the initial node sub-model is constructed; Inputting the sample relationship topology graph into the initial node sub-model, determining a sample mapping vector of each sample node in the N sample nodes by the initial node sub-model, and predicting the predicted behavior classification group to which the target business object belongs based on the sample mapping vector of each sample node; Based on the predicted behavior classification group and the sample abnormality grouping, sub-model training is performed on the initial node sub-model, and the initial node sub-model after sub-model training is used as the target node sub-model.

15. The method according to claim 14, characterized in that The method further comprises: Using the text sub-model in the initial training model as the initial text sub-model; When sample text information associated with the sample behavior data is obtained, text label information of the sample text information is determined as sample text label information associated with the sample business object, and a sample text grouping for training the initial text sub-model is constructed based on the sample text label information; Inputting the sample text information into the initial text sub-model, determining the sample text mapping vector of the text segmentation in the sample text information by the initial text sub-model, and predicting the predicted text classification group to which the sample business object belongs based on the sample text mapping vector; Based on the predicted text classification group and the sample text classification group, sub-model training is performed on the initial text sub-model, and the initial text sub-model after sub-model training is used as the target text sub-model.

16. The method according to claim 15, characterized in that The method further comprises: When the business main model in the initial training model is used as the initial business main model, the sample abnormal behavior label information in the sample abnormal group in the target node sub-model is used as the sample abnormal behavior type label of the sample abnormal behavior type associated with the sample business object; Using the predicted behavior classification group predicted and output by the target node sub-model for the sample business object as the first sample input variable for training the initial business main model, and using the predicted text classification group predicted and output by the target text sub-model for the sample business object as the second sample input variable for training the initial business main model; When a sample processing result of the sample indicator data associated with the sample behavior data is obtained, the sample behavior processing result is used as a third sample input variable for training the initial business main model; Inputting the first sample input variable, the second sample input variable and the third sample input variable into the initial business main model, the initial business main model determines the confidence that the sample business object belongs to the predicted abnormal behavior type in the predicted behavior classification group, and when the predicted abnormal behavior type corresponding to the maximum confidence among the confidences is determined as the target predicted abnormal behavior type, the initial business main model outputs the predicted abnormal behavior type label corresponding to the target predicted abnormal behavior type; Based on the predicted abnormal behavior type label and the sample abnormal behavior type label, the initial business main model is trained as a main model, and the initial business main model after the main model training is used as a target business main model; The target node sub-model is used as the node sub-model of the target training model, the target text sub-model is used as the text sub-model of the target training model, and the target business main model is used as the business main model of the target training model. Based on the node sub-model of the target training model, the text sub-model of the target training model and the business main model of the target training model, the target training model is constructed.

17. A transaction data processing device, characterized in that: The device comprises: A topology map construction module is used to determine the transaction business scenario associated with the transaction behavior data when the transaction behavior data of the target business object is obtained, and to construct a node relationship topology map associated with the target business object based on the transaction business scenario; the node relationship topology map includes N business nodes, and one business node is determined by one transaction business scenario; N is a positive integer greater than 1; a behavior group determination module, for, when a target training model for predicting the object classification type of the target business object is acquired, inputting the node relationship topology diagram into a node sub-model of the target training model, determining a node mapping vector of each of the N business nodes by the node sub-model, and outputting the abnormal behavior classification group to which the target business object belongs based on the node mapping vector of each business node; A text grouping determination module, for, when obtaining associated text information associated with the transaction behavior data, inputting the associated text information into a text sub-model of the target training model, determining a text mapping vector of a text word in the associated text information by the text sub-model, and determining the text classification group to which the target business object belongs based on the text mapping vector; A confidence output module, for, when a data processing result of the transaction indicator data associated with the transaction behavior data is obtained, inputting the data processing result, the abnormal behavior classification group and the text classification group into the business main model of the target training model, and determining by the business main model the confidence that the target business object belongs to the abnormal behavior type in the abnormal behavior classification group, and when the abnormal behavior type corresponding to the maximum confidence in the confidence is determined as the target abnormal behavior type, the business main model outputs the confidence of the target abnormal behavior type; The risk level determination module is used to determine the risk level when the object classification type of the target business object is the target abnormal behavior type based on the confidence of the target abnormal behavior type.

18. A computer device, characterized in that: including memory and processor; The memory is connected to the processor, the memory is used to store a computer program, and the processor is used to call the computer program so that the computer device executes the method according to any one of claims 1 to 16.

19. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded and executed by a processor, so that a computer device having the processor executes the method according to any one of claims 1 to 16.

20. A computer program product, characterized in that The method comprises a computer program / instruction, which implements the method according to any one of claims 1 to 16 when executed by a processor.

Images