Method, device and equipment for monitoring user transaction behavior, medium and program product

Abstract

The invention provides a method for monitoring user transaction behaviors. The method can be applied to the field of information security or big data. The method comprises the steps of obtaining transaction information of an account in response to a transaction request of the account accessed to a service end; transmitting the transaction information to a first rule engine, and judging whether the transaction information violates a first judgment caliber or not through the first rule engine; in response to the transaction information violating the first judgment caliber, adding an alarm label to the transaction information, and transmitting the transaction information carrying the alarm label to a second rule engine; based on the transaction information carrying the alarm label, whether the transaction information violates a second judgment caliber is judged through a second rule engine, the second judgment caliber is different from the first judgment caliber, and the first judgment caliber and the second judgment caliber jointly form a preset rule; and in response to the transaction information violating the second judgment caliber, intercepting the transaction request.

Description

Technical Field

[0001] The present disclosure relates to the field of information security or big data, and more specifically to a method, device, equipment, medium and program product for monitoring user transaction behavior. Background Art

[0002] With the rapid development of information technology, the amount of transaction data has increased dramatically, and transaction risks have also followed. Traditional transaction monitoring methods often rely on a single real-time rule engine to formulate real-time rules. However, many real-time rules require the real-time rule engine to access new transaction fields or even new transaction lines to meet the judgment of the rule scope. This requires the real-time rule engine system interface layer to link with the upstream of the transaction line to expand the transaction information accessed by the real-time rule engine, which will increase the development cycle, testing cycle, labor cost and maintenance cost of real-time rule development after the rules are launched. At the same time, business needs have become more intensive and urgent, resulting in the compression of development and testing cycles, which in turn contradicts the above problems. Summary of the invention

[0003] In view of the above problems, embodiments of the present disclosure provide a method, apparatus, device, medium and program product for monitoring user transaction behavior.

[0004] According to a first aspect of the present disclosure, a method for monitoring user transaction behavior is provided, the method comprising: in response to a transaction request of an account accessing a service end, obtaining transaction information of the account; transmitting the transaction information to a first rule engine, and judging whether the transaction information violates a first judgment caliber through the first rule engine; in response to the transaction information violating the first judgment caliber, adding an alarm tag to the transaction information, and transmitting the transaction information carrying the alarm tag to a second rule engine; based on the transaction information carrying the alarm tag, judging whether the transaction information violates a second judgment caliber using the second rule engine, wherein the second judgment caliber is different from the first judgment caliber, and the first judgment caliber and the first judgment caliber together constitute a preset rule; in response to the transaction information violating the second judgment caliber, intercepting the transaction request.

[0005] According to an embodiment of the present disclosure, the method further includes: caching the transaction information of the account into an Hbase database through the first rule engine.

[0006] According to an embodiment of the present disclosure, judging whether the transaction information violates a first judgment caliber by the first rule engine, and adding an alarm tag to the transaction information in response to the transaction information violating the first judgment caliber includes: judging whether the transaction information violates a first caliber of the first judgment caliber by using the first rule engine, the first caliber being a first part of the first judgment caliber; when the transaction information violates the first caliber, adding a first tag to the transaction information, and associating the Hbase database through the transaction information to obtain historical transaction information of the account; judging whether the transaction information carrying the first tag violates a second caliber of the first judgment caliber based on the historical transaction information of the account, the second caliber being a second part of the first judgment caliber; when the transaction information violates the second caliber, adding an alarm tag to the transaction information.

[0007] According to an embodiment of the present disclosure, based on the transaction information carrying the alarm tag, using the second rule engine to determine whether the transaction information violates the second judgment caliber, and in response to the transaction information violating the second judgment caliber, intercepting the transaction request includes: receiving the transaction information carrying the alarm tag, and caching the transaction date in the transaction information as the current natural day; using the second rule engine to determine whether the transaction information violates the second judgment caliber; in response to the transaction information violating the second judgment caliber, reading the cached transaction date and determining whether the transaction date is the current natural day; in response to the transaction information violating the second judgment caliber, intercepting the transaction request.

[0008] According to an embodiment of the present disclosure, before transmitting the transaction information to the first rule engine, the process includes: determining whether the second rule engine can independently develop the preset rule in real time; when the second rule engine cannot independently develop the preset rule, splitting the preset rule to obtain a first judgment caliber and a second judgment caliber, wherein the first judgment caliber is the existing caliber of the first rule engine, and the second judgment caliber is whether the second rule engine can independently develop the preset rule.

[0009] According to an embodiment of the present disclosure, in response to a transaction request of an account accessing a business terminal, obtaining transaction information of the account includes: identifying a transaction data source corresponding to the transaction information, and determining whether the transaction data source is a transaction data source already available to the first rule engine; when the transaction data source is a transaction data source already available to the first rule engine, obtaining transaction information of the account.

[0010] According to an embodiment of the present disclosure, the method further includes: the first rule engine and the second rule engine are a combination of one or more of a real-time rule engine, a stream computing engine, and a batch rule engine.

[0011] The second aspect of the present disclosure provides a device for monitoring user transaction behavior, the device comprising: an acquisition module, used to respond to a transaction request of an account connected to a business terminal, to acquire transaction information of the account; a first judgment module, used to transmit the transaction information to a first rule engine, and to judge whether the transaction information violates a first judgment caliber through the first rule engine; a labeling module, used to add an alarm tag to the transaction information in response to the transaction information violating the first judgment caliber, and transmit the transaction information carrying the alarm tag to a second rule engine; a second judgment module, used to judge whether the transaction information violates a second judgment caliber based on the transaction information carrying the alarm tag, using the second rule engine, wherein the second judgment caliber is different from the first judgment caliber, and the first judgment caliber and the first judgment caliber together constitute a preset rule; an interception module, used to intercept the transaction request in response to the transaction information violating the second judgment caliber.

[0012] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0013] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0014] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0015] According to the method, device, equipment, medium and program product for monitoring user transaction behavior provided by the embodiments of the present disclosure, the real-time preset rules are divided into the first judgment caliber and the second judgment caliber, and the first judgment caliber can be judged by the first rule engine, thereby reusing the existing transaction data source and caliber of the first rule engine to shorten the development cycle, and solve the problem that a single rule engine cannot formulate preset rules when new lines of transactions or new fields are not connected and the development time is tight. In addition, Hbase is used as a database for caching, so that more comprehensive and detailed dimension tables can be read and written by rules, while avoiding the problem of missing or miscounting historical transaction information due to loss of transaction information. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0017] Figure 1 The application scenario diagram schematically shows the method, apparatus, device, medium and program product for monitoring user transaction behavior according to an embodiment of the present disclosure;

[0018] Figure 2 A flowchart schematically shows a method for monitoring user transaction behavior according to an embodiment of the present disclosure;

[0019] Figure 3 Another flow chart of the method for monitoring user transaction behavior according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 4 A block diagram schematically shows a structure of a device for monitoring user transaction behavior according to an embodiment of the present disclosure; and

[0021] Figure 5 A block diagram of an electronic device suitable for implementing a method for monitoring user transaction behavior according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0022] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0023] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0024] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0025] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0026] It should be noted that the method and device for monitoring user transaction behavior disclosed in the present invention can be used in the financial field, information security or big data field, and can also be used in any field other than the financial field, such as the field of information processing technology. The application field of the method and device for monitoring user transaction behavior disclosed in the present invention is not limited.

[0027] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0028] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0029] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0030] Embodiments of the present disclosure provide a method, apparatus, device, medium, and program product for monitoring user transaction behavior.

[0031] Figure 1 The application scenario diagram of the method, apparatus, device, medium and program product for monitoring user transaction behavior according to an embodiment of the present disclosure is schematically shown.

[0032] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0033] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0034] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0035] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0036] It should be noted that the method for monitoring user transaction behavior provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the device for monitoring user transaction behavior provided in the embodiment of the present disclosure can generally be set in the server 105. The method for monitoring user transaction behavior provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the device for monitoring user transaction behavior provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0037] It should be understood that Figure 1The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0038] The following will be based on Figure 1 The scene described by Figures 2 to 3 The method for monitoring user transaction behavior according to an embodiment of the present disclosure is described in detail.

[0039] First, the technical terms described in this article are explained and described as follows.

[0040] Interception during the transaction: Real-time monitoring of transaction behavior during the transaction process so that immediate response (early warning, interception) can be made when fraud occurs. That is, when the transaction is being processed, the system will analyze the transaction behavior in real time and may require additional identity verification, such as SMS verification code or biometric verification. Among them, "in the process" refers to risk management while the transaction is in progress.

[0041] Post-event interception: By retrospectively analyzing transactions that have occurred, any possible fraudulent behavior can be identified and appropriate measures can be taken. In other words, the analysis of completed transactions, such as comparing transaction amounts, frequencies, locations and other information with normal behavior patterns, and investigating suspicious transaction records. Post-event refers to the process of reviewing transaction records after the transaction is completed.

[0042] Stream computing technology (Flink SQL): Flink SQL is a declarative language for querying streaming data in an open source stream processing framework. It allows developers to use SQL syntax to process real-time data streams. Flink SQL has the following features: Ease of use: Flink SQL provides a simple and powerful application programming interface that allows developers to use familiar SQL syntax to process real-time data streams. High performance: Flink SQL takes advantage of the low latency and high throughput characteristics of the stream processing engine to efficiently process large amounts of real-time data. Window processing: supports multiple window types such as sliding windows and rolling windows for time-related aggregation operations. Join operations: supports multiple join methods such as stream-stream joins and stream-table joins, and can handle complex multi-stream association scenarios. Event time processing: supports event-time-based processing, can handle out-of-order data, and perform precise time window operations. Continuous query: supports continuous query, and can continuously execute query operations in data streams. State consistency: supports state consistency guarantees, and can maintain data accuracy during fault recovery. Integration capabilities: can be integrated with multiple data sources and receivers.

[0043] SAS Rules Studio (real-time rule engine): A real-time rule engine is a technical component that can execute predefined business logic immediately when data arrives. In the financial field, it is usually used to implement in-process interception or in-process pop-up alerts for financial transactions / pre-verification and verification transactions. The real-time rule engine has the following characteristics: Real-time processing, which can process data and respond in a very short time. Flexibility, allowing users to define and modify rules without changing the code. High performance, maintaining good performance even in high concurrency. Scalability, able to handle growing data volumes and rule complexity. Decision logic, supporting complex business logic and decision tree structures. Event-driven: triggering rule execution based on events.

[0044] The inventor has found through research that in the related art, the capacity of the open source Redis database used for caching is limited, and the current capacity is close to the upper limit. Before Redis is expanded, it is impossible to add large-scale and large-field length transaction information such as transaction notes, mobile phone numbers and ID numbers for each transaction. At the same time, the field upper limit of each cache array of the current Redis database is 56. When the cache value exceeds 56, the new data will be inserted into the array in the form of left-in and right-out, which means that the real-time rule engine can only trace back the transaction information of the first 56 transactions at most, and the previous transactions will be lost due to overflow, causing the real-time rule engine to inaccurately count historical transactions or even errors. In the scenario of counting the historical counterparties, number of transactions and transaction amounts of the same account in the ultra-long time span from T-180 to T-15, the statistical results often deviate due to the limited length of the cache array, which ultimately leads to the problem of missed alarms or false alarms in the real-time rules. In addition, due to the severe anti-fraud situation, in order to accurately detect the increasingly changeable and complex fraud scenarios, the business is constantly refined, the scope of rule detection is constantly enriched, and new rules are continuously proposed with new dimensions and ideas. Therefore, two problems arise. First, many rules require the real-time rule engine to access new transaction fields or even new transaction lines to meet the judgment of the rule scope. This requires the real-time rule engine system interface layer to be linked with the upstream of the transaction line to broaden the transaction information accessed by the real-time rule engine, which will increase the development cycle, testing cycle, labor cost and maintenance cost of the real-time rule development after the rules are launched; second, business needs have become more intensive and more urgent, resulting in the compression of development and testing cycles, which in turn contradicts problem one. Therefore, in response to the above problems, the embodiments of the present disclosure provide a method for monitoring user transaction behavior.

[0045] Figure 2 The flowchart of the method for monitoring user transaction behavior according to an embodiment of the present disclosure is schematically shown.

[0046] like Figure 2As shown, the method for monitoring user transaction behavior of this embodiment includes operations S210 to S250.

[0047] In operation S210, in response to a transaction request of an account accessing a service end, transaction information of the account is obtained.

[0048] In an embodiment of the present disclosure, before obtaining the transaction information of the account, the user's consent or authorization may be obtained. For example, before operation S210, a request to obtain the transaction information of the account may be issued to the user. When the user agrees or authorizes that the transaction information of the account may be obtained, operation S210 is performed.

[0049] In operation S220, the transaction information is transmitted to a first rule engine, and the first rule engine determines whether the transaction information violates a first judgment criterion.

[0050] In operation S230, in response to the transaction information violating the first judgment criterion, a warning tag is added to the transaction information, and the transaction information carrying the warning tag is transmitted to the second rule engine.

[0051] In operation S240, based on the transaction information carrying the alarm tag, the second rule engine is used to determine whether the transaction information violates a second judgment caliber, wherein the second judgment caliber is different from the first judgment caliber, and the first judgment caliber and the first judgment caliber together constitute a preset rule.

[0052] In operation S250, in response to the transaction information violating the second judgment criterion, the transaction request is intercepted.

[0053] In the embodiments of the present disclosure, a corresponding operation entry may be provided for the user to choose to agree or reject the automated decision result. That is, before intercepting and processing / decision-making a transaction request, an instruction of agreeing or rejecting processing / decision-making inputted by the user through the corresponding operation entry may be obtained. If the user agrees to process / decision-making, the transaction request is intercepted and processed / decision-making, that is, step S240 is executed. If the user refuses to process / decision-making, the expert decision-making process is entered.

[0054] For real-time preset rules, a single rule engine does not have the corresponding judgment caliber, so the rule can be split into two parts, the first rule engine and the second rule engine, where the first judgment caliber can be the existing one of the first rule engine, and the second judgment caliber can be the existing one of the second rule engine.

[0055] When an account initiates a transaction request, the system will immediately capture and obtain the transaction information of the account, including but not limited to key data such as transaction amount, transaction type, transaction time, and counterparty account. After obtaining the transaction information, the information is transmitted to the first rule engine for preliminary judgment. Through the first judgment caliber built into the first rule engine, it can be judged whether the transaction information violates at least some of the preset rules. Once the transaction information is judged to violate the first judgment caliber, the system will immediately add an alarm tag to the transaction information to prompt the second rule engine that the transaction has potential risks. Then, the second judgment caliber in the second rule engine can be used to judge whether the remaining preset rules are violated. If it is also judged to violate the second judgment caliber, the system will immediately intercept the transaction request.

[0056] It should be noted that the second judgment caliber and the first judgment caliber are different judgment rules. In some embodiments, the first judgment caliber is more complex than the second judgment caliber. For example, the transaction scenarios involved in the first judgment caliber are more complex, and more data sources need to be integrated. Correspondingly, the first rule engine has more comprehensive transaction lines and more detailed transaction information than the second rule engine. In the case that the second rule engine does not access new lines of transactions or new fields and the development time is tight, the existing transaction data sources and calibers in the first rule engine can be reused.

[0057] In an embodiment of the present disclosure, the first rule engine and the second rule engine are a combination of one or more of a real-time rule engine, a stream computing engine, and a batch rule engine.

[0058] Preferably, the first rule engine is a stream computing engine, which belongs to post-event management and control, and the data source is a transaction log. The second rule engine is a real-time rule engine (SFM).

[0059] Figure 3 Another flow chart of the method for monitoring user transaction behavior according to an embodiment of the present disclosure is schematically shown.

[0060] For example, Figure 3As shown in the figure, a real-time preset rule is taken as an example to illustrate the general idea and process of developing real-time rules by combining the stream computing engine (i.e., the first rule engine) and the real-time rule engine (i.e., the second rule engine). The general content of the preset rule is: 1. For accounts with no card and no discount (a certain transaction scenario) transaction records on the same day, and no card and no discount transaction records in the past six months, 2. If the transaction amount of the current transfer transaction of the account is greater than two thousand, the transaction is intercepted. Since this is a real-time rule for in-process interception, and the real-time rule engine currently has no judgment caliber for no card and no discount transactions (the stream computing engine currently has), and there is no cache record of historical no card and no discount transactions (the stream computing engine currently has), this rule is split into two parts, the stream computing engine and the real-time rule engine, the first half is developed by the stream computing engine, and the second half is developed by the real-time rule engine. In the development process of the stream computing engine, first, open a window to detect each transaction of the current account on the day. If there is a transaction of the type of no card and no discount, and there is no record of no card and no discount transaction in the past six months, add an alarm tag, that is, define the alarm ID as "WKWZ". In the development process of the real-time rule engine, first receive the transaction with the alarm ID "WKWZ" from the stream computing engine, cache the corresponding information, and then when the real-time rule engine detects a transfer transaction greater than two thousand, compare it with the cached information to determine whether it has received an alarm from the stream computing real-time rule engine. If so, it meets the first half of the rule, so it returns the control strategy of "intercepting the transaction" and sends an alarm message.

[0061] On the basis of the above embodiments, the real-time rule engine and the quasi-real-time rule engine (stream computing engine) are combined to solve the development difficulties. Furthermore, on this basis, the real-time rule engine, the quasi-real-time rule engine and the batch rule engine can be combined in pairs or even in combination to jointly develop preset rules, and comprehensively discuss and solve problems from multiple dimensions.

[0062] It is understandable that through the flexible application and combination of rule engines, their respective advantages can be fully utilized while avoiding their respective limitations, solving the difficulties and challenges in the development process in an optimal way and improving the accuracy of risk identification of user transaction behaviors.

[0063] It can be understood that the method provided by the embodiment of the present disclosure can solve the problem that the second rule engine is unable to independently undertake business needs and independently complete real-time rule development tasks in certain special circumstances, thereby increasing the availability and robustness of the second rule engine system, better meeting external anti-fraud prevention and control requirements, and solving some pain points and difficulties in the existing real-time rule development process, expanding the depth and breadth of rule and model decision-making, and improving the accuracy of early warning and the deployment capabilities of corresponding models.

[0064] In an embodiment of the present disclosure, the transaction information of the account is cached in an Hbase database through the first rule engine.

[0065] As a distributed, column-based storage database, Hbase has the characteristics of high throughput and low latency, and is suitable for storing and processing large amounts of transaction data. In addition, by caching transaction information in the database, data can be stored persistently. Even if the system fails or data is lost, the data can be quickly restored from the Hbase database to ensure business continuity and data integrity.

[0066] When caching transaction information in the Hbase database, a series of security measures can be taken to protect the privacy and security of the data. For example, encryption technology can be used to encrypt and store sensitive data, and strict access control policies can be set to limit access rights to the data.

[0067] It is understandable that the first rule engine uses Hbase as a cache database, and there are more comprehensive and detailed dimension tables in the database for rule reading and writing. Therefore, it is possible to consider reusing the Hbase database in StreamCompute instead of creating a new cache field in the Reids database with limited resources to implement rules. At the same time, there is no length limit for various tables in Hbase. As long as the customized data cleanup cycle and the time span of rule statistics do not conflict, there will be no problem of missing or miscounting historical transaction information due to loss of transaction information.

[0068] On the basis of the above embodiments, in this embodiment, judging whether the transaction information violates the first judgment caliber by the first rule engine, and adding an alarm label to the transaction information in response to the transaction information violating the first judgment caliber includes: judging whether the transaction information violates the first caliber of the first judgment caliber by using the first rule engine, the first caliber being the first part of the first judgment caliber; when the transaction information violates the first caliber, adding a first label to the transaction information, and associating the Hbase database through the transaction information to obtain historical transaction information of the account; judging whether the transaction information carrying the first label violates the second caliber of the first judgment caliber based on the historical transaction information of the account, the second caliber being the second part of the first judgment caliber; when the transaction information violates the second caliber, adding an alarm label to the transaction information.

[0069] In order to improve the accuracy and efficiency of judgment, the "first judgment caliber" can be subdivided into two parts, namely the first caliber and the second caliber. In the first stage, the first caliber can be used to judge some intuitive and easy-to-identify risk points, such as whether the type of trading scene on the day is abnormal. If the transaction information violates the rules in the first caliber, the first rule engine can be used to add a "first label" to the transaction information as a mark for initial risk screening. In the second stage, the second caliber can be used for judgment. The second caliber is more complex and in-depth than the first caliber, such as analysis of historical transaction records and transaction frequency. Through the account information carried in the transaction information, the historical transaction records of the account stored in the Hbase database are associated, and based on the historical transaction records, it is evaluated whether the transaction violates the rules set by the second caliber. If the transaction information is also judged to violate the second caliber in the second stage, the transaction information can be marked again through the first rule engine, and a "warning label" can be added to it.

[0070] In some exemplary embodiments, referring to Figure 3 , for the first judgment caliber, if there is a cardless and no-discount transaction record on the same day, and there is no cardless and no-discount transaction record in the past six months, the judgment caliber can be refined to obtain the first caliber, that is, there is a cardless and no-discount type transaction, and the second caliber, that is, the number of cardless and no-discount transactions in the past six months is 0. Use the first rule engine (such as the stream computing engine) to determine whether there is a cardless and no-discount type transaction. If so, add the first label (such as label A). If the transaction is labeled A, the dimension table of the Hbase database is associated with the transaction information (such as the card number) to query the number of cardless and no-discount transactions of the account in the past six months. If the number of associated transactions is zero, add an alarm label (such as label B). Then, if the transaction is labeled B, the transaction can be transmitted to the KAFKA table subscribed by the second rule engine (such as the real-time rule engine P8), and the alarm ID is defined as "WKWZ".

[0071] It should be noted that for details not included in this embodiment, please refer to the implementation details of the aforementioned embodiment.

[0072] It is understandable that by subdividing the first judgment caliber into the first caliber and the second caliber, a hierarchical and progressive analysis of transaction information is achieved. The first caliber focuses on quickly screening out transactions that may be risky, while the second caliber conducts a more in-depth assessment based on historical transaction information, thereby more accurately identifying real risky transactions and reducing false positives and false negatives.

[0073] On the basis of the above embodiments, in this embodiment, the transaction information carrying the alarm tag uses the second rule engine to determine whether the transaction information violates the second judgment caliber, and in response to the transaction information violating the second judgment caliber, the transaction request is intercepted, including: receiving the transaction information carrying the alarm tag, and caching the transaction date in the transaction information as the current natural day; using the second rule engine to determine whether the transaction information violates the second judgment caliber; in response to the transaction information violating the second judgment caliber, reading the cached transaction date and determining whether the transaction date is the current natural day; in response to the transaction information violating the second judgment caliber, intercepting the transaction request.

[0074] In some exemplary embodiments, referring to Figure 3 , for the second judgment caliber, if the transaction amount of the account's outgoing transaction is greater than two thousand, in the process of using the second rule engine for judgment, first receive the transaction with the alarm ID "WKWZ" from the stream computing engine, and cache the transaction date (that day) of the transaction. When the second rule engine detects an outgoing transaction greater than two thousand, read the transaction date cached by the account. If the transaction date is that day, it means that the alarm sent by the first rule engine to the second rule engine was received that day, which meets the first half of the rule, so the control strategy of "intercepting the transaction" is returned to intercept the transaction request.

[0075] It should be noted that for details not included in this embodiment, please refer to the implementation details of the aforementioned embodiment.

[0076] It can be understood that by judging whether the transaction date is the current natural day, the system can ensure that the interception operation is aimed at the risk transaction currently occurring, avoiding erroneous interception or missed interception due to processing delays or time dislocations. At the same time, the information is directly used in subsequent judgments to avoid repeated queries and calculations, thereby optimizing resource utilization and improving processing efficiency.

[0077] On the basis of the above embodiments, in this embodiment, before transmitting the transaction information to the first rule engine, it includes: judging whether the second rule engine can independently develop the preset rules in real time; when the second rule engine cannot independently develop the preset rules, splitting the preset rules to obtain a first judgment caliber and a second judgment caliber, wherein the first judgment caliber is the existing caliber of the first rule engine, and the second judgment caliber is whether the second rule engine can independently develop in real time.

[0078] Before submitting the transaction information to the first rule engine, the system will first evaluate the real-time development capabilities of the second rule engine. Specifically, check whether the second rule engine has the technical capabilities and resources to independently develop preset rules (i.e., a specific set of rules used to determine whether the transaction information is in violation of regulations) in real time, such as evaluating whether the second rule engine has transaction cache records corresponding to the transaction scenario, whether there is a judgment caliber for transactions in the transaction scenario corresponding to the preset rules, etc. If the second rule engine cannot independently develop a complete set of preset rules in real time, the preset rules can be decomposed into the first judgment caliber and the second judgment caliber. The first judgment caliber is what the first rule engine already has or can easily handle, and the second judgment caliber is what the second rule engine can independently develop in real time. After the split is completed, the split rules can be assigned to the corresponding engine according to the capabilities of each rule engine.

[0079] It is understandable that through pre-steps such as evaluation, it is possible to ensure that transaction information is fully pre-processed and optimized before being transmitted to the rule engine, thereby improving the processing efficiency and accuracy of the rule engine and providing strong support for subsequent risk judgment and transaction interception.

[0080] Based on the above embodiment, in this embodiment, in response to a transaction request of an account accessing a business terminal, obtaining transaction information of the account includes: identifying a transaction data source corresponding to the transaction information, and determining whether the transaction data source is an existing transaction data source of the first rule engine; when the transaction data source is an existing transaction data source of the first rule engine, obtaining the transaction information of the account.

[0081] When the system receives an account transaction request from the access service end, it can identify the transaction data source corresponding to the transaction information carried in the transaction request. The transaction data source is used to characterize the source channel, provider or data generation scenario of the transaction data. For example, the transaction data source of the stream computing engine is a transaction log, which records the detailed information of the transaction activities, and the transaction information is stored in the log file. Then, it is determined whether the transaction data source is already a transaction data source already available in the first rule engine to determine whether the first rule engine can be used to process the transaction information later, that is, when the second rule engine does not have a transaction data source corresponding to the preset rule, it can be processed by the first rule engine. For example, the second rule engine does not have a judgment caliber corresponding to the transaction scenario of no card and no discount, and does not have a cache record of historical no card and no discount transactions (i.e. historical transaction information), while the first rule engine has both, then the transaction information carried in the account transaction request can be obtained, and the transaction information can be further processed by the first rule engine.

[0082] It can be understood that by identifying the transaction data source corresponding to the transaction information and determining whether the data source is an existing transaction data source of the first rule engine, errors and anomalies caused by data source mismatch can be reduced, the stability and reliability of the system can be enhanced, and the success rate of transaction behavior monitoring can be improved.

[0083] Based on the above method for monitoring user transaction behavior, the present disclosure also provides a device for monitoring user transaction behavior. Figure 4 The device is described in detail.

[0084] Figure 4 The structural block diagram of the device for monitoring user transaction behavior according to an embodiment of the present disclosure is schematically shown.

[0085] like Figure 4 As shown, the device 400 for monitoring user transaction behavior of this embodiment includes an acquisition module 410 , a first judgment module 420 , a marking module 430 , a second judgment module 440 and an interception module 450 .

[0086] The acquisition module 410 is used to respond to a transaction request of an account accessing the service terminal and acquire the transaction information of the account. In one embodiment, the acquisition module 410 can be used to perform the operation S210 described above, which will not be described in detail here.

[0087] The first judgment module 420 is used to transmit the transaction information to the first rule engine, and the first rule engine determines whether the transaction information violates the first judgment criterion. In one embodiment, the first judgment module 420 can be used to perform the operation S220 described above, which will not be repeated here.

[0088] The labeling module 430 is used to add a warning tag to the transaction information in response to the transaction information violating the first judgment caliber, and transmit the transaction information carrying the warning tag to the second rule engine. In one embodiment, the labeling module 430 can be used to perform the operation S230 described above, which will not be repeated here.

[0089] The second judgment module 440 is used to judge whether the transaction information violates a second judgment caliber based on the transaction information carrying the alarm tag and using the second rule engine, wherein the second judgment caliber is different from the first judgment caliber, and the first judgment caliber and the first judgment caliber together constitute a preset rule. In one embodiment, the second judgment module 440 can be used to perform the operation S240 described above, which will not be repeated here.

[0090] The interception module 450 is used to intercept the transaction request in response to the transaction information violating the second judgment caliber. In one embodiment, the interception module 450 can be used to perform the operation S250 described above, which will not be repeated here.

[0091] According to an embodiment of the present disclosure, the first judgment module 420 may also be used to: cache the transaction information of the account to an Hbase database through the first rule engine.

[0092] According to an embodiment of the present disclosure, the first judgment module 420 is specifically used to: use the first rule engine to determine whether the transaction information violates the first caliber of the first judgment caliber, the first caliber being the first part of the first judgment caliber; when the transaction information violates the first caliber, add a first label to the transaction information, and associate the Hbase database through the transaction information to obtain historical transaction information of the account; based on the historical transaction information of the account, determine whether the transaction information carrying the first label violates the second caliber of the first judgment caliber, the second caliber being the second part of the first judgment caliber; when the transaction information violates the second caliber, add an alarm label to the transaction information.

[0093] According to an embodiment of the present disclosure, the second judgment module 440 is specifically used to: receive transaction information carrying the alarm tag, and cache the transaction date in the transaction information as the current natural day; use the second rule engine to determine whether the transaction information violates the second judgment caliber; in response to the transaction information violating the second judgment caliber, read the cached transaction date and determine whether the transaction date is the current natural day; in response to the transaction date being the current natural day, intercept the transaction request.

[0094] According to an embodiment of the present disclosure, the acquisition module 410 can also be used to: determine whether the second rule engine can independently develop the preset rules in real time; when the second rule engine cannot independently develop the preset rules, split the preset rules to obtain a first judgment caliber and a second judgment caliber, wherein the first judgment caliber is the existing one of the first rule engine, and the second judgment caliber is whether the second rule engine can independently develop in real time.

[0095] According to an embodiment of the present disclosure, the acquisition module 410 is specifically used to: identify the transaction data source corresponding to the transaction information, and determine whether the transaction data source is a transaction data source already available in the first rule engine; when the transaction data source is a transaction data source already available in the first rule engine, acquire the transaction information of the account.

[0096] According to an embodiment of the present disclosure, the first rule engine and the second rule engine are a combination of one or more of a real-time rule engine, a stream computing engine, and a batch rule engine.

[0097] According to an embodiment of the present disclosure, any multiple modules among the acquisition module 410, the first judgment module 420, the marking module 430, the second judgment module 440 and the interception module 450 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 410, the first judgment module 420, the marking module 430, the second judgment module 440 and the interception module 450 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the acquisition module 410, the first judgment module 420, the marking module 430, the second judgment module 440 and the interception module 450 can be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function can be executed.

[0098] Figure 5 A block diagram schematically shows an electronic device for a method of monitoring user transaction behavior according to an embodiment of the present disclosure.

[0099] like Figure 5 As shown, the electronic device 500 according to an embodiment of the present invention includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 to a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0100] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present invention by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present invention by executing the program stored in the one or more memories.

[0101] According to an embodiment of the present invention, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the I / O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.

[0102] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiment; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present invention is implemented.

[0103] According to an embodiment of the present invention, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present invention, the computer-readable storage medium may include the ROM 502 and / or RAM 503 described above and / or one or more memories other than ROM 502 and RAM 503.

[0104] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method for monitoring user transaction behavior provided by the embodiment of the present disclosure.

[0105] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 501. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0106] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0107] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0108] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0109] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0110] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0111] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for monitoring user transaction behavior, characterized in that: The method comprises: In response to a transaction request of an account accessing a service terminal, obtaining transaction information of the account; Transmitting the transaction information to a first rule engine, and determining by the first rule engine whether the transaction information violates a first judgment criterion; In response to the transaction information violating the first judgment criterion, adding a warning tag to the transaction information, and transmitting the transaction information carrying the warning tag to the second rule engine; Based on the transaction information carrying the alarm tag, using the second rule engine, determining whether the transaction information violates a second judgment caliber, wherein the second judgment caliber is different from the first judgment caliber, and the first judgment caliber and the first judgment caliber together constitute a preset rule; In response to the transaction information violating the second judgment criterion, the transaction request is intercepted.

2. The method according to claim 1, characterized in that The method further comprises: The transaction information of the account is cached in the Hbase database through the first rule engine.

3. The method according to claim 2, characterized in that The determining, by the first rule engine, whether the transaction information violates a first determination criterion, and in response to the transaction information violating the first determination criterion, adding an alarm tag to the transaction information comprises: Using the first rule engine, determining whether the transaction information violates a first caliber of the first judgment caliber, where the first caliber is a first part of the first judgment caliber; When the transaction information violates the first caliber, a first tag is added to the transaction information, and the Hbase database is associated with the transaction information to obtain historical transaction information of the account; Based on the historical transaction information of the account, judging whether the transaction information carrying the first tag violates a second caliber of the first judgment caliber, where the second caliber is a second part of the first judgment caliber; When the transaction information violates the second caliber, a warning tag is added to the transaction information.

4. The method according to claim 1, characterized in that: The determining, based on the transaction information carrying the warning tag, whether the transaction information violates the second judgment criteria by using the second rule engine, and intercepting the transaction request in response to the transaction information violating the second judgment criteria comprises: Receiving transaction information carrying the warning tag, and caching the transaction date in the transaction information as the current natural day; Using the second rule engine, determining whether the transaction information violates the second judgment criteria; In response to the transaction information violating the second judgment criterion, reading the cached transaction date, and determining whether the transaction date is the current natural day; In response to the transaction date being the current natural day, the transaction request is intercepted.

5. The method according to claim 1, characterized in that Before transmitting the transaction information to the first rule engine, the method includes: Determining whether the second rule engine can independently develop the preset rules in real time; When the second rule engine cannot independently develop the preset rule, the preset rule is split to obtain a first judgment caliber and a second judgment caliber, wherein the first judgment caliber is the existing one of the first rule engine, and the second judgment caliber is that the second rule engine can independently develop it in real time.

6. The method according to claim 1, characterized in that The step of obtaining transaction information of an account in response to a transaction request of an account accessing a service terminal includes: Identify a transaction data source corresponding to the transaction information, and determine whether the transaction data source is an existing transaction data source of the first rule engine; When the transaction data source is an existing transaction data source of the first rule engine, the transaction information of the account is obtained.

7. The method according to claim 1, characterized in that The first rule engine and the second rule engine are a combination of one or more of a real-time rule engine, a stream computing engine, and a batch rule engine.

8. A device for monitoring user transaction behavior, characterized in that: The device comprises: An acquisition module, configured to obtain transaction information of an account in response to a transaction request of an account accessing a service terminal; A first judgment module, used for transmitting the transaction information to a first rule engine, and judging whether the transaction information violates a first judgment criterion through the first rule engine; a labeling module, configured to, in response to the transaction information violating the first judgment criterion, add a warning label to the transaction information, and transmit the transaction information carrying the warning label to the second rule engine; A second judgment module, configured to judge whether the transaction information violates a second judgment caliber based on the transaction information carrying the alarm tag and using the second rule engine, wherein the second judgment caliber is different from the first judgment caliber, and the first judgment caliber and the first judgment caliber together constitute a preset rule; An interception module is used to intercept the transaction request in response to the transaction information violating the second judgment caliber.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, It is characterized in that when the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor executes the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images