Transaction risk identification method, related device, equipment and storage medium

Abstract

The invention discloses a transaction risk identification method, a related device, equipment and a storage medium, and the method comprises the steps: extracting the transaction characteristics of a current moment at least based on the transaction data of a target object at the current moment; processing the transaction characteristics at the current moment and the risk identification result at the historical moment based on a transaction risk identification model, and predicting the risk identification result of the target object at the current moment; wherein the historical moment is before the current moment, the transaction risk identification model carries out prediction through autoregression, and the transaction risk identification model carries out reinforcement learning by taking the risk identification proofreading model as a reference object in the training process. According to the scheme, the accuracy of transaction risk identification can be improved.

Description

Technical Field

[0001] The present application relates to the field of natural language processing technology, and in particular to a transaction risk identification method and related devices, equipment and storage media. Background Art

[0002] With the continuous development of artificial intelligence technology and Internet technology, banks and other financial enterprises put their products and services on the Internet to provide users with more convenient and satisfactory services. However, they are facing increasingly severe security challenges in marketing, transactions, ecology, content production and dissemination. Business risk control has gradually become a basic measure for enterprises to intelligently identify transaction risks.

[0003] At present, existing transaction risk identification technologies generally include: rule-based and blacklist-based methods, statistics and data mining-based methods, machine learning modeling-based methods, etc. However, these existing methods are difficult to ensure the accuracy of transaction risk identification. In view of this, how to improve the accuracy of transaction risk identification has become an urgent problem to be solved. Summary of the invention

[0004] The main technical problem solved by the present application is to provide a transaction risk identification method and related devices, equipment and storage media, which can improve the accuracy of transaction risk identification.

[0005] In order to solve the above technical problems, the first aspect of the present application provides a transaction risk identification method, including: extracting transaction features at the current moment based on at least the transaction data of the target object at the current moment; processing the transaction features at the current moment and the risk identification results at historical moments based on a transaction risk identification model, and predicting the risk identification results of the target object at the current moment; wherein, the historical moment is before the current moment, the transaction risk identification model performs prediction through autoregression, and the transaction risk identification model performs reinforcement learning with the risk identification proofreading model as a reference object during the training process.

[0006] In order to solve the above-mentioned technical problems, the second aspect of the present application provides a transaction risk identification device, including: a feature extraction module and a risk prediction module, the feature extraction module is used to extract the transaction features at the current moment based on at least the transaction data of the target object at the current moment; the risk prediction module is used to process the transaction features at the current moment and the risk identification results at the historical moments based on the transaction risk identification model, and predict the risk identification results of the target object at the current moment; wherein, the historical moment is before the current moment, the transaction risk identification model performs prediction through autoregression, and the transaction risk identification model performs reinforcement learning with the risk identification proofreading model as a reference object during the training process.

[0007] In order to solve the above technical problems, the third aspect of the present application provides an electronic device, which comprises at least a memory and a processor coupled to each other, wherein the memory stores at least program instructions, and the processor is used to execute the program instructions to implement the transaction risk identification method in the above first aspect.

[0008] In order to solve the above technical problems, the fourth aspect of the present application provides a computer-readable storage medium storing program instructions that can be executed by a processor, and the program instructions are used to implement the transaction risk identification method of the first aspect.

[0009] The above scheme extracts the transaction features at the current moment based on at least the transaction data of the target object at the current moment, and processes the transaction features at the current moment and the risk identification results at the historical moment based on the transaction risk identification model to predict the risk identification results of the target object at the current moment. The historical moment is before the current moment, and the transaction risk identification model predicts by autoregression. The transaction risk identification model uses the risk identification proofreading model as a reference object for reinforcement learning during the training process. Therefore, on the one hand, the transaction risk identification model combines the transaction features at the current moment and the risk identification results at the historical moment for autoregression, which can constrain the transaction risk identification model to follow the development law and internal relationship of the transaction events of the target object at different moments for risk prediction, which helps to improve the accuracy of transaction risk identification from the aspect of time series representation model learning. On the other hand, the transaction risk identification model uses the risk identification proofreading model as a reference object for reinforcement learning during the training process, so it can constrain the transaction risk identification model to align with the risk identification proofreading model in terms of abnormal discrimination, which helps to improve the accuracy of transaction risk identification from the aspect of reinforcement learning. Therefore, the accuracy of transaction risk identification can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 This is a flow chart of an embodiment of a transaction risk identification method of the present application; Figure 2a It is a process diagram of an embodiment of a transaction risk identification model reinforcement learning; Figure 2b It is a schematic diagram of a process of fine-tuning parameters of a data generation model according to an embodiment; Figure 2c is a schematic diagram of a process of generating synthetic data samples according to an embodiment; Figure 2d It is a process diagram of an embodiment of transaction risk identification; Figure 2e is a schematic diagram of an embodiment of a knowledge graph; Figure 2f is a schematic diagram of an embodiment of generating interpretable text; Figure 2g is a process diagram of an embodiment of a transaction risk notification; Figure 2h This is a process diagram of an embodiment of abnormal transaction stop payment; Figure 2i This is a process diagram of an embodiment of a transaction risk identification method of the present application; Figure 3 This is a schematic diagram of the framework of an embodiment of a transaction risk identification device of the present application; Figure 4 It is a schematic diagram of the framework of an embodiment of the electronic device of the present application; Figure 5 It is a schematic diagram of a framework of an embodiment of a computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0011] The scheme of the embodiment of the present application is described in detail below in conjunction with the drawings of the specification.

[0012] In the following description, for the purpose of explanation rather than limitation, specific details such as specific system structures, interfaces, and technologies are provided to facilitate a thorough understanding of the present application.

[0013] The terms "system" and "network" are often used interchangeably in this article. The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, the fragment " / " in this article generally indicates that the associated objects before and after are in an "or" relationship. In addition, "many" in this article means two or more than two.

[0014] See also Figure 1 , Figure 1 This is a flow chart of an embodiment of the transaction risk identification method of the present application. Specifically, it may include the following steps: Step S11: extracting transaction features at the current moment based at least on the transaction data of the target object at the current moment.

[0015] In an implementation scenario, the target object can be a natural person or an organization such as a company or a group, and the specific type of the target object is not limited here.

[0016] In an implementation scenario, the target object can be identified for transaction risk in real time. As a possible example, the target object can be identified for transaction risk every half a minute, or every one minute. Of course, the above examples are only several possible examples of real-time transaction risk identification, and the time interval for real-time identification is not limited here. It should be noted that although the above examples are all for transaction risk identification at fixed time intervals, in real scenarios, transaction risk identification can also be performed at intervals of non-fixed time intervals (such as, transaction risk identification is performed whenever a new transaction event is generated by the target object), which is also not limited here. Please refer to Table 1, which is a schematic table of an embodiment of the transaction data of the target object. As shown in Table 1, the target object "Zhang San" has three transaction flows in the transaction data within a certain period of time, among which there is a small transaction (for shopping) with the transaction object "Li Si", and there are two large transactions (for personal transfers) with the transaction object "Wang Wu" continuously and in a short period of time. Of course, Table 1 is only a possible example of transaction data within a certain period of time, and no examples are given here one by one. Exemplarily, when transaction risk identification is performed at a fixed time interval of "one minute", the three transaction flows shown in Table 1 will be used as transaction data at the current moment in the transaction risk identification process; or, when transaction risk identification is performed at a fixed time interval of "two minutes", the first transaction flow and the last two transaction flows shown in Table 1 will be used as transaction data at the current moment in the transaction risk identification process; or, when transaction risk identification is performed at a non-fixed time interval based on the generation of a new transaction event, the three transaction flows shown in Table 1 will be used as transaction data at the current moment in the transaction risk identification process.

[0017] Table 1 Schematic table of transaction data of target object in one embodiment

[0018] In an implementation scenario, each transaction flow in the transaction data of the target object at the current moment can be subjected to feature extraction to obtain sub-features of each transaction flow, and the sub-features of each transaction flow can form the transaction features of the target object at the current moment. For example, taking the extraction of transaction features by a large language model as an example, the transaction features can be expressed as: …… (1) In the above formula (1), Respectively represent each transaction flow in the target object's transaction data at the current moment, Represents the sub-features of each transaction flow, Represents the transaction features of the target object at the current moment. LLM stands for Large Language Model. It should be noted that since transaction data is the interaction behavior of users over a period of time, it is essentially an ordered sequence, and the large language model belongs to the Transformer architecture, the core of which is to predict the next token. For transaction data, the next action behavior is equivalent to the large language model predicting the next token in the word sequence. Compared with traditional feature extraction methods, feature extraction through large language models helps to improve the richness of feature information. In addition, as a possible example, the sub-features of each transaction flow mentioned above It can be expressed as: …… (2) In the above formula (2), Indicates the target object. Indicates the transaction object. Indicates the transaction time. Indicates other attributes (such as transaction purpose, etc.), which can be specifically combined with the above Table 1 and will not be described here one by one.

[0019] In another implementation scenario, different from the aforementioned implementation, as another possible example, feature extraction can be performed based on the image data of the target object to obtain the static features of the target object, and feature extraction can be performed based on the transaction data of the target object at the current moment to obtain the dynamic features of the target object at the current moment (such as the aforementioned formulas (1), (2) and related descriptions), and feature extraction can be performed based on reference data from an external source to obtain reference features. On this basis, feature fusion can be performed based on static features, dynamic features and reference features to obtain transaction features at the current moment. The above method can extract richer semantic information by fusing multi-dimensional information such as image data, transaction data and reference data.

[0020] In a specific implementation scenario, please refer to Table 2, which is a schematic table of an embodiment of a portrait data set. As shown in Table 2, the portrait data may include but is not limited to user ID, user name, user age, user occupation, emergency contact, account status, etc.

[0021] Table 2 Schematic diagram of an embodiment of image data

[0022] In a specific implementation scenario, the reference data from the external source may include, but is not limited to: external news, call texts, etc., and the reference data is not specifically limited here.

[0023] In a specific implementation scenario, similar to the feature extraction of transaction data mentioned above, feature extraction can also be performed based on a large language model for portrait data and reference data. For details, please refer to the above-mentioned related description, which will not be repeated here.

[0024] In a specific implementation scenario, taking the extraction of static features from a large language model as an example, the static features can be expressed as: …… (3) In the above formula (3), Represents the attribute values ​​in the image data. Sub-features representing the values ​​of each attribute, Represents static features.

[0025] In a specific implementation scenario, taking the case where reference features are extracted from a large language model, the reference features can be expressed as: …… (4) In the above formula (4), Indicates reference data from external sources, Represents the reference feature. On this basis, the above static features, reference features and the dynamic features at the current moment are fused (such as splicing) to serve as the transaction features of the target object at the current moment. For ease of description, the transaction features at moment n can be recorded as .

[0026] Step S12: Process the transaction characteristics at the current moment and the risk identification results at the historical moments based on the transaction risk identification model, and predict the risk identification results of the target object at the current moment.

[0027] In the disclosed embodiment, the historical moment is before the current moment. As a possible example, the historical moment includes at least the moment before the current moment. Taking the current moment t as an example, the historical moment may include at least the moment before t-1; or, as another possible example, in addition to this, the historical moment may also include the first moment 1 and the next moment 2 for identifying transaction risks. Of course, the above examples are only several possible examples of historical moments in actual applications, and the specific values ​​of historical moments are not limited here.

[0028] In the disclosed embodiment, the transaction risk identification model is predicted by autoregression, and the transaction risk identification model performs reinforcement learning with the risk identification proofreading model as a reference object during the training process. As a possible example, as mentioned above, the transaction features can be extracted from the large language model, and the transaction risk identification model can also belong to the large language model, so that the large model unified solution can be used in the entire process of transaction risk identification, which can not only provide a unified representation for downstream tasks, but also share information, which helps to improve interpretability. In addition, it should be noted that the risk identification proofreading model represents a neural network model of an artificial benchmark. Exemplarily, the risk identification proofreading model can be pre-trained with manually annotated data, and specific references can be made to relevant technical details such as supervised training; or, the risk identification proofreading model itself can also be trained in combination with artificial feedback and reinforcement learning (Reinforcement Learning from HumanFeedback, RLHF) during the training process, and specific references can be made to the technical details of RLHF, which will not be repeated here.

[0029] In an implementation scenario, during the training of the transaction risk identification model, the sample transaction features of the sample at the current moment can be extracted based on at least the sample transaction data of the sample object at the current moment of the sample. It should be noted that the process of extracting the sample transaction features can refer to the relevant description of the aforementioned transaction features, which will not be repeated here. On this basis, the sample transaction features of the sample at the current moment and the sample risk results of the sample at the historical moment can be processed based on the transaction risk identification model to obtain a first identification result, and the sample transaction data of the sample at the current moment can be processed based on the risk identification proofreading model to obtain a second identification result, and the sample historical moment is before the current moment of the sample. It should be noted that the specific setting of the sample historical moment can refer to the relevant description of the aforementioned historical moment, which will not be repeated here. After obtaining the first identification result and the second identification result, the network parameters of the transaction risk identification model can be adjusted based on at least the difference between the first identification result and the second identification result. It should be noted that the sample risk result at the sample historical moment can be the labeled risk result at the sample historical moment (i.e., whether there is a transaction anomaly manually labeled), or it can also be the risk identification result predicted by the transaction risk identification model at the sample historical moment, which is not limited here. The above method uses the second identification result of the risk identification and proofreading model as a reference object to constrain the transaction risk identification model, which can force the transaction risk identification model to be as close to the risk identification and proofreading model as possible.

[0030] In a specific implementation scenario, please refer to Figure 2a , Figure 2a Schematic diagram of the process of an embodiment of transaction risk identification model reinforcement learning. Figure 2aAs shown, the first recognition result may at least include a first probability value that the sample object has a transaction anomaly at the current moment of the sample, and the second recognition result may at least include a second probability value that the sample object has a transaction anomaly at the current moment of the sample. Then, based on the first probability value and the second probability value that the sample object has a transaction anomaly at the current moment of the sample, the risk recognition probability difference of the transaction risk recognition model and the risk recognition proofreading model for the same sample transaction data can be obtained, and then based on the distribution difference of the risk recognition probability difference of each sample transaction data respectively in the transaction risk recognition model and the risk recognition proofreading model, the network parameters are adjusted, and each sample transaction data includes: at least one of normal transaction data and abnormal transaction data. It should be noted that the above distribution difference can be specifically measured by a loss function such as KL divergence to constrain the prediction results of the transaction risk recognition model to be continuously aligned with the artificial results of the artificial benchmark, and finally to be close to the artificial cognitive level, which is not limited here. In the above manner, the model is constrained by probability difference, which helps to improve the prediction results of the transaction risk recognition model to be constantly close to the artificial benchmark, and is conducive to mining abnormal transaction behaviors.

[0031] In a specific implementation scenario, please continue to refer to Figure 2a , before adjusting the network parameters of the transaction risk identification model based at least on the difference between the first identification result and the second identification result, the first loss can also be obtained based on the difference between the first identification result and the risk labeling result of the sample transaction data (i.e., whether there is a transaction anomaly). As a possible example, the first loss can be obtained by measuring the difference between the first identification result and the risk labeling result based on a loss function such as cross entropy. For details, please refer to the technical details of the loss function such as cross entropy, which will not be repeated here. In addition, the second loss can be obtained based on the difference between the first identification result and the second identification result. For details, please refer to the above-mentioned related description, which will not be repeated here. On this basis, the network parameters of the transaction risk identification model can be adjusted based on the first loss and the second loss. Exemplarily, the first loss and the second loss can be fused (such as addition, weighting, etc.) to obtain the total loss, and then the network parameters of the transaction risk identification model can be adjusted based on the total loss. The above method, combined with the first loss and the second loss to jointly constrain the training process of the transaction risk identification model, can force the transaction risk identification model to have its prediction results as close to the labeling results as possible on the one hand, and can force the transaction risk identification model to have its prediction results as close to the artificial benchmark as possible on the other hand.

[0032] In one implementation scenario, the transaction risk identification model can be trained based on sample transaction data, and the sample transaction data can involve at least one of normal transaction data and abnormal transaction data. As a possible example, in order to enable the transaction risk identification model to learn abnormal transaction characteristics during the training process, the sample transaction data can involve both normal transaction data and abnormal transaction data. In addition, when the sample transaction data involves abnormal transaction data, at least part of the abnormal transaction data can be generated and expanded by the data generation model, thereby making up for the limitations of model training caused by the scarcity of abnormal transaction data in real scenarios as much as possible.

[0033] In a specific implementation scenario, the data generation model can be a large language model with fine-tuned parameters. Figure 2b , Figure 2b FIG. 1 is a schematic diagram of a process of fine-tuning parameters of a data generation model according to an embodiment. Figure 2b As shown, the first reference data represented by the reference object in a tabular form can be converted into the second reference data represented in a textual form, and the first reference data includes the portrait data (as shown in Table 2) and the transaction data (as shown in Table 1) of the reference object, and the transaction data in the first reference data at least involves abnormal transaction data (such as the second and third transaction flows in Table 1). On this basis, data enhancement can be performed based on the second reference data (for example, it can at least include word order adjustment) to obtain the third reference data, and then the parameters of the data generation model can be fine-tuned based on the second reference data and the third reference data. It should be noted that the specific process of parameter fine-tuning can refer to the technical details of parameter fine-tuning (Fine Tune), which will not be repeated here. In addition, before being processed by the data generation model, it can be first processed by tokenizer for word segmentation. The above method converts tabular data into textual data, and then performs text enhancement to obtain more samples, which are used for parameter fine-tuning, which helps to force the data generation model to learn data amplification and generation through as many samples as possible.

[0034] In a specific implementation scenario, please refer to Figure 2c , Figure 2c FIG. 1 is a schematic diagram of a process of generating synthetic data samples according to an embodiment. Figure 2c As shown, after the data generation model is fine-tuned, a reference text for guiding the generation of expansion can be obtained, and the reference text at least involves the portrait data of the object to be expanded (such as Figure 2cIn the example, the data is represented by the sample transaction data represented by the text form, and then the sample transaction data represented by the text form is converted into the sample transaction data represented by the table form. For example, the sample transaction data represented by the table form may include the portrait data of the newly added object "Zhao Er", the transaction flow of the newly added object "Zhao Er" (such as each flow may include the user ID of "Zhao Er", the user name of "Zhao Er", "flow number", "transaction time", "transaction amount", "transaction object", "whether abnormal", etc., please refer to the above-mentioned relevant description for details). It should be noted that, as mentioned above, before being processed by the data generation model, the data may be first processed by the tokenizer for word segmentation, and after being processed by the data generation model, the data may be reversely processed by the de-tokenizer to obtain the sample transaction data represented by the text form. The above method uses reference text as a guide during the data generation and amplification process, which can force the data generation model to generate data under certain constraints, and can ensure the generation quality of the data generation model as much as possible.

[0035] In an implementation scenario, after training a transaction risk identification model through the sample transaction data and model training steps in the above example, the transaction risk identification model can be used to identify risks in the transaction data of the target object at the current moment. Figure 2d , Figure 2d FIG. 1 is a schematic diagram of a process of an embodiment of transaction risk identification. Figure 2dAs shown, the features extracted from the portrait data, transaction data and reference data by the large language model are fused to obtain transaction features. At time 1, the transaction features corresponding to time 1 can be obtained, at time 2, the transaction features corresponding to time 2 can be obtained, and at time t, the transaction features corresponding to time t can be obtained. Exemplarily, when time 1 is the current time, since there is no historical time before this, the transaction features can be directly processed based on the transaction risk identification model to obtain the risk identification result of time 1, and when time 2 is the current time, since there is a historical time (i.e., time 1) before this, the transaction features of time 2 and the risk identification result of time 1 can be processed based on the transaction risk identification model to obtain the risk identification result of time 2. By analogy, when time t is the current time, since there is a historical time (i.e., time t-1, or it can further include time 1 and time 2) before this, the transaction features of time t and the risk identification results of historical times (i.e., time t-1, or it can further include time 1 and time 2) can be processed based on the transaction risk identification model to obtain the risk identification result of time t. It should be noted that the transaction risk identification model uses the current transaction characteristics and the risk identification results at historical moments (i.e., the model output results of the transaction risk identification model at historical moments) as model input to predict the current moment output, which is autoregression. In addition, the specific process of autoregression can be referred to the technical details of autoregression, which will not be repeated here.

[0036] In one implementation scenario, after processing the transaction characteristics at the current moment and the risk identification results at the historical moment based on the transaction risk identification model and predicting the risk identification results of the target object at the current moment, it is also possible to construct a knowledge graph of the target object at the current moment based on the portrait data of the target object and the transaction data at the current moment, and the nodes in the knowledge graph represent either the target object or the transaction object of the target object, and the connection between the node representing the target object and the node representing the transaction object represents the transaction flow between the target object and the transaction object. On this basis, a risk warning text expressed in natural language can be generated based on the portrait data of the target object, reference data from an external source, the knowledge graph of the target object at the current moment, transaction data and risk identification results. The above method, combined with the knowledge graph and other heterogeneous data to generate risk warning text expressed in natural language, can improve the accuracy, coherence and logic of the interpretability of the output text, and help make the output text easier to understand.

[0037] In a specific implementation scenario, please refer to Figure 2e , Figure 2e Schematic diagram of an embodiment of a knowledge graph. Figure 2eAs shown, please refer to Table 1 and Table 2. The node "Zhang San" represents the target object, while the nodes "Li Si" and "Wang Wu" represent the transaction objects, and the edge between the node "Zhang San" and the node "Li Si" represents the transaction flow (e.g., transaction amount 128, transaction time 12:30:00); similarly, the edge between the node "Zhang San" and the node "Wang Wu" represents the transaction flow (e.g., transaction amount 10,000, transaction time 22:23:00; transaction amount 12,000, transaction time 22:24:00). In addition, the knowledge graph can also contain other nodes, such as nodes representing attributes related to the target object (e.g., "doctor", "26 years old", "account status", etc.). Of course, Figure 2e What is shown is only a possible example of a knowledge graph in actual application, and the specific content of the knowledge graph is not limited here.

[0038] In a specific implementation scenario, such as Figure 2e As shown, the knowledge graph can be in the form of a multi-tuple, including the head entity target object, the tail entity transaction object, time information, other attributes, etc. Please refer to Figure 2f , Figure 2f is a schematic diagram of an embodiment of generating interpretable text. Figure 2f As shown, in addition, it can also include the portrait data of the target object, reference data from external sources, the target object's transaction data at the current moment, and the risk identification results, together as the input data of the large language model. It can even include transaction features, which are also input into the large language model. Similar to the above description, before and after the large language model processing, it can be processed by tokenizer for word segmentation and de-tokenizer for reverse processing, and in this process, it is subject to a series of output constraints such as fluency control, punctuation and typo correction, and manual intervention. In this way, all information enters the large language model after preliminary processing and is encoded and decoded to better unify and regularize multi-source data, ensure the controllable generation of the large language model, and make the output text of the large language model more accurate, coherent and logical. For the convenience of description, the input data of the large language model can be expressed as: …… (5) In the above formula (5), Represents the input data of the large language model, represents the transaction risk identification model. In addition, , , , For the specific meanings of the related parameters, please refer to the relevant descriptions in the above formulas (1) to (4), which will not be repeated here.

[0039] In a specific implementation scenario, the above input data is encoded by a large language model to obtain an output representation Y: …… (6) In the above formula (6), Represents input data, Generate functions for large language models, represents the large language model constraint function, such as the output constraints such as the aforementioned fluency control, It should be noted that the above output representation is further decoded by the large language model to obtain the risk warning text expressed in natural language, such as Figure 2f The output is "Zhang San and Wang Wu have two large transactions at night, which may be abnormal." Of course, the above example is only one possible situation in the actual application process, and it does not limit the specific content of the risk warning text. Other possible situations will not be given examples one by one here.

[0040] In an implementation scenario, please refer to Figure 2g , Figure 2g FIG. 1 is a process diagram of an embodiment of a transaction risk notification. Figure 2gAs shown, in response to the risk identification result indicating that there is a transaction anomaly, the target notification tool can be called in the preset notification tool set (such as, including but not limited to instant messaging tools, text messages, telephone voice, etc.), and a risk notification message suitable for the target notification tool is generated based on the risk warning text. For example, taking the aforementioned risk warning text "Zhang San and Wang Wu have two large transactions at night, which may be abnormal" as an example, when the preset notification tool "text message" is selected as the target notification tool, the risk notification message may include but is not limited to "

XX Bank

XX Bank

[0041] In an implementation scenario, please refer to Figure 2h , Figure 2g FIG. 1 is a schematic diagram of the process of an embodiment of abnormal transaction stop payment. Figure 2hAs shown, in response to receiving a risk confirmation message in response to a risk notification message, the target stop payment tool can be called in a preset stop payment tool set (e.g., including but not limited to cardholder active stop payment, card issuing bank stop payment, head office stop payment, fraud account protective stop payment, case-related emergency stop payment, etc.), and a target stop payment measure applicable to the target stop payment tool is generated based on the risk confirmation message. Exemplarily, when calling "card issuing bank stop payment" as the target stop payment tool, a target stop payment measure applicable to "card issuing bank stop payment" can be generated based on the risk confirmation message, such as "transaction flow, transaction parties" and other information. On this basis, the target stop payment tool can be called to execute the target stop payment measure, and the risk notification message is generated when the risk identification result indicates that there is a transaction anomaly and at least notifies the target object. For details, please refer to the above-mentioned related description, which will not be repeated here. In the above method, in response to receiving a risk confirmation message in reply to a risk notification message, a target stop payment tool is called within a preset stop payment tool set, and a target stop payment measure applicable to the target stop payment tool is generated based on the risk confirmation message, and the target stop payment tool is called to execute the target stop payment measure. Moreover, the risk notification message is generated when the risk identification result indicates that there is a transaction anomaly and at least the target object is notified, so that the transaction security can be improved as much as possible.

[0042] In one implementation scenario, see Figure 2i , Figure 2i This is a process diagram of an embodiment of the transaction risk identification method of the present application. Figure 2i As shown, the corresponding features of the portrait data, transaction data, and reference data are extracted and fused by the large language model to obtain transaction features, which are sent to the transaction risk identification model for prediction to obtain the risk identification result of the target object at the current moment. At the same time, the knowledge graph can be generated by combining the portrait data, transaction data and other related data, and the knowledge graph, portrait data, transaction data, reference data, and the aforementioned transaction features and risk identification results are input into the large language model together to obtain the risk warning text expressed in natural language, and then the relevant notification tool is called to send the risk notification message generated by the risk warning text to the target object, the electronic fraud center and other related targets, so that after receiving the risk confirmation message of the risk notification message, the relevant stop payment tool is called to execute the stop payment measure on the transaction flow of the confirmed risk. With the above process, the transaction risk identification and control can be realized in the three key processes of account management, risk monitoring, and post-control, which helps to improve the transaction security.

[0043] The above scheme extracts the transaction features at the current moment based on at least the transaction data of the target object at the current moment, and processes the transaction features at the current moment and the risk identification results at the historical moment based on the transaction risk identification model to predict the risk identification results of the target object at the current moment. The historical moment is before the current moment, and the transaction risk identification model predicts by autoregression. The transaction risk identification model uses the risk identification proofreading model as a reference object for reinforcement learning during the training process. Therefore, on the one hand, the transaction risk identification model combines the transaction features at the current moment and the risk identification results at the historical moment for autoregression, which can constrain the transaction risk identification model to follow the development law and internal relationship of the transaction events of the target object at different moments for risk prediction, which helps to improve the accuracy of transaction risk identification from the aspect of time series representation model learning. On the other hand, the transaction risk identification model uses the risk identification proofreading model as a reference object for reinforcement learning during the training process, so it can constrain the transaction risk identification model to align with the risk identification proofreading model in terms of abnormal discrimination, which helps to improve the accuracy of transaction risk identification from the aspect of reinforcement learning. Therefore, the accuracy of transaction risk identification can be improved.

[0044] See also Figure 3 , Figure 3 It is a schematic diagram of the framework of an embodiment of the transaction risk identification device of the present application. The transaction risk identification device 30 includes: a feature extraction module 31 and a risk prediction module 32. The feature extraction module 31 is used to extract the transaction features at the current moment based on at least the transaction data of the target object at the current moment; the risk prediction module 32 is used to process the transaction features at the current moment and the risk identification results at the historical moments based on the transaction risk identification model, and predict the risk identification results of the target object at the current moment; wherein, the historical moment is before the current moment, the transaction risk identification model is predicted by autoregression, and the transaction risk identification model is reinforced learning with the risk identification proofreading model as a reference object during the training process.

[0045] In the above scheme, the transaction risk identification device 30 extracts the transaction features at the current moment based on at least the transaction data of the target object at the current moment, and processes the transaction features at the current moment and the risk identification results at the historical moments based on the transaction risk identification model, predicts the risk identification results of the target object at the current moment, and the historical moment is before the current moment, and the transaction risk identification model predicts by autoregression. The transaction risk identification model uses the risk identification proofreading model as a reference object for reinforcement learning during the training process. Therefore, on the one hand, the transaction risk identification model performs autoregression by combining the transaction features at the current moment and the risk identification results at the historical moments, which can constrain the transaction risk identification model to follow the development law and internal relationship of the transaction events of the target object at different moments for risk prediction, which helps to improve the accuracy of transaction risk identification from the aspect of time series representation model learning. On the other hand, the transaction risk identification model uses the risk identification proofreading model as a reference object for reinforcement learning during the training process, so it can constrain the transaction risk identification model to align with the risk identification proofreading model in terms of abnormal discrimination, which helps to improve the accuracy of transaction risk identification from the aspect of reinforcement learning. Therefore, the accuracy of transaction risk identification can be improved.

[0046] In some disclosed embodiments, the transaction risk identification device 30 includes a sample extraction module, which is used to extract sample transaction features of the sample at the current moment based on at least the sample transaction data of the sample object at the current moment of the sample; the transaction risk identification device 30 includes a sample prediction module, which is used to process the sample transaction features of the sample at the current moment and the sample risk results of the sample at the historical moment based on the transaction risk identification model to obtain a first identification result, and process the sample transaction data of the sample at the current moment based on the risk identification proofreading model to obtain a second identification result; wherein the sample historical moment is before the current moment of the sample; the transaction risk identification device 30 includes a parameter adjustment module, which is used to adjust the network parameters of the transaction risk identification model based on at least the difference between the first identification result and the second identification result.

[0047] In some disclosed embodiments, the first recognition result includes at least a first probability value that a transaction anomaly exists for the sample object at the current moment of the sample, and the second recognition result includes at least a second probability value that a transaction anomaly exists for the sample object at the current moment of the sample. The parameter adjustment module includes a deviation acquisition submodule for obtaining, based on the first probability value and the second probability value that a transaction anomaly exists for the sample object at the current moment of the sample, the risk identification probability difference between the transaction risk identification model and the risk identification proofreading model for the same sample transaction data; the parameter adjustment module includes a parameter adjustment submodule for adjusting network parameters based on the distribution difference of the risk identification probability difference between the transaction risk identification model and the risk identification proofreading model for each sample transaction data, respectively; wherein each sample transaction data includes: at least one of normal transaction data and abnormal transaction data.

[0048] In some disclosed embodiments, the transaction risk identification device 30 includes a loss measurement module for obtaining a first loss based on a difference between a first identification result and a risk labeling result of sample transaction data; the parameter adjustment module is specifically used to obtain a second loss based on a difference between the first identification result and the second identification result, and adjust network parameters based on the first loss and the second loss.

[0049] In some disclosed embodiments, the transaction risk identification model is trained based on sample transaction data, the sample transaction data involves at least one of normal transaction data and abnormal transaction data, and at least part of the abnormal transaction data is generated and expanded by a data generation model.

[0050] In some disclosed embodiments, the data generation model is a large language model with fine-tuned parameters, and the transaction risk identification device 30 includes a first conversion module for converting first reference data represented in tabular form based on a reference object into second reference data represented in text form; wherein the first reference data includes portrait data and transaction data of the reference object, and the transaction data in the first reference data at least involves abnormal transaction data; the transaction risk identification device 30 includes a data enhancement module for performing data enhancement based on the second reference data to obtain third reference data; wherein the data enhancement at least includes word order adjustment; the transaction risk identification device 30 includes a parameter fine-tuning module for performing parameter fine-tuning on the data generation model based on the second reference data and the third reference data.

[0051] In some disclosed embodiments, the transaction risk identification device 30 includes a text acquisition module for acquiring a reference text for guiding the generation of expansion; wherein the reference text at least involves portrait data of the object to be expanded; the transaction risk identification device 30 includes a data expansion module for processing the reference text based on a data generation model to obtain sample transaction data represented in text form; the transaction risk identification device 30 includes a second conversion module for converting the sample transaction data represented in text form into sample transaction data represented in tabular form.

[0052] In some disclosed embodiments, the transaction risk identification device 30 includes a graph construction module for constructing a knowledge graph of the target object at the current moment based on the portrait data of the target object and the transaction data at the current moment; wherein the nodes in the knowledge graph represent either the target object or the transaction object of the target object, and the lines between the nodes representing the target object and the nodes representing the transaction object represent the transaction flow between the target object and the transaction object; the transaction risk identification device 30 includes a text generation module for generating a risk warning text expressed in natural language based on the portrait data of the target object, reference data from an external source, the knowledge graph of the target object at the current moment, the transaction data and the risk identification results.

[0053] In some disclosed embodiments, the transaction risk identification device 30 includes a risk notification module, which is used to call a target notification tool in a preset notification tool set in response to the risk identification result indicating the existence of a transaction anomaly, and generate a risk notification message suitable for the target notification tool based on the risk warning text, and call the target notification tool to send the risk notification message to the target terminal; wherein the target terminal at least includes a user terminal of the target object.

[0054] In some disclosed embodiments, the transaction risk identification device 30 includes a transaction stop payment module, which is used to call a target stop payment tool in a preset stop payment tool set in response to a risk confirmation message received in response to a risk notification message, and generate a target stop payment measure applicable to the target stop payment tool based on the risk confirmation message, and call the target stop payment tool to execute the target stop payment measure; wherein the risk notification message is generated when the risk identification result indicates the existence of a transaction anomaly and at least notifies the target object.

[0055] In some disclosed embodiments, the feature extraction module 31 includes a portrait extraction submodule, which is used to perform feature extraction based on the portrait data of the target object to obtain the static features of the target object; the feature extraction module 31 includes a transaction extraction submodule, which is used to perform feature extraction based on the transaction data of the target object at the current moment to obtain the dynamic features of the target object at the current moment; the feature extraction module 31 includes a reference extraction submodule, which is used to perform feature extraction based on reference data from an external source to obtain reference features; the feature extraction module 31 includes a feature fusion submodule, which is used to perform feature fusion based on static features, dynamic features and reference features to obtain transaction features at the current moment.

[0056] In some disclosed embodiments, the historical moments include at least the moment before the current moment, the first moment and the second moment when the transaction risk is identified; and / or, the transaction features are extracted by a large language model, and the transaction risk identification model belongs to the large language model.

[0057] See also Figure 4 , Figure 4 : is a schematic diagram of a framework of an embodiment of an electronic device of the present application. The electronic device 40 includes at least a memory 41 and a processor 42 coupled to each other, the memory 41 stores at least program instructions, and the processor 42 is used to execute the program instructions to implement the steps in any of the above transaction risk identification method embodiments. For details, please refer to the aforementioned disclosed embodiments, which will not be repeated here. As a possible example, the electronic device 40 may include but is not limited to a server, etc., and the specific type of the electronic device 40 is not limited here.

[0058] Specifically, the processor 42 is used to control itself and the memory 41 to implement the steps in any of the above transaction risk identification method embodiments. The processor 42 can also be called a CPU (Central Processing Unit). The processor 42 may be an integrated circuit chip with signal processing capabilities. The processor 42 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. In addition, the processor 42 can be implemented by an integrated circuit chip.

[0059] In the above scheme, the electronic device 40 extracts the transaction features at the current moment based on at least the transaction data of the target object at the current moment, and processes the transaction features at the current moment and the risk identification results at the historical moment based on the transaction risk identification model, predicts the risk identification results of the target object at the current moment, and the historical moment is before the current moment, and the transaction risk identification model predicts by autoregression. The transaction risk identification model uses the risk identification proofreading model as a reference object for reinforcement learning during the training process. Therefore, on the one hand, the transaction risk identification model performs autoregression by combining the transaction features at the current moment and the risk identification results at the historical moment, which can constrain the transaction risk identification model to follow the development law and internal relationship of the transaction events of the target object at different moments for risk prediction, which helps to improve the accuracy of transaction risk identification from the aspect of time series representation model learning. On the other hand, the transaction risk identification model uses the risk identification proofreading model as a reference object for reinforcement learning during the training process, so it can constrain the transaction risk identification model to align with the risk identification proofreading model in terms of abnormal discrimination, which helps to improve the accuracy of transaction risk identification from the aspect of reinforcement learning. Therefore, the accuracy of transaction risk identification can be improved.

[0060] See also Figure 5 , Figure 5 The figure is a schematic diagram of a framework of an embodiment of a computer-readable storage medium 50 of the present application. The computer-readable storage medium 50 stores program instructions 51 that can be executed by a processor, and the program instructions 51 are used to implement the steps in any of the above transaction risk identification method embodiments.

[0061] In the above scheme, the computer-readable storage medium 50 extracts the transaction features at the current moment based on at least the transaction data of the target object at the current moment, and processes the transaction features at the current moment and the risk identification results at the historical moment based on the transaction risk identification model, predicts the risk identification results of the target object at the current moment, and the historical moment is before the current moment, and the transaction risk identification model predicts by autoregression. The transaction risk identification model uses the risk identification proofreading model as a reference object for reinforcement learning during the training process. Therefore, on the one hand, the transaction risk identification model performs autoregression by combining the transaction features at the current moment and the risk identification results at the historical moment, which can constrain the transaction risk identification model to follow the development law and internal relationship of the transaction events of the target object at different moments for risk prediction, which helps to improve the accuracy of transaction risk identification from the aspect of time series representation model learning. On the other hand, the transaction risk identification model uses the risk identification proofreading model as a reference object for reinforcement learning during the training process, so it can constrain the transaction risk identification model to align with the risk identification proofreading model in terms of abnormal discrimination, which helps to improve the accuracy of transaction risk identification from the aspect of reinforcement learning. Therefore, the accuracy of transaction risk identification can be improved.

[0062] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0063] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0064] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0065] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0066] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0067] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0068] If the technical solution of this application involves personal information, the product using the technical solution of this application has clearly informed the personal information processing rules and obtained the individual's voluntary consent before processing the personal information. If the technical solution of this application involves sensitive personal information, the product using the technical solution of this application has obtained the individual's separate consent before processing the sensitive personal information, and at the same time meets the "explicit consent" requirement. For example, on personal information collection devices such as cameras, clear and prominent signs are set to inform that the personal information collection scope has been entered and personal information will be collected. If the individual voluntarily enters the collection scope, it is deemed that he or she agrees to the collection of his or her personal information; or on the device that processes personal information, the personal information processing rules are notified by obvious signs / information, and the individual's authorization is obtained through pop-up information or by asking the individual to upload his or her personal information; among them, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the type of personal information processed.

Claims

1. A transaction risk identification method, characterized in that: include: Extracting transaction features at the current moment based at least on the transaction data of the target object at the current moment; Processing the transaction characteristics at the current moment and the risk identification results at historical moments based on the transaction risk identification model, and predicting the risk identification result of the target object at the current moment; Among them, the historical moment is before the current moment, the transaction risk identification model is predicted by autoregression, and the transaction risk identification model is reinforced learning with the risk identification proofreading model as a reference object during the training process.

2. The method according to claim 1, characterized in that The training steps of the transaction risk identification model include: Extracting sample transaction features of the sample at the current moment based at least on sample transaction data of the sample object at the current moment of the sample; Processing the sample transaction features of the sample at the current moment and the sample risk results of the sample at the historical moment based on the transaction risk identification model to obtain a first identification result, and processing the sample transaction data of the sample at the current moment based on the risk identification proofreading model to obtain a second identification result; wherein the sample historical moment is before the current moment of the sample; Based at least on a difference between the first identification result and the second identification result, a network parameter of the transaction risk identification model is adjusted.

3. The method according to claim 2, characterized in that The first recognition result at least includes a first probability value that the sample object has a transaction anomaly at the current moment of the sample, and the second recognition result at least includes a second probability value that the sample object has a transaction anomaly at the current moment of the sample, and adjusting the network parameters of the transaction risk identification model based at least on the difference between the first recognition result and the second recognition result includes: Based on a first probability value and a second probability value that the sample object has a transaction anomaly at the current moment of the sample, a risk identification probability difference between the transaction risk identification model and the risk identification proofreading model for the same sample transaction data is obtained; Adjusting the network parameters based on the distribution difference of the risk identification probability difference of each of the sample transaction data respectively between the transaction risk identification model and the risk identification and proofreading model; Each of the sample transaction data includes at least one of normal transaction data and abnormal transaction data.

4. The method according to claim 2, characterized in that: Before adjusting the network parameters of the transaction risk identification model based at least on the difference between the first identification result and the second identification result, the method further includes: Obtaining a first loss based on a difference between the first recognition result and a risk labeling result of the sample transaction data; The adjusting the network parameters of the transaction risk identification model based at least on the difference between the first identification result and the second identification result includes: A second loss is obtained based on a difference between the first recognition result and the second recognition result, and the network parameters are adjusted based on the first loss and the second loss.

5. The method according to claim 1, characterized in that The transaction risk identification model is trained based on sample transaction data, where the sample transaction data involves at least one of normal transaction data and abnormal transaction data, and at least part of the abnormal transaction data is generated and expanded by a data generation model.

6. The method according to claim 5, characterized in that The data generation model is a large language model with fine-tuned parameters, and the parameter fine-tuning step includes: Based on first reference data represented by a reference object in a tabular form, converting into second reference data represented in a text form; wherein the first reference data includes the portrait data and transaction data of the reference object, and the transaction data in the first reference data at least involves the abnormal transaction data; Performing data enhancement based on the second reference data to obtain third reference data; wherein the data enhancement at least includes word order adjustment; Based on the second reference data and the third reference data, fine-tune the parameters of the data generation model.

7. The method according to claim 5, characterized in that The step of generating the expansion comprises: Acquire a reference text for guiding the generation of the expansion; wherein the reference text at least involves the portrait data of the object to be expanded; Processing the reference text based on the data generation model to obtain sample transaction data represented in text form; Based on the sample transaction data represented in text form, the sample transaction data is converted into the sample transaction data represented in table form.

8. The method according to claim 1, characterized in that After processing the transaction features at the current moment and the risk identification results at historical moments based on the transaction risk identification model and predicting the risk identification result of the target object at the current moment, the method further includes: Based on the portrait data of the target object and the transaction data at the current moment, a knowledge graph of the target object at the current moment is constructed; wherein the nodes in the knowledge graph represent any one of the target object and the transaction object of the target object, and the connection between the node representing the target object and the node representing the transaction object represents the transaction flow between the target object and the transaction object; Based on the portrait data of the target object, reference data from external sources, the knowledge graph of the target object at the current moment, transaction data and risk identification results, a risk warning text expressed in natural language is generated.

9. The method according to claim 8, characterized in that The method further comprises: In response to the risk identification result indicating the existence of a transaction anomaly, a target notification tool is called within a preset notification tool set, and a risk notification message suitable for the target notification tool is generated based on the risk warning text, and the target notification tool is called to send the risk notification message to a target terminal; wherein the target terminal includes at least a user terminal of the target object.

10. The method according to claim 8, characterized in that The method further comprises: In response to receiving a risk confirmation message in reply to a risk notification message, a target stop payment tool is called within a preset stop payment tool set, and a target stop payment measure applicable to the target stop payment tool is generated based on the risk confirmation message, and the target stop payment tool is called to execute the target stop payment measure; wherein, the risk notification message is generated when the risk identification result indicates the existence of a transaction anomaly and at least notifies the target object.

11. The method according to claim 1, characterized in that: The extracting the transaction features at the current moment based at least on the transaction data of the target object at the current moment includes: Performing feature extraction based on the portrait data of the target object to obtain static features of the target object, performing feature extraction based on the transaction data of the target object at the current moment to obtain dynamic features of the target object at the current moment, and performing feature extraction based on reference data from an external source to obtain reference features; Feature fusion is performed based on the static feature, the dynamic feature and the reference feature to obtain the transaction feature at the current moment.

12. The method according to any one of claims 1 to 11, characterized in that: The historical moments include at least the moment before the current moment, the first moment and the next moment of identifying the transaction risk; and / or, The transaction features are extracted from a large language model, and the transaction risk identification model belongs to the large language model.

13. A transaction risk identification device, characterized in that: include: A feature extraction module, configured to extract transaction features at the current moment based at least on the transaction data of the target object at the current moment; A risk prediction module, used to process the transaction characteristics at the current moment and the risk identification results at historical moments based on the transaction risk identification model, and predict the risk identification result of the target object at the current moment; Among them, the historical moment is before the current moment, the transaction risk identification model is predicted by autoregression, and the transaction risk identification model is reinforced learning with the risk identification proofreading model as a reference object during the training process.

14. An electronic device, characterized in that: The method comprises at least a memory and a processor coupled to each other, wherein the memory at least stores program instructions, and the processor is used to execute the program instructions to implement the transaction risk identification method according to any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that: Program instructions that can be executed by a processor are stored, and the program instructions are used to implement the transaction risk identification method described in any one of claims 1 to 12.

Images