Account risk level prediction method and device based on account transaction characteristics

Abstract

The invention provides an account risk level prediction method and device based on account transaction features, which can be used in the technical field of artificial intelligence, and the method comprises the steps: carrying out the feature extraction and classification according to original user information, original account information and original transaction detail information, and generating account transaction feature matrixes of different account classifications; training the decision tree according to the account transaction feature matrixes of the different account classifications and pre-generated index feature weights, and generating account transaction risk prediction models corresponding to the different account classifications; through account transaction risk prediction models corresponding to different account classifications, risk prediction is carried out on to-be-identified account transaction features, account risk levels are generated, fine-grained division is carried out on different types of accounts in combination with user information, account information and transaction detail information, the comprehensiveness, accuracy and adaptability of risk prediction are improved, and the risk prediction efficiency is improved. Therefore, a comprehensive, efficient and accurate anomaly monitoring effect is realized.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, in particular to the field of artificial intelligence technology, and more particularly to a method and device for predicting account risk levels based on account transaction characteristics. Background Art

[0002] With the continuous advancement of science and technology in today's society, users' disguise methods for abnormal accounts have become more complex and hidden. Transaction abnormality monitoring is a common problem in the current financial industry. At the same time, with the continuous development of the Internet, the amount of transaction data has increased exponentially, which has greatly increased the difficulty of transaction abnormality monitoring for banks and other financial institutions. In related technologies, the traditional abnormal transaction monitoring method is mainly based on the statistical identification of abnormal transaction rules summarized by experts, such as large single transaction amount, high transaction frequency in a short period of time, etc., focusing on statistical account transaction indicators, building abnormal transaction rule models, calculating whether the transaction indicators are abnormal, and then judging whether the account is abnormal; or, using machine learning algorithms to train models for massive historical transaction details, and judging whether the account is abnormal through the trained machine learning model. However, the traditional abnormal transaction rule model relies on preset rules for statistical analysis, and the rule iteration is slow, which cannot adapt to the current situation of rapid economic development and skyrocketing transaction volume. Machine learning algorithms are usually based only on account transaction data, but account anomalies usually involve multi-dimensional influencing factors, and there are transaction differences between different accounts, with a high misjudgment rate, which increases a lot of manual screening costs. It can be seen that both current methods have problems such as one-sidedness, poor adaptability, and low accuracy. Summary of the invention

[0003] One object of the present invention is to provide an account risk level prediction method based on account transaction characteristics, which combines user information, account information and transaction details information, performs fine-grained division of different types of accounts, and uses a decision tree algorithm to generate personalized anomaly identification rules for each type of account group to predict the risk level of the account, thereby improving the comprehensiveness, accuracy and adaptability of risk prediction, thereby achieving a comprehensive, efficient and accurate anomaly monitoring effect. Another object of the present invention is to provide an account risk level prediction device based on account transaction characteristics. Another object of the present invention is to provide a computer-readable medium. Another object of the present invention is to provide a computer device.

[0004] In order to achieve the above objectives, the present invention discloses, on one hand, a method for predicting account risk level based on account transaction characteristics, comprising:

[0005] Obtain original user information, original account information, and original transaction details;

[0006] Extract and classify features based on original user information, original account information, and original transaction details to generate account transaction feature matrices for different account classifications;

[0007] According to the account transaction feature matrix of different account classifications and the pre-generated indicator feature weights, the decision tree is trained to generate the account transaction risk prediction model corresponding to different account classifications;

[0008] Through the account transaction risk prediction model corresponding to different account classifications, risk prediction is performed on the account transaction characteristics to be identified to generate the account risk level.

[0009] Preferably, the original account information includes full account information and abnormal list account information;

[0010] Feature extraction and classification are performed based on the original user information, original account information, and original transaction details information to generate account transaction feature matrices for different account classifications, including:

[0011] Perform account association based on the full account information and the account information on the exception list, and generate an account association information table;

[0012] Perform data cleaning on the original user information, account association information table and original transaction details information to generate cleaned user information table, account association information table and transaction details information table;

[0013] Perform data integration and account classification on the user information table, account association information table and transaction detail information table to generate account transaction feature matrices for different account classifications.

[0014] Preferably, data integration and account classification are performed on the user information table, the account association information table and the transaction detail information table to generate an account transaction feature matrix of different account classifications, including:

[0015] The user information table and the account association information table are associated and merged to generate an account feature table;

[0016] Perform one-way data conversion on the transaction details information table to generate a one-way transaction table;

[0017] Perform feature conversion on the one-way transaction table to generate a transaction feature table;

[0018] The account feature table and the transaction feature table are associated and merged to generate the original account transaction feature table;

[0019] Use clustering algorithm to classify the account feature table and generate account classification results;

[0020] Key features are extracted based on the account classification results and the original account transaction feature table to generate account transaction feature matrices for different account classifications.

[0021] Preferably, the method further comprises:

[0022] Extract key features from the original account transaction feature table to obtain multiple groups of feature variables and corresponding target variables;

[0023] Through the hierarchical analysis method, weights are calculated based on multiple groups of characteristic variables and corresponding target variables to generate indicator characteristic weights.

[0024] Preferably, the account transaction risk prediction model corresponding to different account classifications is used to perform risk prediction on the account transaction features to be identified and generate an account risk level, including:

[0025] According to the account transaction feature matrix of different account categories, determine the target account category to which the account transaction feature to be identified belongs;

[0026] According to the classification of target accounts, determine the corresponding target account transaction risk prediction model;

[0027] Through the target account transaction risk prediction model, risk prediction is performed on the account transaction characteristics to be identified to generate the account risk level.

[0028] Preferably, after performing risk prediction on the account transaction features to be identified and generating the account risk level through the account transaction risk prediction models corresponding to different account classifications, the method further includes:

[0029] Determine whether the current transaction has abnormal risks based on the account risk level;

[0030] If it exists, the corresponding risk control plan will be matched according to the account risk level through the preset risk control strategy.

[0031] The present invention also discloses an account risk level prediction device based on account transaction characteristics, comprising:

[0032] A data collection unit, used to obtain original user information, original account information and original transaction details;

[0033] A data processing unit, used to extract and classify features based on original user information, original account information and original transaction details information, and generate account transaction feature matrices for different account classifications;

[0034] A model training unit, used to train the decision tree according to the account transaction feature matrix of different account classifications and the pre-generated indicator feature weights, and generate an account transaction risk prediction model corresponding to different account classifications;

[0035] The risk level prediction unit is used to perform risk prediction on the account transaction features to be identified through the account transaction risk prediction models corresponding to different account classifications, and generate the account risk level.

[0036] The present invention also discloses a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the method described above is implemented.

[0037] The present invention also discloses a computer device, including a memory and a processor, wherein the memory is used to store information including program instructions, the processor is used to control the execution of program instructions, and the processor implements the above method when executing the program.

[0038] The present invention also discloses a computer program product, including a computer program / instruction, and the method described above is implemented when the computer program / instruction is executed by a processor.

[0039] The present invention obtains original user information, original account information and original transaction detail information; performs feature extraction and classification according to the original user information, original account information and original transaction detail information, and generates account transaction feature matrices of different account classifications; trains a decision tree according to the account transaction feature matrices of different account classifications and pre-generated indicator feature weights, and generates account transaction risk prediction models corresponding to different account classifications; performs risk prediction on account transaction features to be identified through the account transaction risk prediction models corresponding to different account classifications, generates account risk levels, combines user information, account information and transaction detail information, performs fine-grained division of different types of accounts, adopts a decision tree algorithm to generate personalized anomaly recognition rules for each type of account group, predicts the risk level of the account, and improves the comprehensiveness, accuracy and adaptability of risk prediction, thereby achieving a comprehensive, efficient and accurate anomaly monitoring effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 A flowchart of a method for predicting account risk level based on account transaction characteristics provided by an embodiment of the present invention;

[0042] Figure 2 A flowchart of another method for predicting account risk level based on account transaction characteristics provided by an embodiment of the present invention;

[0043] Figure 3 A schematic diagram of a data integration structure provided by an embodiment of the present invention;

[0044] Figure 4 A schematic diagram of a characteristic variable structure based on the hierarchical analysis method provided by an embodiment of the present invention;

[0045] Figure 5 A schematic diagram of the structure of an account risk level prediction device based on account transaction characteristics provided by an embodiment of the present invention;

[0046] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] It should be noted that the method and device for predicting account risk level based on account transaction characteristics disclosed in the present application can be used in the field of artificial intelligence technology, and can also be used in any field outside the field of artificial intelligence technology. The application field of the method and device for predicting account risk level based on account transaction characteristics disclosed in the present application is not limited.

[0049] In order to facilitate the understanding of the technical solution provided by this application, the relevant contents of the technical solution of this application are first explained below. For the data basis of account abnormality monitoring, in addition to transaction behavior, an important feature of suspicious fund transactions is that the fund transactions are contrary to their transaction background, such as the nature of the account, the age and income of the user, etc. Therefore, the present invention will combine user information, account information and transaction data as the data basis for model training.

[0050] In view of the fact that the current abnormal transaction monitoring technology in the financial industry lacks analysis of users themselves and their account types, and does not take into account the transaction differences of different types of accounts, the present invention proposes an account risk level prediction method that fully combines user information, account information and transaction data, divides different types of accounts into more fine-grained categories, and uses a decision tree algorithm to generate personalized abnormal identification rules for each type of account group, predict the risk level of the account, and then determine whether the transaction is abnormal, and promptly remind relevant staff according to the prediction results, thereby achieving a comprehensive, efficient and accurate abnormal monitoring effect.

[0051] The following takes the account risk level prediction device based on account transaction features as an example of the execution subject to illustrate the implementation process of the account risk level prediction method based on account transaction features provided by the embodiment of the present invention. It can be understood that the execution subject of the account risk level prediction method based on account transaction features provided by the embodiment of the present invention includes but is not limited to the account risk level prediction device based on account transaction features.

[0052] Figure 1 A flowchart of a method for predicting account risk level based on account transaction characteristics provided by an embodiment of the present invention, such as Figure 1 As shown, the method includes:

[0053] Step 101: Obtain original user information, original account information, and original transaction details.

[0054] Step 102: extract and classify features based on the original user information, original account information and original transaction details information to generate account transaction feature matrices for different account classifications.

[0055] Step 103: Train the decision tree based on the account transaction feature matrix of different account classifications and the pre-generated indicator feature weights to generate account transaction risk prediction models corresponding to different account classifications.

[0056] Step 104: Using the account transaction risk prediction models corresponding to different account classifications, risk prediction is performed on the account transaction features to be identified to generate an account risk level.

[0057] In the technical solution provided by the embodiment of the present invention, original user information, original account information and original transaction details information are obtained; feature extraction and classification are performed according to the original user information, original account information and original transaction details information to generate account transaction feature matrices of different account classifications; according to the account transaction feature matrices of different account classifications and pre-generated indicator feature weights, decision trees are trained to generate account transaction risk prediction models corresponding to different account classifications; through the account transaction risk prediction models corresponding to different account classifications, risk prediction is performed on the account transaction features to be identified to generate account risk levels, and user information, account information and transaction details information are combined to perform fine-grained division of different types of accounts, and a decision tree algorithm is used to generate personalized anomaly recognition rules for each type of account group to predict the risk level of the account, thereby improving the comprehensiveness, accuracy and adaptability of risk prediction, thereby achieving a comprehensive, efficient and accurate anomaly monitoring effect.

[0058] Figure 2 A flowchart of another method for predicting account risk level based on account transaction characteristics provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the method includes:

[0059] Step 201: Obtain original user information, original account information, and original transaction details.

[0060] In the embodiment of the present invention, each step is performed by an account risk level prediction device based on account transaction characteristics.

[0061] In the embodiment of the present invention, the distributed database stores the sample data set required for the training model, and the original user information, original account information and original transaction detail information required for the training model are obtained from the distributed database.

[0062] In an embodiment of the present invention, the original user information is the basic information of a bank user, and the user information includes but is not limited to the user's gender, age, occupation, annual income, credit rating, telephone number, and user identification code; the original account information is the attributes of an account opened by the user for handling fund collection and payment settlement, and the original account information includes but is not limited to the account opener, account opening bank, account status, type, card number, account number, and account opener identification code; the original transaction detail information refers to the transaction records generated by the user using the account for daily income and expenditure, cash deposits and withdrawals, transfers and other financial activities, and the original transaction detail information includes but is not limited to the transfer-out account number, transfer-in account number, transaction time, transaction channel, and transaction amount. The original transaction detail information can be used as a basis for fund flow.

[0063] Since the amount of data of the original transaction details is huge, the original transaction details data within the specified time period is obtained. The specified time period can be set according to actual needs, and the embodiment of the present invention does not limit this. As an optional solution, the specified time period is 2 years before the current time.

[0064] In the embodiment of the present invention, original user information, original account information and original transaction detail information are combined as the data basis for model training, which has the characteristics of large data volume and wide coverage, and effectively improves the precision, accuracy and comprehensiveness of the model.

[0065] Step 202: perform account association based on the full account information and the account information on the abnormal list, and generate an account association information table.

[0066] In the embodiment of the present invention, the subject of abnormal transaction monitoring is the account. Abnormal transaction monitoring is actually monitoring abnormal accounts and then tracking all transaction links of the account. Therefore, the original account information includes full account information and abnormal list account information. The full account information is the account information of the bank's full account, and the abnormal list account information is the account information included in the abnormal list by the bank. The abnormal list includes the abnormal level of the abnormal account, and the abnormal level includes attention class, suspicious class and prohibited class.

[0067] Specifically, a new "abnormal level" column is added to the full account information as a flag column for abnormal accounts; the account number in the full account information is matched with the account number in the abnormal list account information. If the match is successful, the abnormal level corresponding to the account number in the abnormal list account information is queried, and the abnormal level value queried is filled in the abnormal level corresponding to the account number in the full account information; if the match fails, the abnormal level value corresponding to the account number in the full account information is determined as the normal class; the full account information including the filled "abnormal level" column is determined as the account association information table. The account association information table includes but is not limited to the account holder, account opening bank, account status, type, card number, account number, and abnormal level.

[0068] Step 203: clean the original user information, account association information table and original transaction detail information to generate a cleaned user information table, account association information table and transaction detail information table.

[0069] In the embodiment of the present invention, there are some missing, inconsistent, and abnormal data in the original user information, account association information table, and original transaction details information, which will affect the training effect of the model. It is necessary to preprocess the original user information, account association information table, and original transaction details information to ensure the rationality and reliability of the subsequent model. Data preprocessing includes data cleaning and data integration. Data cleaning includes but is not limited to processing missing values, removing duplicate values, and identifying abnormal values.

[0070] Specifically, for the processing of missing values, if the number of records with missing values ​​in a field is less than a preset record number threshold, the records with missing values ​​are deleted; if the number of records with missing values ​​in a field is greater than or equal to the preset record number threshold, the method of numerical supplementation is used to fill in the missing values. The methods of numerical supplementation include but are not limited to mean interpolation, mode interpolation, fixed value interpolation, and interpolation.

[0071] It is worth noting that the record number threshold can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0072] In the embodiment of the present invention, by performing data processing on missing values, data resource waste and record missing can be reduced, data resource utilization can be improved, and model training efficiency can be improved.

[0073] Specifically, due to different data storage formats, some data may have multiple duplicate records. The account association information table is generally a partition table and is stored in incremental form. For the processing of duplicate values, the record date corresponding to the data with duplicate values ​​is queried, and the account information of the latest date is used as the account information of the account. For example: when an account modifies an attribute value on T day, the account record will be added to the data table on T+1 day. In this case, the attribute information of the same account on T day and T+1 day exists in the data table at the same time. At this time, the account information of the latest date shall prevail.

[0074] Specifically, for the processing of outliers, we first use the scatter plot to find outliers and outliers in the data set. These values ​​are outliers. Outliers are noise and will interfere with the results of model training. If the outlier is wrong data, we can correct it or delete the corresponding record. If the outlier is correct data, we can distribute the outlier to different intervals through binning, clustering and other methods to achieve the purpose of processing outliers.

[0075] Step 204: perform data integration and account classification on the user information table, account association information table and transaction detail information table to generate account transaction feature matrices of different account classifications.

[0076] In the embodiment of the present invention, data integration is to combine multiple data sources together to form a unified data set, analyze the relevant features of abnormal transactions from a multi-dimensional perspective, and count the characteristics of the account itself and transaction feature indicators to provide a complete data basis for feature extraction. Specifically, with the account as the main body, the user information table, account information table, and transaction details table after data cleaning are integrated to form a complete account transaction feature table. In general, users, accounts, and transaction records are one-to-many-to-many relationships. A user may have multiple accounts, and an account can only belong to one user. An account will correspond to multiple transaction records, and each transaction record will involve multiple accounts. According to this feature, the data is associated and integrated.

[0077] Figure 3 A schematic diagram of a data integration structure provided by an embodiment of the present invention is shown in FIG. Figure 3 As shown, the user information table and the account association information table are associated and merged to obtain the account feature table; the transaction detail information table is converted into a one-way transaction table through one-way data conversion; the one-way transaction table is converted into a transaction feature table; the account feature table and the transaction feature table are associated and merged to obtain the original account transaction feature table.

[0078] In the embodiment of the present invention, step 204 specifically includes:

[0079] Step 2041: Associating and merging the user information table and the account association information table to generate an account feature table.

[0080] Specifically, the account holder identification code in the account association information table is matched with the user identification code in the user information table to determine the corresponding user information, and the user information of the user belonging to each account is matched, that is, the basic information of the account holder, and finally an account feature table is generated.

[0081] Step 2042: Perform one-way data conversion on the transaction details information table to generate a one-way transaction table.

[0082] In the embodiment of the present invention, the transaction detail record includes but is not limited to the transfer-out account and the transfer-in account. Two accounts are involved. A single account is required to be the main body, and a "transfer-in, transfer-out" mark column is added to split each transaction into two unidirectional transaction records to generate a unidirectional transaction table.

[0083] Furthermore, the capital flow path is different according to different transaction methods. There are two phenomena. One is end-to-end direct transaction. For example, when user A transfers money to user B, the funds will flow from user A's account to user B's account. The other is indirect transaction, that is, transaction through a third-party payment institution. For example, when user C shop online and chooses a third-party application to pay, the funds will first flow from user C's account to the third-party payment institution, and then from the third-party payment institution to the shopping platform account. The indirect transaction method is two transaction records for the data table. These two transaction records need to be integrated into one transaction record first. After the transaction is merged, the transaction record can be split and split to generate a one-way transaction table.

[0084] Step 2043: Perform feature conversion on the one-way transaction table to generate a transaction feature table.

[0085] In the embodiment of the present invention, abnormal fund transactions refer to the funds that users circulate non-compliant fund income in the market through various means, so that it gradually becomes a normal source of funds. According to the historical experience summarized by experts, some typical characteristics of such transaction accounts are: frequent large-amount fund transactions; dispersed transfers in and concentrated transfers out of accounts in a short period of time or concentrated transfers in and dispersed transfers out; a large number of high-amount fund transactions suddenly appear in accounts that have been idle for a long time; frequent cross-regional and cross-bank transactions; the existence of test transactions, that is, large-amount transactions appear after completing one or two small transactions, etc. Combined with the typical characteristics of abnormal transactions, the transaction characteristics of each account are counted from the dimensions of time, transaction amount, transaction quantity, transaction intensity, etc. The transaction characteristics include the number of transactions, total transfer-out amount, total transfer-in amount, average monthly transaction amount, maximum transfer-in amount, maximum transfer-out amount, and the number of short-term excess transactions in a specified time period.

[0086] It is worth noting that the specified time period can be set according to actual needs, and the embodiment of the present invention does not limit this. As an optional solution, the specified time period is 2 years before the current time. The number of short-term excess transactions is the number of excess transactions counted on a monthly basis.

[0087] Specifically, based on the information in the single transaction table, statistics and feature conversion are performed according to the transaction characteristics, a transaction key indicator system is constructed, and the one-way transaction table is converted into a transaction feature table.

[0088] Step 2044: associate and merge the account feature table and the transaction feature table to generate an original account transaction feature table.

[0089] Specifically, the account number in the account feature table is matched with the account number in the transaction feature table to determine the corresponding transaction feature information, and the corresponding transaction feature information is matched for each account to generate an original account transaction feature table.

[0090] Step 2045: Use a clustering algorithm to classify the account feature table and generate an account classification result.

[0091] In the embodiment of the present invention, different types of accounts have different transaction characteristics, and the method of judging abnormalities cannot be blindly consistent. For example, some online stores selling digital products, home appliances and other products on the shopping platform have high sales, and the capital flow is relatively frequent. The daily turnover is large, hundreds of thousands or even up to millions, but this situation may be an abnormal phenomenon according to the existing identification method of the bank regulatory department, thus leading to misjudgment. Classifying similar accounts into one category can effectively improve the accuracy of the model. Account classification is mainly based on the nature of the account itself and the characteristics of the user to whom it belongs. Therefore, the account classification can be performed based on the account feature table generated in step 2041, and irrelevant features such as the user's phone number and card number are eliminated to construct an n×d account feature matrix, where n is the number of accounts and d is the number of feature dimensions. The K-Means clustering algorithm is used to classify the accounts and divide the accounts into k categories. The specific calculation method is as follows:

[0092] Step a1: Randomly select k accounts from n accounts, representing k clusters respectively, where the i-th cluster is defined as in, is the dth eigenvalue of the ith cluster, M i is the center point of the i-th cluster.

[0093] Step a2: Calculate the probability that other accounts belong to each cluster respectively. The feature vector of the jth account is defined as X j =(x j1 ,x j2 ,...,x jd ), j = 1, 2, ..., n, where xjd is the dth eigenvalue of the jth account, and the Euclidean distance of the jth account to the center point of the i-th cluster is:

[0094]

[0095] Among them, x jd is the dth eigenvalue of the jth account, r ji is the Euclidean distance between the jth account and the center of the ith cluster, M i is the center point of the i-th cluster, X j is the feature vector of the j-th account.

[0096] The probability that the jth account belongs to the i-th cluster can be defined as:

[0097]

[0098] Among them, r ji is the Euclidean distance of the jth account to the center of the i-th cluster, p ji is the probability that the j-th account belongs to the i-th cluster, and k is the number of clusters.

[0099] According to the principle of K-Means clustering algorithm, the smaller the distance between the account feature vector and the center point of the cluster, the higher the similarity and the greater the probability of being classified into this category. That is, the probability of a sample point belonging to a cluster is inversely proportional to its Euclidean distance. Each account is divided into the cluster with the highest probability.

[0100] Step a3: Update the cluster center and recalculate the center point of each cluster to make the sum of squared errors (SSE) as small as possible. Repeat step a2 until the cluster center point no longer changes or the maximum number of iterations is reached, and output the account classification result.

[0101]

[0102] Among them, SSE is the sum of squared errors, r ji is the Euclidean distance of the j-th account to the center of the i-th cluster, and k is the number of clusters.

[0103] Step 2046: extract key features based on the account classification results and the original account transaction feature table to generate account transaction feature matrices for different account classifications.

[0104] In the embodiment of the present invention, key feature extraction is to screen the indicators of the data and mine the key features used for training the abnormal transaction monitoring model. The data set obtained by data preprocessing contains many features that have little or no correlation with the classification and identification of abnormal transactions. For example, features such as the user's telephone number and card number may be irrelevant to the target of this model and need to be removed from the original feature set. The impact of noise on the model is reduced by extracting key features.

[0105] Specifically, according to the account classification results, key features are extracted from the original account transaction feature tables corresponding to different account classifications to generate an account transaction feature matrix corresponding to each account classification.

[0106] Step 205: extract key features from the original account transaction feature table to obtain multiple groups of feature variables and corresponding target variables.

[0107] In the embodiment of the present invention, features irrelevant to the model target, such as the user's telephone number and card number, are eliminated, and the influence of noise on the model is reduced by extracting key features to obtain extracted account transaction features.

[0108] In the embodiment of the present invention, the training set of the supervised machine learning classification algorithm should include the characteristic variables and target variables of each sample. The characteristic variables are the characteristic attributes of the account, that is, the attributes of the account transaction feature table. The obviously irrelevant attributes in the account transaction feature table are eliminated, such as the user's phone number, card number, user identification code, etc., to reduce data noise. The processed characteristic variables include: user characteristics (age, occupation, annual income, credit rating, etc.), account characteristics (account status, account nature, account category, account opening time, account holder identification code, etc.), transaction behavior (number of transactions within a specified time period, total transfer amount, total transfer amount, average monthly transaction amount, maximum transfer amount, maximum transfer amount, number of short-term excess transactions within a specified time period, etc.); the target variable is the target classification value of the account, that is, the abnormal level in the account characteristics. Banks generally divide the abnormal level of accounts into four categories: normal, attention, suspicious, and prohibited. This type of data classification has been screened and positioned by the bank in the early stage and has a certain reliability, which can be used as a target variable.

[0109] Step 206: Using the analytic hierarchy process (AHP), weight calculation is performed based on multiple groups of characteristic variables and corresponding target variables to generate indicator characteristic weights.

[0110] In the embodiment of the present invention, the characteristic variables of the sample are combined with the target variables, the idea of ​​analytic hierarchy process (AHP) is introduced to adjust the initial weight parameters of the indicators, subjective judgment is combined with objective analysis, and the initial weights that conform to realistic logic are obtained using systematic, comparative and comprehensive thinking. Figure 4 A schematic diagram of a characteristic variable structure based on the hierarchical analysis method provided by an embodiment of the present invention is as follows: Figure 4 As shown in the figure, the characteristic variable structure includes the target layer, the criterion layer and the indicator layer. The target layer is the judgment target variable, that is, identifying abnormal accounts (N); the criterion layer is the feature category, that is, user characteristics (C1), account characteristics (C2), and transaction characteristics (C3); the indicator layer is the secondary indicator under the criterion layer, that is, the aforementioned characteristic variables are age (P11), occupation (P12), ..., credit rating (P1r), account status (P21), account nature (P22), ..., account opening time (P2s), number of transactions (P31), total amount of transfers (P32), ..., and number of excess transactions (P3t). Each level constructs a judgment matrix based on the comparison of the importance of the indicators, and then calculates the weight of the secondary indicator, i.e., the characteristic variable.

[0111] The importance of the criterion layers C1, C2, and C3 relative to the target layer N is compared pairwise, and the judgment matrix between the target layer and the criterion layer is: Among them, a ij is the comparison factor between Ci and Cj, a ij a ji =1.

[0112] Calculate the weight of each factor in the criterion layer using the arithmetic mean method The weight vector of the criterion layer is u=(u1,u2,u3). i is the weight of feature i in the criterion layer, a ij is the comparison factor between Ci and Cj.

[0113] The importance of the indicator layer P relative to the respective upper criterion layer C1, C2, and C3 is compared pairwise, and the judgment matrix is ​​obtained as follows: Among them, k = 1, 2, 3, corresponding to the three factors of the criterion layer, b ij (k) is the comparison factor between Pki and Pkj under the criterion layer Ck, b ij (k) b ji (k) =1.

[0114] Use the arithmetic mean method to calculate the indicator weights under each criterion layer Ck Among them, i = 1, 2, ..., m, m represents the number of indicators under the criterion layer Ck, and the weight vector of the indicator layer under the criterion layer Ck is v (k) =(v1 (k) ,v2 (k) ,…,v m (k) ). Among them, v i (k) is the weight of indicator i under the criterion layer Ck, a ijis the comparison factor between Ci and Cj.

[0115] The corresponding weights of the comprehensive criterion layer and the indicator layer are finally calculated to calculate the indicator feature weights of the indicator layer:

[0116] w=(u1v (1) ,u2v (2) ,u3v (3) )=(u1v1 (1) ,…,u1v r (r) ,u2v s (2) ,…,u2v s (s) ,u3v t (3) ,…,u3v t (t) )

[0117] Among them, w is the initial indicator feature weight for use in subsequent models; u1, u2, and u3 are user feature weights, account feature weights, and transaction feature weights, respectively; v (1) 、v (2) 、v (3) They are the indicator weight of each indicator feature under user characteristics, the indicator weight of each indicator feature under account characteristics, and the indicator weight of each indicator feature under transaction characteristics.

[0118] Step 207: Train the decision tree based on the account transaction feature matrix of different account classifications and the pre-generated indicator feature weights to generate account transaction risk prediction models corresponding to different account classifications.

[0119] In an embodiment of the present invention, the account transaction feature matrix of different account classifications is used as a training set, combined with the indicator feature weights, to correct the indicator tilt problem of the model training algorithm, and a decision tree algorithm is used to perform model training on the data in the account transaction feature matrix of different account classifications, so as to generate personalized account transaction risk prediction models corresponding to different account classifications.

[0120] Decision tree classification is a model that infers tree-shaped classification rules from unordered and irregular training sample sets. A decision tree contains a root node, several internal nodes and several leaf nodes. The root node and internal nodes store the result partition of each feature variable respectively, and the leaf node corresponds to the target variable. Each branch path from the root node to the leaf node of the decision tree can constitute a rule sequence. Since the feature variables of the training sample set contain both discrete features (such as credit rating, account category, etc.) and continuous variables (such as age, transaction amount, etc.), the model training is based on the C4.5 algorithm. The algorithm splits the decision tree based on the information gain rate of the feature variable, and preferentially selects the feature partition metric with a higher information gain rate as the split node, gradually reducing the system's clutter until the optimal classification decision tree is obtained.

[0121] Specifically, decision tree models are trained for different account categories to generate personalized anomaly detection rules for different account categories. a samples, calculate the target variable information entropy H(a) of the sample set of class a accounts, This is used to measure the degree of system disorder of the sample set of class a accounts, where k is the number of target variable categories. That is, as mentioned above, the abnormal account levels are divided into four categories: normal, attention, suspicious, and prohibited. Then k = 4, D i is the number of samples divided into each target variable value.

[0122] Calculate feature x in account type a d Its own information entropy H(x d ), For discrete features, the C4.5 algorithm directly calculates the information entropy based on the feature values. For continuous features, the values ​​of the continuous features are sorted from small to large, the midpoint of two adjacent values ​​is taken as the split point, the continuous features are discretized, and then the information entropy is calculated. Where m is the number of feature variable values, D v The number of samples for each value of the feature variable.

[0123] The essence of the decision tree algorithm is to find the best division of each feature and the order of division of different features to obtain a decision tree with the best classification effect. d After partitioning, the overall information entropy of the sample is calculated, that is, the conditional entropy H(a,x d ), Then we can get the information gain Gain(a,x d ), Gain(a,x d )=H(a)-H(a,x d ), iterate so that the Gain(a,x) of each feature d) is the largest, and the best partitioning is found for each feature. Where m is the number of feature variables, D v is the number of samples for each value of the feature variable, k is the number of target variable categories, N a is the sample size.

[0124] After finding the best split for each feature variable, you need to prioritize one of the feature variables as the first split node of the decision tree. Generally speaking, information gain is affected by the number of feature values ​​and is not suitable for comparison between features. The fewer the feature variables themselves are, the smaller the conditional entropy value is, and the greater the information gain is. If the feature priority is also determined by the information gain, then the model will prioritize the selection of feature variables with fewer values. Therefore, C4.5 uses the information gain rate To enhance the comparability between features, prevent the model from leaning towards features with fewer values, and use the division of the feature variable with the largest information gain rate as the first split node of the decision tree. Although the information gain rate corrects the problem of feature tilt, it mainly depends on the internal data structure of the system. The abnormal transaction monitoring scenario includes users, accounts, and transaction features, which has certain complexity and flexibility. It should be combined with real experience, take the nature of the features themselves into consideration, improve the strong objectivity of the model, so that the model can truly, objectively, completely and accurately reflect the actual situation, and optimize the information gain rate indicator in combination with the indicator feature weights to achieve the priority selection of more important features among features with the same or similar information gain rates:

[0125]

[0126] Where Gain_rate′(a,x d ) is the optimized information gain rate, w d is feature x d The indicator feature weight, H(a) is the target variable information entropy of the sample set of class a accounts, H(a,x d ) is the conditional entropy, H(x d ) is the feature x d Its own information entropy.

[0127] After selecting the optimized feature with a high information gain rate as the first splitting node, the sample data is divided into multiple sub-sample sets according to the features. A new splitting node is selected for each sub-sample set according to the above algorithm, and so on, until all sub-sample sets belong to the same target variable and no further splitting is required. Finally, an optimal decision tree is obtained, and the branch path from the root node to the leaf node can be extracted as the abnormal account monitoring rule.

[0128] Step 208: Determine the target account classification of the account transaction feature to be identified based on the account transaction feature matrix of different account classifications.

[0129] In an embodiment of the present invention, based on the account transaction features to be identified, the Euclidean distance is calculated with the center point of the cluster of each account classification; multiple Euclidean distances are compared to determine the minimum Euclidean distance; and the account classification corresponding to the minimum Euclidean distance is determined as the target account classification.

[0130] Step 209: Determine the corresponding target account transaction risk prediction model based on the target account classification.

[0131] In the embodiment of the present invention, according to the target account classification, a personalized account transaction risk prediction model of the corresponding cluster is selected; and the selected account transaction risk prediction model is determined as the target account transaction risk prediction model.

[0132] Step 210: Use the target account transaction risk prediction model to perform risk prediction on the account transaction characteristics to be identified and generate an account risk level.

[0133] Specifically, the transaction features of the account to be identified are input into the target account transaction risk prediction model to predict the account risk level, and the account risk level is output.

[0134] Step 211: Determine whether the current transaction has abnormal risk based on the account risk level. If so, execute step 212; if not, the process ends.

[0135] In the embodiment of the present invention, the account risk levels include normal, attention, suspicious and prohibited.

[0136] Specifically, if the account risk level is suspicious or prohibited, it indicates that the current transaction has abnormal risks, and step 212 is executed; if the account risk level is normal or concerned, it indicates that the current transaction does not have abnormal risks, and the process ends.

[0137] Step 212: Match the corresponding risk control plan according to the account risk level through the preset risk control strategy.

[0138] In the embodiment of the present invention, the risk control strategy can be set according to actual needs, and the embodiment of the present invention does not limit this. As an optional solution, if the account risk level is suspicious, the corresponding risk control solution is that the relevant bank staff follows up the transaction link of the funds of the current transaction, quickly locates the account transaction chain through the one-way transaction table, and conducts risk control analysis; if the prediction result is prohibited, the corresponding risk control solution is that the bank system immediately intercepts the flow of the funds and freezes the relevant accounts.

[0139] Aiming at the current demand of the financial industry for high efficiency and high precision in monitoring abnormal transactions, the present invention comprehensively analyzes the three aspects of user characteristics, account characteristics and transaction characteristics, explores the influencing indicators of transaction risks and performs feature extraction to reduce noise, introduces the hierarchical analysis method to calculate the weight of the transaction characteristics of each account, combines the importance of subjectively quantified characteristics with expert evaluation, and takes into account the transaction differences of different types of accounts, adopts the K-Means clustering algorithm to perform a finer-grained division of all accounts, uses the improved decision tree algorithm to perform personalized model training for different account groups, so that each account group corresponds to a decision tree model, extracts differentiated abnormal monitoring rules, and effectively improves the prediction accuracy. The decision tree algorithm combines the feature weight to adjust the information gain rate, eliminates subjective bias and objective bias, and selects the best feature division to construct the decision tree, thereby enhancing the reliability of the model.

[0140] It is worth noting that the acquisition, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of laws and regulations. The user information in the embodiments of this application is obtained through legal and compliant channels, and the acquisition, storage, use, and processing of user information are authorized and agreed by the user.

[0141] It is worth noting that the information collected in this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good customs, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0142] It is worth noting that the technical solution provided in this application provides users with corresponding operation entrances for them to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0143] In the technical solution of the account risk level prediction method based on account transaction features provided by the embodiment of the present invention, original user information, original account information and original transaction detail information are obtained; feature extraction and classification are performed according to the original user information, original account information and original transaction detail information to generate account transaction feature matrices of different account classifications; according to the account transaction feature matrices of different account classifications and pre-generated indicator feature weights, decision trees are trained to generate account transaction risk prediction models corresponding to different account classifications; through the account transaction risk prediction models corresponding to different account classifications, risk prediction is performed on the account transaction features to be identified to generate account risk levels, and user information, account information and transaction detail information are combined to perform fine-grained division of different types of accounts, and a decision tree algorithm is used to generate personalized anomaly recognition rules for each type of account group to predict the risk level of the account, thereby improving the comprehensiveness, accuracy and adaptability of risk prediction, thereby achieving a comprehensive, efficient and accurate anomaly monitoring effect.

[0144] Figure 5 A schematic diagram of the structure of an account risk level prediction device based on account transaction characteristics provided by an embodiment of the present invention, wherein the device is used to execute the above-mentioned account risk level prediction method based on account transaction characteristics, such as Figure 5 As shown, the device includes: a data acquisition unit 11, a data processing unit 12, a model training unit 13 and a risk level prediction unit 14.

[0145] The data collection unit 11 is used to obtain original user information, original account information and original transaction details information.

[0146] The data processing unit 12 is used to extract and classify features based on the original user information, original account information and original transaction details information, and generate account transaction feature matrices for different account classifications.

[0147] The model training unit 13 is used to train the decision tree according to the account transaction feature matrix of different account classifications and the pre-generated indicator feature weights, so as to generate the account transaction risk prediction model corresponding to the different account classifications.

[0148] The risk level prediction unit 14 is used to perform risk prediction on the account transaction features to be identified through account transaction risk prediction models corresponding to different account classifications, and generate an account risk level.

[0149] In an embodiment of the present invention, the original account information includes full account information and abnormal list account information; the data processing unit 12 is specifically used to associate accounts according to the full account information and the abnormal list account information, and generate an account association information table; perform data cleaning on the original user information, the account association information table and the original transaction detail information, and generate a cleaned user information table, an account association information table and a transaction detail information table; perform data integration and account classification on the user information table, the account association information table and the transaction detail information table, and generate an account transaction feature matrix of different account classifications.

[0150] In the embodiment of the present invention, the data processing unit 12 is specifically used to associate and merge the user information table and the account association information table to generate an account feature table; perform one-way data conversion on the transaction detail information table to generate a one-way transaction table; perform feature conversion on the one-way transaction table to generate a transaction feature table; associate and merge the account feature table and the transaction feature table to generate an original account transaction feature table; perform account classification on the account feature table through a clustering algorithm to generate an account classification result; perform key feature extraction based on the account classification result and the original account transaction feature table to generate an account transaction feature matrix of different account classifications.

[0151] In the embodiment of the present invention, the device further includes: a feature extraction unit 15 and a feature weight generation unit 16.

[0152] The feature extraction unit 15 is used to extract key features from the original account transaction feature table to obtain multiple groups of feature variables and corresponding target variables.

[0153] The feature weight generating unit 16 is used to generate the indicator feature weight by performing weight calculation according to multiple groups of feature variables and corresponding target variables through the hierarchical analysis method.

[0154] In the embodiment of the present invention, the risk level prediction unit 14 is specifically used to determine the target account category to which the account transaction feature to be identified belongs based on the account transaction feature matrix of different account classifications; determine the corresponding target account transaction risk prediction model based on the target account classification; and perform risk prediction on the account transaction feature to be identified through the target account transaction risk prediction model to generate an account risk level.

[0155] In the embodiment of the present invention, the device further includes: an abnormal risk judgment unit 17 and a risk control scheme matching unit 18.

[0156] The abnormal risk judgment unit 17 is used to judge whether there is an abnormal risk in the current transaction according to the account risk level.

[0157] The risk control scheme matching unit 18 is used to match the corresponding risk control scheme according to the account risk level through the preset risk control strategy, if any.

[0158] In the scheme of the embodiment of the present invention, original user information, original account information and original transaction details are obtained; feature extraction and classification are performed based on the original user information, original account information and original transaction details to generate account transaction feature matrices of different account classifications; decision trees are trained based on the account transaction feature matrices of different account classifications and pre-generated indicator feature weights to generate account transaction risk prediction models corresponding to different account classifications; risk prediction is performed on account transaction features to be identified through the account transaction risk prediction models corresponding to different account classifications to generate account risk levels, and user information, account information and transaction details are combined to perform fine-grained division of different types of accounts, and a decision tree algorithm is used to generate personalized anomaly recognition rules for each type of account group to predict the risk level of the account, thereby improving the comprehensiveness, accuracy and adaptability of risk prediction, thereby achieving a comprehensive, efficient and accurate anomaly monitoring effect.

[0159] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer device, and specifically, the computer device may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0160] An embodiment of the present invention provides a computer device, including a memory and a processor, the memory is used to store information including program instructions, the processor is used to control the execution of the program instructions, and when the program instructions are loaded and executed by the processor, the steps of the embodiment of the above-mentioned account risk level prediction method based on account transaction characteristics are implemented. For a specific description, please refer to the embodiment of the above-mentioned account risk level prediction method based on account transaction characteristics.

[0161] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer device 600 suitable for implementing an embodiment of the present application.

[0162] like Figure 6 As shown, the computer device 600 includes a central processing unit (CPU) 601, which can perform various appropriate operations and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the computer device 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0163] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal feedback device (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed as needed as the storage section 608.

[0164] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 609, and / or installed from the removable medium 611.

[0165] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0166] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0167] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0168] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0169] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0170] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0171] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0172] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0173] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0174] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0175] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0176] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for predicting account risk level based on account transaction characteristics, characterized in that: The method comprises: Obtain original user information, original account information, and original transaction details; Extract and classify features based on the original user information, original account information, and original transaction details information to generate account transaction feature matrices for different account classifications; Training a decision tree according to the account transaction feature matrix of the different account classifications and the pre-generated indicator feature weights to generate an account transaction risk prediction model corresponding to the different account classifications; By using the account transaction risk prediction models corresponding to the different account classifications, risk prediction is performed on the account transaction features to be identified to generate an account risk level.

2. The account risk level prediction method based on account transaction characteristics according to claim 1 is characterized in that: The original account information includes full account information and abnormal list account information; The feature extraction and classification are performed according to the original user information, the original account information and the original transaction detail information to generate an account transaction feature matrix of different account classifications, including: Perform account association based on the full account information and the account information on the abnormal list, and generate an account association information table; Cleaning the original user information, account association information table and original transaction details information to generate a cleaned user information table, account association information table and transaction details information table; Data integration and account classification are performed on the user information table, account association information table and transaction detail information table to generate account transaction feature matrices of different account classifications.

3. The account risk level prediction method based on account transaction characteristics according to claim 2 is characterized in that: The step of integrating data and classifying accounts on the user information table, the account association information table, and the transaction detail information table to generate the account transaction feature matrix of different account classifications includes: Associating and merging the user information table and the account association information table to generate an account feature table; Performing one-way data conversion on the transaction details information table to generate a one-way transaction table; Performing feature conversion on the one-way transaction table to generate a transaction feature table; Associating and merging the account feature table and the transaction feature table to generate an original account transaction feature table; Using a clustering algorithm, classifying the account feature table to generate an account classification result; Key features are extracted according to the account classification results and the original account transaction feature table to generate an account transaction feature matrix of the different account classifications.

4. The method for predicting account risk level based on account transaction characteristics according to claim 3, characterized in that: The method further comprises: Extract key features from the original account transaction feature table to obtain multiple groups of feature variables and corresponding target variables; By means of the hierarchical analysis method, weight calculation is performed according to multiple groups of characteristic variables and corresponding target variables to generate the indicator characteristic weights.

5. The method for predicting account risk level based on account transaction characteristics according to claim 1, characterized in that: Through the account transaction risk prediction models corresponding to the different account classifications, risk prediction is performed on the account transaction features to be identified to generate account risk levels, including: Determining the target account category to which the account transaction feature to be identified belongs according to the account transaction feature matrix of the different account categories; According to the classification of target accounts, determine the corresponding target account transaction risk prediction model; The target account transaction risk prediction model is used to predict the risk of the account transaction characteristics to be identified and generate an account risk level.

6. The method for predicting account risk level based on account transaction characteristics according to claim 1, characterized in that: After performing risk prediction on the account transaction features to be identified and generating account risk levels through the account transaction risk prediction models corresponding to the different account classifications, the method further includes: According to the account risk level, determine whether the current transaction has abnormal risks; If it exists, the corresponding risk control plan is matched according to the account risk level through the preset risk control strategy.

7. A device for predicting account risk level based on account transaction characteristics, characterized in that: The device comprises: A data collection unit, used to obtain original user information, original account information and original transaction details; A data processing unit, configured to extract and classify features according to the original user information, original account information and original transaction details information, and generate account transaction feature matrices for different account classifications; A model training unit, used to train a decision tree according to the account transaction feature matrix of the different account classifications and the pre-generated indicator feature weights, to generate an account transaction risk prediction model corresponding to the different account classifications; The risk level prediction unit is used to perform risk prediction on the account transaction features to be identified through the account transaction risk prediction models corresponding to the different account classifications, and generate an account risk level.

8. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the account risk level prediction method based on account transaction characteristics described in any one of claims 1 to 6 is implemented.

9. A computer device comprising a memory and a processor, wherein the memory is used to store information including program instructions, and the processor is used to control the execution of the program instructions, characterized in that: When the program instructions are loaded and executed by the processor, the account risk level prediction method based on account transaction characteristics described in any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the account risk level prediction method based on account transaction characteristics as described in any one of claims 1 to 6 is implemented.

Images