Financial risk early warning method and system based on big data technology

Abstract

The invention discloses a financial risk early warning method and system based on a big data technology, and aims to evaluate risks in real time and carry out early warning by analyzing transaction behaviors of financial users. The method comprises the following steps: acquiring a historical operation record of a financial user and extracting operation path data; clustering the historical operation path data by using a clustering algorithm, and identifying operation path features under different transaction types; constructing a transaction risk assessment model, and analyzing the deviation degree of the real-time transaction behavior; assessing the risk according to the deviation degree, and if the risk exceeds a preset value, marking the user as a risk user and performing secondary confirmation; and finally triggering a risk early warning mechanism and formulating an early warning strategy. The system comprises a data acquisition module, a data processing module, an evaluation module, an early warning module and an execution module which work cooperatively to realize real-time monitoring and risk early warning. The method can accurately identify the abnormal transaction behavior, improves the intelligence and automation level of financial risk management, and has a wide application prospect in the financial field.

Description

Technical Field

[0001] The present invention relates to the field of risk warning technology, and in particular to a financial risk warning method and system based on big data technology. Background Art

[0002] With the rapid development of financial markets and the diversification of financial transaction methods, the risks of financial transactions are increasing, especially in emerging fields such as Internet finance and online payment. The complexity and diversity of financial transaction behaviors have brought many challenges to traditional financial risk assessment and early warning methods. Traditional financial risk early warning methods usually rely on static rules and historical data analysis. These methods are difficult to cope with the rapidly changing market environment and complex user behaviors, are prone to false positives or false negatives, and lack flexibility and real-time performance.

[0003] In recent years, with the continuous development of big data technology, the financial industry has gradually introduced risk analysis methods based on big data. Through in-depth mining and analysis of financial user behavior data, potential risk factors can be identified and more accurate risk assessment and early warning can be carried out. However, the application of existing big data technology in financial risk early warning still has certain limitations. For example, how to efficiently and accurately identify potential risks in user transaction behaviors, how to dynamically adjust risk assessment models based on real-time data, and how to reduce manual intervention and improve the level of system automation are still urgent issues to be solved.

[0004] Therefore, the present invention proposes a financial risk early warning method and system based on big data technology, which identifies potential risk characteristics through real-time monitoring, analysis and clustering of financial user transaction behaviors, and combines intelligent algorithms and risk assessment models for dynamic analysis, in order to achieve more efficient and accurate financial risk early warning. This method can not only improve the accuracy of risk identification, but also take preventive measures before risks occur, thereby effectively reducing financial risks and improving the security and response capabilities of financial institutions. Summary of the invention

[0005] In order to solve at least one of the above technical problems, the present invention proposes a financial risk early warning method and system based on big data technology.

[0006] The first aspect of the present invention provides a financial risk early warning method based on big data technology, comprising:

[0007] Acquire historical operation record data of a financial user according to a target financial server, and extract historical operation path data of the financial user according to the historical operation record data;

[0008] Performing a clustering operation on the historical operation path data according to a clustering algorithm to obtain an operation record clustering result;

[0009] Identifying transaction operation path characteristics of financial users under different transaction types according to the operation record clustering results;

[0010] constructing a transaction operation risk assessment model for the financial user according to the transaction operation path characteristics, performing a transaction operation path deviation analysis on the real-time transaction operation behavior of the financial user according to the transaction operation risk assessment model, calculating the deviation degree of the real-time transaction operation behavior of the financial user, and performing a transaction operation risk assessment according to the real-time transaction operation behavior deviation degree;

[0011] If the transaction operation risk is greater than the preset risk value, the financial user will be marked as a risky user, and the transaction risk of the risky user will be reconfirmed. A financial risk warning will be issued based on the result of the second confirmation of the transaction risk, and a financial risk warning strategy will be established.

[0012] In this solution, the historical operation record data of the financial user is obtained according to the target financial server, and the historical operation path data of the financial user is extracted according to the historical operation record data, specifically:

[0013] Acquire historical operation record data of a financial user according to a target financial server, wherein the historical operation record data includes browsing records, financial consultation records, and transaction records;

[0014] Sorting the historical operation record data according to timestamps to construct historical operation record time series data, and segmenting the historical operation record time series data according to transaction record time points to obtain historical operation record data segments;

[0015] The historical operation record data segments are used to construct an operation record directed graph, and the historical operation path data of the financial user is extracted according to the operation record directed graph.

[0016] In this solution, the historical operation path data is clustered according to a clustering algorithm to obtain an operation record clustering result, which is specifically:

[0017] Setting a clustering weight for each operation record in the historical operation path data, calculating the Euclidean distance between each pair of historical operation paths in the historical operation path data, and calculating the similarity between the historical operation paths according to the Euclidean distance and the clustering weight;

[0018] Constructing a similarity matrix according to the similarity, calculating a diagonal matrix of the similarity matrix, constructing a Laplace matrix according to the similarity matrix and the diagonal matrix, performing eigenvalue decomposition on the Laplace matrix, and finding eigenvectors corresponding to the smallest k eigenvalues;

[0019] Constructing a feature matrix according to the eigenvectors corresponding to the k eigenvalues, randomly selecting k data points from the feature matrix as initial centroids, calculating the Euclidean distance from each data point in the feature matrix to each initial centroid, and assigning each data point to the cluster where the nearest initial centroid is located;

[0020] Iteratively update the cluster center and recalculate the updated Euclidean distance from each data to the updated cluster center. Allocate data points according to the updated Euclidean distance until the cluster center no longer changes, and obtain the operation record clustering result.

[0021] In this solution, the transaction operation path characteristics of financial users under different transaction types are identified according to the operation record clustering results, specifically:

[0022] Extracting the transaction type to which each clustering result belongs according to the operation record clustering results, constructing the transaction operation path of the transaction type to which each clustering result belongs according to the operation record clustering results, and obtaining the transaction operation path feature;

[0023] Repeatedly identify the transaction operation path features, determine whether each transaction type has multiple transaction operation path features, mark the transaction type with multiple transaction operation path features, extract the multiple transaction operation path features of the marked transaction type and mark them as the transaction operation path features to be merged;

[0024] Calculating the proportion of each transaction operation path feature to be merged in the operation record clustering result according to the operation record clustering result, taking the transaction operation path feature to be merged with the largest proportion as the benchmark transaction operation path feature, and marking the remaining transaction operation path features to be merged as candidate transaction operation path features;

[0025] Preset a minimum support threshold for path feature merging, obtain the operation record elements included in the candidate transaction operation path features, calculate the frequency of occurrence of each operation record element in the transaction operation path features to be merged, and evaluate the support of the operation record element according to the frequency of occurrence;

[0026] Comparing the support of the operation record element with the minimum support threshold, and marking the operation record element whose support is greater than the minimum support threshold and is not included in the benchmark transaction operation path feature as a candidate frequent sub-feature;

[0027] Based on the Apriori algorithm, a hierarchical search is performed on the transaction operation path features to be merged, and the occurrence probability of the candidate frequent sub-features after each operation record in the benchmark transaction operation path features is analyzed, and the insertion position of the candidate frequent sub-features in the benchmark transaction operation path features is determined according to the occurrence probability;

[0028] The benchmark transaction operation path feature and the candidate frequent sub-features are merged according to the insertion position to obtain the transaction operation path features of the financial user under different transaction types.

[0029] In this solution, the transaction operation risk assessment model of the financial user is constructed according to the transaction operation path characteristics, the transaction operation path deviation analysis is performed on the real-time transaction operation behavior of the financial user according to the transaction operation risk assessment model, the deviation degree of the real-time transaction operation behavior of the financial user is calculated, and the transaction operation risk assessment is performed according to the real-time transaction operation behavior deviation degree, specifically:

[0030] constructing an operation state transfer pair for the transaction operation path features based on a Markov chain, calculating the operation transfer probability between the operation state transfer pairs according to the historical operation path data, and constructing an operation state transfer matrix according to the operation transfer probability;

[0031] Constructing a transaction operation risk assessment model for financial users according to the operation state transfer matrix, and constructing a data link channel between the transaction operation risk assessment model and the target financial server based on big data technology, wherein the data link channel includes a data interface between the target financial server and the transaction operation risk assessment model, and a data cleaning module;

[0032] Importing the real-time transaction operation behavior data of the financial user of the target financial service server into the transaction operation risk assessment model according to the data link channel, calculating the operation state transition probability between adjacent operation behaviors in the real-time transaction operation behavior data, and calculating the operation transition comprehensive probability of the real-time transaction operation behavior data according to the operation state transition probability between the adjacent operation behaviors;

[0033] The deviation between the real-time transaction operation behavior of the financial user and the transaction operation path characteristics is calculated according to the comprehensive probability of operation transfer of the real-time transaction operation behavior data, and the real-time transaction operation of the financial user is risk assessed according to the deviation based on the transaction operation risk assessment model to obtain a transaction operation risk assessment result.

[0034] In this solution, if the transaction operation risk is greater than the preset risk value, the financial user is marked as a risky user, the transaction risk of the risky user is reconfirmed, and a financial risk warning is issued based on the transaction risk reconfirmation result, and a financial risk warning strategy is constructed, specifically:

[0035] According to the transaction operation risk assessment result, if the transaction operation risk is greater than the preset risk value, the financial user is marked as a risky user, and the transaction change information of the risky user within a preset time period is obtained, and the transaction change information includes the change of transaction frequency and transaction amount;

[0036] Comprehensively analyzing the transaction change information and the transaction operation path characteristics, determining the change of the transaction change information to the transaction operation path characteristics, updating the transaction operation path characteristics according to the change, and performing a secondary risk assessment on the real-time transaction operation behavior of the risky user according to the updated transaction operation path characteristics;

[0037] If the transaction operation risk of the secondary risk assessment is still greater than the preset risk value, the real-time transaction operation behavior data of the risk user is compared with the transaction operation path characteristics to identify the missing operations of the risk user's real-time transaction operation behavior, and the missing operations are generated as warning information to perform warning reminder operations on the risk user to obtain a user warning plan;

[0038] Acquire transaction IP address information of risky users and credit rating information of transaction objects, determine the risk level of risky users according to the transaction IP address information and credit rating information of transaction objects, generate warning information according to the risk level, perform warning operations on target financial institutions, and obtain institutional warning plans;

[0039] A financial risk early warning strategy is constructed based on the user early warning plan and the institution early warning plan.

[0040] The second aspect of the present invention further provides a financial risk early warning system based on big data technology, the system comprising: a memory, a processor, the memory comprising a financial risk early warning method program based on big data technology, and when the financial risk early warning method program based on big data technology is executed by the processor, the following steps are implemented:

[0041] Acquire historical operation record data of a financial user according to a target financial server, and extract historical operation path data of the financial user according to the historical operation record data;

[0042] Performing a clustering operation on the historical operation path data according to a clustering algorithm to obtain an operation record clustering result;

[0043] Identifying transaction operation path characteristics of financial users under different transaction types according to the operation record clustering results;

[0044] constructing a transaction operation risk assessment model for the financial user according to the transaction operation path characteristics, performing a transaction operation path deviation analysis on the real-time transaction operation behavior of the financial user according to the transaction operation risk assessment model, calculating the deviation degree of the real-time transaction operation behavior of the financial user, and performing a transaction operation risk assessment according to the real-time transaction operation behavior deviation degree;

[0045] If the transaction operation risk is greater than the preset risk value, the financial user will be marked as a risky user, and the transaction risk of the risky user will be reconfirmed. A financial risk warning will be issued based on the result of the second confirmation of the transaction risk, and a financial risk warning strategy will be established.

[0046] The present invention discloses a financial risk early warning method and system based on big data technology, which aims to evaluate risks in real time and issue early warnings by analyzing the transaction behaviors of financial users. The method includes: obtaining historical operation records of financial users and extracting operation path data; clustering historical operation path data using a clustering algorithm to identify the operation path characteristics under different transaction types; building a transaction risk assessment model to analyze the deviation of real-time transaction behaviors; assessing risks based on the deviation, and if the risk exceeds a preset value, marking the user as a risky user and performing secondary confirmation; finally triggering a risk early warning mechanism and formulating an early warning strategy. The system includes data collection, processing, evaluation, early warning and execution modules, which work together to achieve real-time monitoring and risk early warning. The invention can accurately identify abnormal transaction behaviors, improve the intelligence and automation level of financial risk management, and has broad application prospects in the financial field. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A flowchart of a financial risk early warning method based on big data technology is shown in the present invention;

[0048] Figure 2 A flowchart of extracting historical operation path data of a financial user according to the present invention is shown;

[0049] Figure 3 A flow chart showing the risk assessment of trading operations performed by the present invention is shown;

[0050] Figure 4 A block diagram of a financial risk early warning system based on big data technology of the present invention is shown. DETAILED DESCRIPTION

[0051] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0052] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0053] Figure 1 A flow chart of a financial risk early warning method based on big data technology of the present invention is shown.

[0054] like Figure 1 As shown, the first aspect of the present invention provides a financial risk early warning method based on big data technology, comprising:

[0055] S102, acquiring historical operation record data of a financial user from a target financial server, and extracting historical operation path data of the financial user from the historical operation record data;

[0056] S104, performing a clustering operation on the historical operation path data according to a clustering algorithm to obtain an operation record clustering result;

[0057] S106, identifying transaction operation path characteristics of the financial user under different transaction types according to the operation record clustering result;

[0058] S108, constructing a transaction operation risk assessment model for the financial user according to the transaction operation path characteristics, performing a transaction operation path deviation analysis on the real-time transaction operation behavior of the financial user according to the transaction operation risk assessment model, calculating the deviation degree of the real-time transaction operation behavior of the financial user, and performing a transaction operation risk assessment according to the real-time transaction operation behavior deviation degree;

[0059] S110, if the transaction operation risk is greater than the preset risk value, the financial user is marked as a risky user, the transaction risk of the risky user is reconfirmed, a financial risk warning is issued according to the result of the second confirmation of the transaction risk, and a financial risk warning strategy is constructed.

[0060] It should be noted that by obtaining the historical operation record data of financial users (such as browsing records, transaction records, consultation records, etc.) from the target financial server, the user's transaction behavior and historical operation path can be fully understood. By extracting the user's historical operation path data and extracting structured and unstructured data, the user's operation trajectory on the financial platform can be fully reflected to form high-quality input data. The clustering algorithm is applied to cluster the historical operation path data to automatically identify different patterns of user transaction behavior. The clustering result classifies similar transaction behaviors into one category, which helps to simplify complex transaction behavior data into a category structure that is easy to analyze. This clustering process can reveal the typical operation paths of different users in different transaction scenarios; by identifying the operation path characteristics of financial users under different transaction types, the user's behavior habits and preferences in specific transaction scenarios can be further analyzed. This identification process helps to reveal the user's normal transaction mode and provide benchmark data for subsequent risk analysis. If the behavior of some users deviates from the normal mode, it will be detected in time; the construction of a transaction operation risk assessment model can combine the user's operation path characteristics with the risk assessment standards of the financial industry to form a personalized risk prediction tool, monitor user transaction behavior in real time, and conduct deviation analysis, which can detect the deviation between the user's real-time operation and the historical normal mode. This deviation analysis is based on big data technology and machine learning algorithms. It can efficiently and accurately identify potential abnormal trading behaviors and discover possible risks in a timely manner. By calculating the deviation of real-time trading operation behaviors, the risk level of user operations can be accurately quantified. The deviation reflects the difference between the user's current trading behavior and the normal operation path. The greater the deviation, the higher the risk of the trading behavior. When the risk of a trading operation exceeds the set threshold, the user is marked as a "risk user" for secondary confirmation. After further verifying the authenticity of the transaction risk through the secondary confirmation result, a financial risk warning can be effectively triggered. An automated risk warning mechanism is implemented, and financial institutions can take necessary countermeasures (such as suspending transactions, freezing accounts, etc.) in a timely manner according to the warning strategy to reduce possible financial losses.

[0061] Figure 2 A flow chart of extracting historical operation path data of a financial user according to the present invention is shown.

[0062] According to an embodiment of the present invention, the acquiring of historical operation record data of a financial user according to a target financial server and the extraction of historical operation path data of the financial user according to the historical operation record data are specifically:

[0063] S202, acquiring historical operation record data of the financial user according to the target financial server, wherein the historical operation record data includes browsing records, financial consultation records, and transaction records;

[0064] S204, sorting the historical operation record data according to timestamps to construct historical operation record time series data, and segmenting the historical operation record time series data according to transaction record time points to obtain historical operation record data segments;

[0065] S206: construct an operation record directed graph using the historical operation record data segments, and extract historical operation path data of the financial user according to the operation record directed graph.

[0066] It should be noted that sorting the operation record data according to the timestamp can reconstruct the user's real behavior path and form a logically clear time series data. By arranging the data in the time dimension, the order of user operations can be clearly presented. The sorted time series data can be segmented according to the time point of the transaction record, and the related operations can be grouped with the transaction as the core to form an independent historical operation record data segment. This segmentation method directly links the user's operation behavior with the specific transaction behavior, which improves the pertinence of the data; by converting the data segment into an operation record directed graph, the path and flow of the user's operation can be intuitively presented in a graph structure. The directed graph can describe the association relationship and order between operation nodes (such as browsing, consulting, and trading), and reveal the user's operation logic. The browsing record includes browsing content and browsing time; the financial consulting record includes consulting time, consulting type, and consulting channel; the transaction record includes transaction type, transaction time, transaction object, transaction method, and transaction amount. The data segmentation operation is to segment the operations between the transaction record and the previous transaction record into operation record data segments after each transaction is completed by the financial user. For example, if the user performs financial operations within a preset time period after completing a transaction, such as browsing financial information, conducting financial consultation, and then conducting financial transactions, the browsing of financial information, financial consultation, and financial transactions within the preset time period are segmented into the same operation record data segment, and each historical operation record data segment represents the operations performed during a transaction and before the transaction.

[0067] According to an embodiment of the present invention, the historical operation path data is clustered according to a clustering algorithm to obtain an operation record clustering result, specifically:

[0068] Setting a clustering weight for each operation record in the historical operation path data, calculating the Euclidean distance between each pair of historical operation paths in the historical operation path data, and calculating the similarity between the historical operation paths according to the Euclidean distance and the clustering weight;

[0069] Constructing a similarity matrix according to the similarity, calculating a diagonal matrix of the similarity matrix, constructing a Laplace matrix according to the similarity matrix and the diagonal matrix, performing eigenvalue decomposition on the Laplace matrix, and finding eigenvectors corresponding to the smallest k eigenvalues;

[0070] Constructing a feature matrix according to the eigenvectors corresponding to the k eigenvalues, randomly selecting k data points from the feature matrix as initial centroids, calculating the Euclidean distance from each data point in the feature matrix to each initial centroid, and assigning each data point to the cluster where the nearest initial centroid is located;

[0071] Iteratively update the cluster center and recalculate the updated Euclidean distance from each data to the updated cluster center. Allocate data points according to the updated Euclidean distance until the cluster center no longer changes, and obtain the operation record clustering result.

[0072] It should be noted that by setting clustering weights for each operation record, the influence of different operations in the clustering process can be adjusted according to their importance or frequency. This enables the clustering results to more accurately reflect the actual characteristics of user behavior, while avoiding excessive interference of a few unimportant operation records on the clustering results; by calculating the similarity between historical operation paths, constructing a similarity matrix and a Laplace matrix, and performing eigenvalue decomposition on the Laplace matrix, the potential structure of the data can be identified in a high-dimensional space, helping to distinguish the inherent differences between different user groups, avoiding the problems of over-clustering or misclassification that may occur in traditional clustering methods, and improving the accuracy of clustering; by randomly selecting the initial centroid from the feature matrix and calculating the Euclidean distance from the data point to each centroid, an effective preliminary clustering assignment can be achieved. By iteratively updating the cluster center and recalculating the Euclidean distance between the data point and the updated cluster center, the clustering results can be continuously optimized to ensure that each data point is assigned to the cluster that is most similar to it. With the gradual adjustment of the cluster center, the clustering results will gradually converge to the optimal state.

[0073] According to an embodiment of the present invention, identifying the transaction operation path characteristics of a financial user under different transaction types according to the operation record clustering result is specifically:

[0074] Extracting the transaction type to which each clustering result belongs according to the operation record clustering results, constructing the transaction operation path of the transaction type to which each clustering result belongs according to the operation record clustering results, and obtaining the transaction operation path feature;

[0075] Repeatedly identify the transaction operation path features, determine whether each transaction type has multiple transaction operation path features, mark the transaction type with multiple transaction operation path features, extract the multiple transaction operation path features of the marked transaction type and mark them as the transaction operation path features to be merged;

[0076] Calculating the proportion of each transaction operation path feature to be merged in the operation record clustering result according to the operation record clustering result, taking the transaction operation path feature to be merged with the largest proportion as the benchmark transaction operation path feature, and marking the remaining transaction operation path features to be merged as candidate transaction operation path features;

[0077] Preset a minimum support threshold for path feature merging, obtain the operation record elements included in the candidate transaction operation path features, calculate the frequency of occurrence of each operation record element in the transaction operation path features to be merged, and evaluate the support of the operation record element according to the frequency of occurrence;

[0078] Comparing the support of the operation record element with the minimum support threshold, and marking the operation record element whose support is greater than the minimum support threshold and is not included in the benchmark transaction operation path feature as a candidate frequent sub-feature;

[0079] Based on the Apriori algorithm, a hierarchical search is performed on the transaction operation path features to be merged, and the occurrence probability of the candidate frequent sub-features after each operation record in the benchmark transaction operation path features is analyzed, and the insertion position of the candidate frequent sub-features in the benchmark transaction operation path features is determined according to the occurrence probability;

[0080] The benchmark transaction operation path feature and the candidate frequent sub-features are merged according to the insertion position to obtain the transaction operation path features of the financial user under different transaction types.

[0081] It should be noted that when financial users conduct transactions, their behaviors may show multiple path characteristics, especially when users conduct multiple transactions or involve multiple transaction types, the operation path will show inconsistency. For example, in different transaction types such as stock trading, fund purchase, and credit card repayment, the user's operation path may be significantly different. By merging multiple transaction path features, especially the method based on frequent sub-feature merging (such as Apriori algorithm), the core features of the transaction path can be retained and unnecessary diversity can be removed, so that the merged operation path features can more comprehensively represent the risk pattern of the transaction type. By judging whether there are multiple transaction operation path features for each transaction type and merging the transaction types with multiple path features, the diversified behavior patterns of users under the transaction type can be captured more accurately. For example, some users may perform different types of operations in different time periods, or the same user may have different behaviors under multiple transaction types. By merging multiple path features, the model can more comprehensively reflect the transaction characteristics of users, thereby improving the representativeness of the transaction operation path features. If there are multiple path features (such as high-frequency trading, low-frequency trading, etc.) under a certain transaction type, by merging, the system can extract the common parts of these paths and consider them uniformly to avoid excessive individual differences from interfering with risk assessment, thereby more accurately identifying and assessing risks. The support is used to measure the prevalence or frequency of occurrence of a certain item set or rule in the entire data set. The higher the support, the higher the frequency of occurrence; the candidate frequent sub-feature refers to the sub-feature with potential frequent occurrence rules identified from the merged multiple transaction operation path features; the Apriori algorithm is an association rule learning algorithm; the transaction operation path feature refers to an operation mode or trajectory formed by the user according to his historical transaction behavior (such as purchase, transfer, consultation, etc.) during the financial transaction process. These modes reflect the user's behavior path and preference in different transaction types. By analyzing the historical operation data of financial users, these path features can be extracted and used to analyze the user's risk status, behavior deviation, etc.

[0082] Figure 3 A flow chart of the transaction operation risk assessment of the present invention is shown.

[0083] According to an embodiment of the present invention, the transaction operation risk assessment model of the financial user is constructed according to the transaction operation path characteristics, the transaction operation path deviation analysis is performed on the real-time transaction operation behavior of the financial user according to the transaction operation risk assessment model, the deviation degree of the real-time transaction operation behavior of the financial user is calculated, and the transaction operation risk assessment is performed according to the real-time transaction operation behavior deviation degree, specifically:

[0084] S302, constructing an operation state transfer pair for the transaction operation path feature based on a Markov chain, calculating the operation transfer probability between the operation state transfer pairs according to the historical operation path data, and constructing an operation state transfer matrix according to the operation transfer probability;

[0085] S304, constructing a transaction operation risk assessment model for the financial user according to the operation state transfer matrix, and constructing a data link channel between the transaction operation risk assessment model and the target financial server based on big data technology, wherein the data link channel includes a data interface between the target financial server and the transaction operation risk assessment model, and a data cleaning module;

[0086] S306, importing the real-time transaction operation behavior data of the financial user of the target financial service server into the transaction operation risk assessment model according to the data link channel, calculating the operation state transition probability between adjacent operation behaviors in the real-time transaction operation behavior data, and calculating the operation transition comprehensive probability of the real-time transaction operation behavior data according to the operation state transition probability between the adjacent operation behaviors;

[0087] S308, calculating the deviation between the real-time transaction operation behavior of the financial user and the transaction operation path characteristics according to the comprehensive probability of operation transfer of the real-time transaction operation behavior data, and performing risk assessment on the real-time transaction operation of the financial user according to the deviation based on the transaction operation risk assessment model to obtain a transaction operation risk assessment result.

[0088] It should be noted that by using Markov chain to describe the state transition of the transaction operation path, the time series characteristics of user behavior can be accurately captured. Markov chain can infer the transition probability of each operation of the user on the transaction operation path characteristics based on the historical operation path data. Using the operation state transition matrix, a risk assessment model of financial user behavior can be constructed to accurately identify the normal behavior trajectory and deviation behavior of the user; by comparing the real-time transaction operation behavior with the historical operation path characteristics, the deviation degree can be calculated, and it can be immediately found whether the user operation is inconsistent with its normal behavior pattern. If it is found that the user's real-time operation deviates from the normal path, the system will conduct risk assessment in time and generate an early warning; by combining big data technology and the real-time data link channel of Markov chain, the risk assessment model can be adaptively adjusted in a constantly changing market environment. By monitoring the user's transaction behavior data in real time, the model can be updated in time, and the assessment results can be adjusted according to the new data, thereby improving the accuracy and timeliness of risk assessment; through the comprehensive calculation of the operation state transition probability, a comprehensive risk score can be provided for each transaction operation behavior, which not only takes into account the user's operation path characteristics, but also integrates the relative relationship between different operations. This multi-dimensional assessment can help financial institutions more comprehensively analyze whether there are abnormalities in users' transaction behaviors; by comparing the user's real-time operation behavior with the normal pattern of its historical transaction operation path, it can quickly detect potential risks when the user has unusual transaction behavior. For example, if a user who has been operating stably for a long time suddenly has high-frequency and large-value transactions, the system will calculate the comprehensive probability of operation transfer and detect the deviation to promptly warn of risks; the operation transfer probability refers to the probability that a financial user transfers from one operation state to another within a specific time interval; the real-time transaction operation behavior data includes the financial user's real-time transaction type and browsing records and financial consultation records within a preset time period.

[0089] According to an embodiment of the present invention, if the transaction operation risk is greater than a preset risk value, the financial user is marked as a risky user, the transaction risk of the risky user is reconfirmed, a financial risk warning is issued according to the result of the transaction risk reconfirmation, and a financial risk warning strategy is constructed, specifically:

[0090] According to the transaction operation risk assessment result, if the transaction operation risk is greater than the preset risk value, the financial user is marked as a risky user, and the transaction change information of the risky user within a preset time period is obtained, and the transaction change information includes the change of transaction frequency and transaction amount;

[0091] Comprehensively analyzing the transaction change information and the transaction operation path characteristics, determining the change of the transaction change information to the transaction operation path characteristics, updating the transaction operation path characteristics according to the change, and performing a secondary risk assessment on the real-time transaction operation behavior of the risky user according to the updated transaction operation path characteristics;

[0092] If the transaction operation risk of the secondary risk assessment is still greater than the preset risk value, the real-time transaction operation behavior data of the risk user is compared with the transaction operation path characteristics to identify the missing operations of the risk user's real-time transaction operation behavior, and the missing operations are generated as warning information to perform warning reminder operations on the risk user to obtain a user warning plan;

[0093] Acquire transaction IP address information of risky users and credit rating information of transaction objects, determine the risk level of risky users according to the transaction IP address information and credit rating information of transaction objects, generate warning information according to the risk level, perform warning operations on target financial institutions, and obtain institutional warning plans;

[0094] A financial risk early warning strategy is constructed based on the user early warning plan and the institution early warning plan.

[0095] It should be noted that, through the analysis of the transaction operation risk assessment results, if the transaction operation risk of a financial user is greater than the preset risk value, the user can be immediately identified as a risky user. After being marked as a risky user, the system not only relies on the preliminary risk assessment results, but also dynamically monitors the changing trend of user behavior by obtaining transaction change information such as changes in user transaction frequency and transaction amount. This method makes risk assessment more flexible and real-time, and can respond to changes in user behavior in a timely manner and update transaction operation path characteristics. Through this continuously updated dynamic assessment mechanism, the system can more accurately assess and predict the user's potential risks and reduce misjudgments. By conducting a secondary risk assessment on the updated transaction operation path characteristics, the accuracy and credibility of risky user behavior can be further improved; after the secondary risk assessment, if the user's risk still exceeds the preset threshold, the system can identify missing operations by comparing the user's real-time transaction operation behavior and historical path characteristics. Missing operations may mean that the user's behavior is abnormal or there is potential fraud. This feature helps identify those unreasonable or hidden risk behaviors. By generating early warning information in a timely manner, the system can issue risk alerts to financial institutions or users. By combining the user's transaction behavior with multi-dimensional data such as their IP information and the credit rating of the transaction counterparty, the system can more comprehensively and accurately assess the user's risk level. Transaction IP address information helps identify whether the user has abnormal operations across regions or in high-risk areas, and the credit rating of the transaction counterparty helps determine whether the user's interaction with high-risk customers increases potential financial risks.

[0096] According to an embodiment of the present invention, it also includes:

[0097] Constructing a network monitoring system for the target financial server, obtaining the data transmission flow of the target financial server in real time according to the network monitoring system, and constructing a network transmission data packet according to the data transmission flow, wherein the network transmission data packet includes network flow fluctuation data, repeated access data and abnormal data packets;

[0098] A network abnormal behavior detection model is constructed based on the isolation forest algorithm, according to the historical network abnormal behavior data of the target financial server, the historical network abnormal behavior data includes abnormal behavior types and network change characteristics of each abnormal behavior type, the abnormal behavior types include network failures, network attacks, malicious traffic, and data packet tampering, and the network change characteristics include bandwidth utilization change characteristics, network delay characteristics, and packet loss rate characteristics;

[0099] Importing the historical network abnormal behavior data into the network abnormal behavior detection model for training, and importing the network transmission data packet into the trained network abnormal behavior detection model for network anomaly detection to obtain a network anomaly detection result;

[0100] According to the network anomaly detection result, if the target financial server is attacked maliciously, the financial user account is locked and the transaction behavior of the financial user is restricted;

[0101] If the target financial server has a network failure, obtain the real-time transaction behavior data of the financial user and the historical transaction behavior data under normal transaction status, convert the real-time transaction behavior data and the historical transaction behavior data into hash value data, perform hash value verification on the hash value data, and identify the data integrity of the real-time transaction behavior;

[0102] The impact of different degrees of network failure on the data transmission integrity of the financial user's transaction behavior is determined based on the data integrity. If the impact on the data transmission integrity is greater than a preset value, a financial user transaction behavior buffer is constructed. When the network failure degree of the target financial server is greater than a preset degree, the real-time transaction behavior data of the financial user is imported into the financial user transaction behavior buffer until the real-time transaction behavior data is transmitted when the network failure degree is no greater than the preset degree.

[0103] It should be noted that in the process of assessing the financial transaction risk of financial users, the network status of the target financial server will also affect the financial transaction risk of financial users. For example, network attacks (such as DDoS attacks, malicious traffic attacks), network failures (such as bandwidth bottlenecks, packet loss, delays, etc.) or data packet tampering may cause the financial server to be unable to process user requests normally, or even cause financial data to be lost or tampered with, resulting in erroneous transaction records, account anomalies and other problems. Therefore, by building a network monitoring system for the target financial server, its data transmission traffic is obtained in real time. These data include network traffic fluctuation data, repeated access data and abnormal data packets. By analyzing these data, potential anomalies in the network, such as network attacks, malicious traffic, repeated access, etc., can be effectively identified. Based on the isolation forest algorithm, combined with historical network abnormal behavior data (such as network failures, network attacks, malicious traffic, etc.), a network abnormal behavior detection model is trained. Isolation forest is an unsupervised learning algorithm that can automatically identify abnormal patterns in data by establishing a classification model based on a tree structure. The historical network abnormal behavior data includes network change characteristics of various abnormal behaviors, such as bandwidth utilization changes, network delay characteristics, packet loss rate characteristics, etc. By importing historical abnormal behavior data into the model for training, the model can identify abnormal data in real-time network transmission data packets, thereby realizing real-time monitoring and network anomaly detection. Once a network anomaly is detected (such as network attack, network failure, etc.), the system will automatically take corresponding countermeasures. For example, when it is found that the target financial server is under malicious attack, the system will automatically lock the financial user account and restrict its transaction behavior to prevent further risk expansion. For data transmission problems caused by network failures, the system will judge the integrity of transaction behavior data according to the severity of the network failure. If the data integrity is greatly affected (such as severe packet loss, high latency, etc.), the system will build a buffer for financial user transaction behavior. When the degree of network failure exceeds the preset threshold, the system will temporarily store the user's real-time transaction behavior data in the buffer, and then transmit the data after the network returns to normal. This ensures that transaction data is not lost on the one hand, and avoids transaction data errors or anomalies caused by network failures on the other hand.

[0104] According to an embodiment of the present invention, it also includes:

[0105] Acquire network traffic change information of the target financial server within a preset time period, and determine the transaction change amount of the financial user within the preset time period according to the network traffic change information;

[0106] Building a transaction change prediction model for financial users based on the LSTM algorithm, importing the transaction change into the transaction change prediction model for training, and predicting the transaction change in a future preset time period to obtain a transaction change prediction result;

[0107] Determine the amount of concurrent transaction data within a preset time period in the future according to the transaction change amount prediction result, obtain data processing performance information of the target financial server, and determine the data processing amount threshold of concurrent transactions according to the data processing performance information;

[0108] If the concurrent transaction data volume is greater than the data processing volume threshold, determine the concurrent transaction peak time period according to the transaction change volume prediction result, adjust the bandwidth resources of the target financial service server during the concurrent transaction peak time period, and obtain a monitoring resource one-time adjustment strategy;

[0109] Obtain operational behavior data of financial users during the peak time period of concurrent transactions, obtain the risk impact of the operational behavior data on financial transactions, adjust the risk monitoring sensitivity of financial users during the peak time period of concurrent transactions according to the risk impact, obtain a secondary adjustment strategy for monitoring resources, and adjust the financial risk monitoring resources during the peak time period of concurrent transactions according to the primary adjustment strategy for monitoring resources and the secondary adjustment strategy for monitoring resources.

[0110] It should be noted that the LSTM algorithm is a long short-term memory network; the LSTM algorithm is used to accurately predict the transaction changes of financial users, and the transaction fluctuations within the preset time period in the future can be identified; based on the prediction results of the transaction changes, the amount of concurrent transaction data in the future high concurrency period can be accurately calculated; after determining the amount of concurrent transaction data in the future, the impact of the concurrent transaction data on the server performance can be reasonably predicted by obtaining the data processing performance information of the target financial server in real time, so as to set a reasonable data processing volume threshold. When the amount of concurrent transaction data exceeds the threshold, the system can automatically adjust the bandwidth resources of the target financial service server to ensure that the server can run stably under high concurrent load. Through the accurate prediction of the peak period of concurrent transactions, the system can automatically pre-schedule monitoring resources. For example, bandwidth can be increased, storage can be optimized, and computing power can be improved; after predicting the peak period of concurrent transactions, the system will evaluate the risk impact of the transaction based on the operation behavior data of the financial user. Through real-time monitoring of operational behavior data (such as abnormal trading behavior, abnormal capital flow, etc.), the system can evaluate the potential risks of these behaviors to transaction security under high concurrency conditions, and automatically adjust the risk monitoring sensitivity during this period. Automatic adjustment of sensitivity and resource allocation can effectively reduce the risk of system overload and avoid monitoring failures caused by resource shortages. By optimizing resource allocation, the system can maintain efficient operation during high concurrency periods.

[0111] Figure 4 A block diagram of a financial risk early warning system based on big data technology of the present invention is shown.

[0112] The second aspect of the present invention further provides a financial risk early warning system 4 based on big data technology, the system comprising: a memory 41, a processor 42, the memory comprising a financial risk early warning method program based on big data technology, the financial risk early warning method program based on big data technology when executed by the processor, implements the following steps:

[0113] Acquire historical operation record data of a financial user according to a target financial server, and extract historical operation path data of the financial user according to the historical operation record data;

[0114] Performing a clustering operation on the historical operation path data according to a clustering algorithm to obtain an operation record clustering result;

[0115] Identifying transaction operation path characteristics of financial users under different transaction types according to the operation record clustering results;

[0116] constructing a transaction operation risk assessment model for the financial user according to the transaction operation path characteristics, performing a transaction operation path deviation analysis on the real-time transaction operation behavior of the financial user according to the transaction operation risk assessment model, calculating the deviation degree of the real-time transaction operation behavior of the financial user, and performing a transaction operation risk assessment according to the real-time transaction operation behavior deviation degree;

[0117] If the transaction operation risk is greater than the preset risk value, the financial user will be marked as a risky user, and the transaction risk of the risky user will be reconfirmed. A financial risk warning will be issued based on the result of the second confirmation of the transaction risk, and a financial risk warning strategy will be established.

[0118] The present invention discloses a financial risk early warning method and system based on big data technology, which aims to evaluate risks in real time and issue early warnings by analyzing the transaction behaviors of financial users. The method includes: obtaining historical operation records of financial users and extracting operation path data; clustering historical operation path data using a clustering algorithm to identify the operation path characteristics under different transaction types; building a transaction risk assessment model to analyze the deviation of real-time transaction behaviors; assessing risks based on the deviation, and if the risk exceeds a preset value, marking the user as a risky user and performing secondary confirmation; finally triggering a risk early warning mechanism and formulating an early warning strategy. The system includes data collection, processing, evaluation, early warning and execution modules, which work together to achieve real-time monitoring and risk early warning. The invention can accurately identify abnormal transaction behaviors, improve the intelligence and automation level of financial risk management, and has broad application prospects in the financial field.

[0119] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0120] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0121] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0122] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks or optical disks, and other media that can store program codes.

[0123] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0124] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A financial risk early warning method based on big data technology, characterized in that: The following steps are involved: Acquire historical operation record data of a financial user according to a target financial server, and extract historical operation path data of the financial user according to the historical operation record data; Performing a clustering operation on the historical operation path data according to a clustering algorithm to obtain an operation record clustering result; Identifying transaction operation path characteristics of financial users under different transaction types according to the operation record clustering results; constructing a transaction operation risk assessment model for the financial user according to the transaction operation path characteristics, performing a transaction operation path deviation analysis on the real-time transaction operation behavior of the financial user according to the transaction operation risk assessment model, calculating the deviation degree of the real-time transaction operation behavior of the financial user, and performing a transaction operation risk assessment according to the real-time transaction operation behavior deviation degree; If the transaction operation risk is greater than the preset risk value, the financial user will be marked as a risky user, and the transaction risk of the risky user will be reconfirmed. A financial risk warning will be issued based on the result of the second confirmation of the transaction risk, and a financial risk warning strategy will be established.

2. The financial risk early warning method based on big data technology according to claim 1 is characterized in that: The acquiring of the historical operation record data of the financial user according to the target financial server and the extraction of the historical operation path data of the financial user according to the historical operation record data are specifically: Acquire historical operation record data of a financial user according to a target financial server, wherein the historical operation record data includes browsing records, financial consultation records, and transaction records; Sorting the historical operation record data according to timestamps to construct historical operation record time series data, and segmenting the historical operation record time series data according to transaction record time points to obtain historical operation record data segments; The historical operation record data segments are used to construct an operation record directed graph, and the historical operation path data of the financial user is extracted according to the operation record directed graph.

3. The financial risk early warning method based on big data technology according to claim 1 is characterized in that: The clustering operation is performed on the historical operation path data according to the clustering algorithm to obtain the operation record clustering result, which is specifically: Setting a clustering weight for each operation record in the historical operation path data, calculating the Euclidean distance between each pair of historical operation paths in the historical operation path data, and calculating the similarity between the historical operation paths according to the Euclidean distance and the clustering weight; Constructing a similarity matrix according to the similarity, calculating a diagonal matrix of the similarity matrix, constructing a Laplace matrix according to the similarity matrix and the diagonal matrix, performing eigenvalue decomposition on the Laplace matrix, and finding eigenvectors corresponding to the smallest k eigenvalues; Constructing a feature matrix according to the eigenvectors corresponding to the k eigenvalues, randomly selecting k data points from the feature matrix as initial centroids, calculating the Euclidean distance from each data point in the feature matrix to each initial centroid, and assigning each data point to the cluster where the nearest initial centroid is located; Iteratively update the cluster center and recalculate the updated Euclidean distance from each data to the updated cluster center. Allocate data points according to the updated Euclidean distance until the cluster center no longer changes, and obtain the operation record clustering result.

4. The financial risk early warning method based on big data technology according to claim 1 is characterized in that: The identifying the transaction operation path characteristics of the financial user under different transaction types according to the operation record clustering result is specifically: Extracting the transaction type to which each clustering result belongs according to the operation record clustering results, constructing the transaction operation path of the transaction type to which each clustering result belongs according to the operation record clustering results, and obtaining the transaction operation path feature; Repeatedly identify the transaction operation path features, determine whether each transaction type has multiple transaction operation path features, mark the transaction type with multiple transaction operation path features, extract the multiple transaction operation path features of the marked transaction type and mark them as the transaction operation path features to be merged; Calculating the proportion of each transaction operation path feature to be merged in the operation record clustering result according to the operation record clustering result, taking the transaction operation path feature to be merged with the largest proportion as the benchmark transaction operation path feature, and marking the remaining transaction operation path features to be merged as candidate transaction operation path features; Preset a minimum support threshold for path feature merging, obtain the operation record elements included in the candidate transaction operation path features, calculate the frequency of occurrence of each operation record element in the transaction operation path features to be merged, and evaluate the support of the operation record element according to the frequency of occurrence; Comparing the support of the operation record element with the minimum support threshold, and marking the operation record element whose support is greater than the minimum support threshold and is not included in the benchmark transaction operation path feature as a candidate frequent sub-feature; Based on the Apriori algorithm, a hierarchical search is performed on the transaction operation path features to be merged, and the occurrence probability of the candidate frequent sub-features after each operation record in the benchmark transaction operation path features is analyzed, and the insertion position of the candidate frequent sub-features in the benchmark transaction operation path features is determined according to the occurrence probability; The benchmark transaction operation path feature and the candidate frequent sub-features are merged according to the insertion position to obtain the transaction operation path features of the financial user under different transaction types.

5. The financial risk early warning method based on big data technology according to claim 1 is characterized in that: The step of constructing a transaction operation risk assessment model for a financial user according to the transaction operation path characteristics, performing a transaction operation path deviation analysis on the real-time transaction operation behavior of the financial user according to the transaction operation risk assessment model, calculating the deviation degree of the real-time transaction operation behavior of the financial user, and performing a transaction operation risk assessment according to the real-time transaction operation behavior deviation degree is specifically as follows: constructing an operation state transfer pair for the transaction operation path features based on a Markov chain, calculating the operation transfer probability between the operation state transfer pairs according to the historical operation path data, and constructing an operation state transfer matrix according to the operation transfer probability; Constructing a transaction operation risk assessment model for financial users according to the operation state transfer matrix, and constructing a data link channel between the transaction operation risk assessment model and the target financial server based on big data technology, wherein the data link channel includes a data interface between the target financial server and the transaction operation risk assessment model, and a data cleaning module; Importing the real-time transaction operation behavior data of the financial user of the target financial service server into the transaction operation risk assessment model according to the data link channel, calculating the operation state transition probability between adjacent operation behaviors in the real-time transaction operation behavior data, and calculating the operation transition comprehensive probability of the real-time transaction operation behavior data according to the operation state transition probability between the adjacent operation behaviors; The deviation between the real-time transaction operation behavior of the financial user and the transaction operation path characteristics is calculated according to the comprehensive probability of operation transfer of the real-time transaction operation behavior data, and the real-time transaction operation of the financial user is risk assessed according to the deviation based on the transaction operation risk assessment model to obtain a transaction operation risk assessment result.

6. The financial risk early warning method based on big data technology according to claim 1 is characterized in that: If the transaction operation risk is greater than the preset risk value, the financial user is marked as a risky user, the transaction risk of the risky user is reconfirmed, and a financial risk warning is issued based on the transaction risk reconfirmation result, and a financial risk warning strategy is constructed, specifically: According to the transaction operation risk assessment result, if the transaction operation risk is greater than the preset risk value, the financial user is marked as a risky user, and the transaction change information of the risky user within a preset time period is obtained, and the transaction change information includes the change of transaction frequency and transaction amount; Comprehensively analyzing the transaction change information and the transaction operation path characteristics, determining the change of the transaction change information to the transaction operation path characteristics, updating the transaction operation path characteristics according to the change, and performing a secondary risk assessment on the real-time transaction operation behavior of the risky user according to the updated transaction operation path characteristics; If the transaction operation risk of the secondary risk assessment is still greater than the preset risk value, the real-time transaction operation behavior data of the risk user is compared with the transaction operation path characteristics to identify the missing operations of the risk user's real-time transaction operation behavior, and the missing operations are generated as warning information to perform warning reminder operations on the risk user to obtain a user warning plan; Acquire transaction IP address information of risky users and credit rating information of transaction objects, determine the risk level of risky users according to the transaction IP address information and credit rating information of transaction objects, generate warning information according to the risk level, perform warning operations on target financial institutions, and obtain institutional warning plans; A financial risk early warning strategy is constructed based on the user early warning plan and the institution early warning plan.

7. A financial risk early warning system based on big data technology, characterized in that: The financial risk early warning system based on big data technology includes a storage device and a processor. The storage device includes a financial risk early warning method program based on big data technology. When the financial risk early warning method program based on big data technology is executed by the processor, the following steps are implemented: Acquire historical operation record data of a financial user according to a target financial server, and extract historical operation path data of the financial user according to the historical operation record data; Performing a clustering operation on the historical operation path data according to a clustering algorithm to obtain an operation record clustering result; Identifying transaction operation path characteristics of financial users under different transaction types according to the operation record clustering results; constructing a transaction operation risk assessment model for the financial user according to the transaction operation path characteristics, performing a transaction operation path deviation analysis on the real-time transaction operation behavior of the financial user according to the transaction operation risk assessment model, calculating the deviation degree of the real-time transaction operation behavior of the financial user, and performing a transaction operation risk assessment according to the real-time transaction operation behavior deviation degree; If the transaction operation risk is greater than the preset risk value, the financial user will be marked as a risky user, and the transaction risk of the risky user will be reconfirmed. A financial risk warning will be issued based on the result of the second confirmation of the transaction risk, and a financial risk warning strategy will be established.

Images