Risk early warning method, risk early warning system and server

Abstract

The embodiment of the invention provides a risk early warning method, a risk early warning system and a server. The method comprises the steps that a server can format user behaviors and then input the formatted user behaviors into an early warning model, and abnormal risk information containing a first risk level and at least one abnormal category is output. The server can also input the historical abnormal information into the analysis model, and output risk check information including a second risk level and an abnormal reason. If the first risk level is greater than or equal to a first threshold value and the second risk level is greater than or equal to a second threshold value, the server can determine an influence parameter corresponding to each exception category according to an exception reason and a preset influence factor, and updates the first risk level according to the influence parameter to obtain a third risk level; and if the third risk level is greater than or equal to the third preset threshold value, the server can generate a risk abnormity prompt according to the to-be-verified user. The method is used for achieving the effect of improving the early warning effectiveness.

Description

Technical Field

[0001] The present application relates to the computer field, and in particular to a risk warning method, a risk warning system and a server. Background Art

[0002] With the continuous advancement of information technology, user behavior warning technology is gradually shifting from passive response to active prevention.

[0003] Currently, user behavior warnings are usually carried out by building user behavior models and conducting in-depth mining of historical data to identify abnormal user behavior.

[0004] However, how to continue to improve the effectiveness of early warning remains a technical challenge that needs to be addressed. Summary of the invention

[0005] The embodiments of the present application provide a risk warning method, a risk warning system and a server to improve the effectiveness of the warning.

[0006] In a first aspect, an embodiment of the present application provides a risk warning method, comprising:

[0007] Obtain user behavior information of the user to be verified, and input the user behavior information of the user to be verified into a preset early warning model to obtain abnormal risk information of the user to be verified; the abnormal risk information includes a first risk level and at least one abnormal category; the abnormal category represents the business type corresponding to the abnormal user behavior information of the user to be verified; the early warning model is trained based on the user behavior information for which risk labels have been set; the risk label of the user behavior information is determined based on abnormal behavior monitoring indicators;

[0008] Acquire historical abnormal information of the user to be verified, and input the historical abnormal information into a preset analysis model to obtain risk verification information of the user to be verified; the risk verification information includes a second risk level and at least one abnormal reason; the abnormal reason represents the cause of the historical abnormal information; the analysis model is a classification model generated according to a plurality of preset abnormal reasons;

[0009] If the first risk level is greater than or equal to a first threshold, and the second risk level is greater than or equal to a second threshold, determining an impact parameter corresponding to the abnormal category of the user to be verified based on the abnormal cause of the user to be verified and a preset impact factor; updating the first risk level according to the abnormal category and the impact parameter to obtain a third risk level;

[0010] If the updated third risk level is greater than or equal to the third threshold, a risk abnormality reminder is generated.

[0011] Optionally, the early warning model is trained based on user behavior information for which risk labels have been set, including:

[0012] Obtain user behavior information and user behavior results;

[0013] Generating the risk label corresponding to the user behavior information according to the user behavior result and a first mapping table; the first mapping table indicates the corresponding relationship between the user behavior result and the risk label;

[0014] Inputting the user behavior information and the risk label corresponding to the user behavior information into the early warning model for training until the performance indicator of the early warning model matches a preset performance threshold, thereby obtaining the trained early warning model;

[0015] The performance indicator is obtained by testing the early warning model through a preset verification algorithm.

[0016] Optionally, determining the impact parameter corresponding to the abnormal category of the user to be verified based on the abnormal cause of the user to be verified and a preset impact factor includes:

[0017] Determine the correlation coefficient between the abnormal cause and the abnormal category by querying a second mapping table; the second mapping table indicates the correlation coefficient between each abnormal cause and the abnormal category;

[0018] The influence parameter corresponding to the abnormal category is obtained according to the cumulative sum of the products of the preset influence factors corresponding to the various abnormal causes and the correlation coefficients.

[0019] Optionally, the method further includes:

[0020] Determine at least one superior user of the user to be verified according to a preset organizational structure; wherein different superior users have different user levels in the organizational structure;

[0021] Determining a target user level corresponding to the third risk level according to the third risk level and the third mapping table;

[0022] The risk abnormality reminder is sent to the superior user whose user level is less than or equal to the target user level.

[0023] In a second aspect, an embodiment of the present application provides a risk warning device, including:

[0024] An acquisition module is used to acquire user behavior information of a user to be verified, and input the user behavior information of the user to be verified into a preset early warning model to obtain abnormal risk information of the user to be verified; the abnormal risk information includes a first risk level and at least one abnormal category; the abnormal category represents the business type corresponding to the abnormal user behavior information of the user to be verified; the early warning model is trained based on user behavior information for which risk labels have been set; the risk label of the user behavior information is determined based on abnormal behavior monitoring indicators; historical abnormal information of the user to be verified is acquired, and the historical abnormal information is input into a preset analysis model to obtain risk verification information of the user to be verified; the risk verification information includes a second risk level and at least one abnormal reason; the abnormal reason represents the reason for the historical abnormal information; the analysis model is a classification model generated based on multiple preset abnormal reasons;

[0025] A processing module is used to determine the impact parameter corresponding to the abnormal category of the user to be verified based on the abnormal cause of the user to be verified and a preset impact factor when the first risk level is greater than or equal to a first threshold and the second risk level is greater than or equal to a second threshold; update the first risk level according to the abnormal category and the impact parameter to obtain a third risk level; and generate a risk abnormality reminder when the updated third risk level is greater than or equal to a third threshold.

[0026] Optionally, obtain a module for:

[0027] Obtain user behavior information and user behavior results;

[0028] Generating the risk label corresponding to the user behavior information according to the user behavior result and a first mapping table; the first mapping table indicates the corresponding relationship between the user behavior result and the risk label;

[0029] Inputting the user behavior information and the risk label corresponding to the user behavior information into the early warning model for training until the performance indicator of the early warning model matches a preset performance threshold, thereby obtaining the trained early warning model;

[0030] The performance indicator is obtained by testing the early warning model through a preset verification algorithm.

[0031] Optionally, the processing module is used to:

[0032] Determine the correlation coefficient between the abnormal cause and the abnormal category by querying a second mapping table; the second mapping table indicates the correlation coefficient between each abnormal cause and the abnormal category;

[0033] The influence parameter corresponding to the abnormal category is obtained according to the cumulative sum of the products of the preset influence factors corresponding to the various abnormal causes and the correlation coefficients.

[0034] Optionally, the processing module is used to:

[0035] Determine at least one superior user of the user to be verified according to a preset organizational structure; wherein different superior users have different user levels in the organizational structure;

[0036] Determining a target user level corresponding to the third risk level according to the third risk level and the third mapping table;

[0037] The risk abnormality reminder is sent to the superior user whose user level is less than or equal to the target user level.

[0038] In a third aspect, an embodiment of the present application provides a risk warning system, including:

[0039] The system management module is used to collect and record the user behavior information and abnormal information of the user to be verified. After the abnormal information is recorded, the historical abnormal information of the user to be verified is formed.

[0040] The early warning management module is used to generate abnormal risk information of the user to be verified based on the user behavior information of the user to be verified and the preset early warning model. The abnormal risk information includes a first risk level and at least one abnormal category. The abnormal category represents the business type corresponding to the abnormal user behavior information of the user to be verified. And, based on the historical abnormal information and the preset analysis model, the risk verification information of the user to be verified is generated. The risk verification information includes a second risk level and at least one abnormal reason. The abnormal reason represents the cause of the historical abnormal information. And based on the abnormal risk information and the risk verification information, a risk abnormality reminder is generated.

[0041] The statistical analysis module is used to regularly summarize abnormal risk information, risk verification information and risk abnormality reminders to obtain summary information. According to the preset items, the summary information is statistically analyzed to obtain analysis results. A statistical analysis report is generated based on the analysis results.

[0042] The model training module is used to generate training data from user behavior information and user behavior results, and use the training data to complete the training of the early warning model. In addition, it is used to evaluate the performance indicators of the trained early warning model according to the preset verification algorithm.

[0043] In a fourth aspect, an embodiment of the present application provides a server, including: a memory, a processor;

[0044] The memory stores computer-executable instructions;

[0045] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0046] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0047] In a sixth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0048] The risk warning method, risk warning system and server provided in the embodiments of the present application comprehensively collect user behavior information of users to be verified, format these user behaviors and input them into the warning model, and output abnormal risk information including a first risk level and at least one abnormal category; obtain historical abnormal information of users to be verified, and input the historical abnormal information into the analysis model, and output risk verification information including a second risk level and the cause of the abnormality; if the first risk level is greater than or equal to the first threshold, and the second risk level is greater than or equal to the second threshold, then according to the cause of the abnormality and the preset influencing factor, the influencing parameters corresponding to each abnormal category are determined, and the first risk level is updated accordingly to obtain a third risk level; if the third risk level is greater than or equal to the third preset threshold, then according to the user to be verified, a means of generating a risk abnormality reminder is achieved to improve the effectiveness of the warning. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0050] Figure 1 A flowchart of the risk warning method provided for this application;

[0051] Figure 2 An execution flow chart of the risk warning method provided for this application;

[0052] Figure 3 A schematic diagram of the structure of the risk warning device provided for this application;

[0053] Figure 4 A schematic diagram of the structure of the risk warning system provided for this application;

[0054] Figure 5 Functional diagram of the risk warning system provided for this application;

[0055] Figure 6 A schematic diagram of the structure of the server provided for this application.

[0056] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0057] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0058] It should be noted that the user information (including but not limited to user personal information, user behavior information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0059] With the rapid development and widespread application of information technology, commercial banks are facing unprecedented challenges and opportunities in risk prevention and control. In recent years, regulatory authorities have continuously strengthened guidance and supervision on commercial banks' risk prevention and control, requiring banks to not only have a sound risk management system, but also be able to efficiently respond to various potential risks. In this context, user behavior early warning technology, as an important means of risk prevention and control, is undergoing a major transformation from passive response to active prevention.

[0060] At present, user behavior early warning technology mainly builds a refined user behavior model and conducts in-depth mining and analysis of massive historical data to identify abnormal user behavior patterns. This technology can help banks detect potential risks in a timely manner, so as to take effective measures to intervene and avoid the occurrence of risk events. However, with the continuous advancement of technology and the expansion of application scenarios, how to achieve efficient and accurate user behavior early warning while fully protecting user privacy has become a technical problem that needs to be solved urgently.

[0061] In order to achieve effective early warning under the premise of protecting user privacy, the risk early warning method provided by this application integrates multi-dimensional data such as account behavior, transaction behavior, and business behavior, builds user abnormal behavior monitoring indicators and user risk behavior label library, and realizes daily accurate identification of user risk behavior. At the same time, this application also introduces other external information to ensure daily accurate monitoring and cross-verification of user abnormal behavior. During the execution of this application, this application fully applies privacy computing technology to desensitize the user's personal information. The risk early warning system provided by this application also integrates user information from systems such as internal control and compliance management information systems and violation and discipline management systems, and uses technologies such as knowledge graphs to perform multi-dimensional analysis of users. This analysis can correspond to the user's personalized dimensions. In addition, this application can also push user risk information to the corresponding superior user, so that the superior user can specifically supervise the user's behavioral risks and reduce the probability of risk occurrence.

[0062] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0063] Figure 1 The process diagram of risk warning provided for this application is as follows: Figure 1 As shown, with the server as the execution subject, the method includes:

[0064] S101. Obtain user behavior information of the user to be verified, and input the user behavior information of the user to be verified into a preset early warning model to obtain abnormal risk information of the user to be verified. The abnormal risk information includes a first risk level and at least one abnormal category. The abnormal category characterizes the business type corresponding to the abnormal user behavior information of the user to be verified. The early warning model is trained based on the user behavior information that has completed the risk label setting. The risk label of the user behavior information is determined according to the abnormal behavior monitoring indicator.

[0065] In this embodiment, the server first comprehensively collects user behavior information of the user to be verified. The user behavior may include the user behavior of the user to be verified in the process of processing transactions, the user behavior in the process of processing business, the user behavior in the process of processing accounts, etc. After obtaining the user behavior of the user to be verified, the server may format these user behaviors and input them into the early warning model. The early warning model is trained based on the user behavior information of the completed risk label setting. The early warning model can output abnormal risk information including a first risk level and at least one abnormal category. Among them, the abnormal category can be used to indicate the specific business type corresponding to the abnormality in the user behavior. Optionally, the first risk level may include an overall risk indicator. The overall risk indicator can be used to indicate, on the whole, the probability that the user behavior of the user to be verified is at risk. Optionally, the first risk level may also include multiple business risk indicators. The business risk indicator can be used to indicate the probability that the user behavior of the user to be verified is at risk in the business type corresponding to the abnormal category. Generally, the overall risk treatment can be obtained based on the business risk indicator summary.

[0066] S102, obtaining historical abnormal information of the user to be verified, and inputting the historical abnormal information into a preset analysis model to obtain risk verification information of the user to be verified. The risk verification information includes a second risk level and at least one abnormal reason. The abnormal reason represents the cause of the historical abnormal information. The analysis model is a classification model generated according to multiple preset abnormal reasons.

[0067] In this embodiment, the server may also obtain historical abnormal information of the user to be verified. Optionally, the server may obtain historical abnormal information of the user to be verified from an internal system and an external system. Optionally, the historical abnormal information includes abnormalities that have occurred in the user to be verified. The server may input the historical abnormal information into the analysis model after formatting the historical abnormal information. The analysis model may be a classification model. The classification in the analysis model may be a plurality of preset abnormal reasons. Optionally, the abnormal reason may be a personal reason of the user. Optionally, the abnormal reason may be set by a technician. The analysis model may output risk verification information including a second risk level and an abnormal reason. Optionally, the second risk level may include an overall risk index. The overall risk index may be used to indicate the probability of the user to be verified having a risk as a whole, determined based on the historical abnormal behavior of the user. Optionally, the second risk level may also include a cause risk index corresponding to each abnormal reason. The cause risk index is used to indicate the probability of the user to be verified having a risk caused by the risk reason. Among them, the overall risk index may be obtained by summarizing the cause risk index.

[0068] S103: If the first risk level is greater than or equal to the first threshold, and the second risk level is greater than or equal to the second threshold, determine the impact parameter corresponding to the abnormal category of the user to be verified based on the abnormal cause of the user to be verified and the preset impact factor. Update the first risk level according to the abnormal category and the impact parameter to obtain a third risk level.

[0069] In this embodiment, the server can cross-verify step S101 and step S102. That is, if the first risk level is greater than or equal to the first preset threshold, and the second risk level is also greater than or equal to the second preset threshold, the server determines that the user does have a risk. At this time, the server can summarize the contents in steps S101 and S102 to obtain a third risk level.

[0070] Otherwise, if the first risk level is greater than or equal to the first preset threshold, and the second risk level is less than the second preset threshold, it means that the abnormal user behavior information is sporadic. The server can record the abnormal risk information and not process it for the time being. If the first risk level is less than the first preset threshold, and the second risk level is greater than or equal to the second preset threshold, it means that there is a high possibility of risk in the user behavior information of the user to be verified, but in the current situation, the user to be verified has not yet shown any risky behavior. If the first risk level is less than the first preset threshold, and the second risk level is also less than the second preset threshold, it means that the user to be verified is very safe.

[0071] Specifically, the server may determine the impact parameter corresponding to each abnormal category according to the abnormal cause and the preset impact factor, and update the first risk level accordingly to obtain the third risk level. Optionally, the specific calculation process of the impact parameter may include:

[0072] Step 1: Determine the correlation coefficient between the abnormal cause and the abnormal category by querying the second mapping table. The second mapping table indicates the correlation coefficient between each abnormal cause and the abnormal category.

[0073] In this step, the server first accesses the second mapping table. The second mapping table lists in detail the correlation coefficients between each abnormal reason and each abnormal category. Subsequently, the server traverses all detected abnormal reasons, and for each abnormal reason, obtains the corresponding correlation coefficient of the abnormal category of the user to be verified from the second mapping table.

[0074] Step 2: Obtain the impact parameter corresponding to the abnormal category according to the cumulative sum of the products of the preset impact factors and the correlation coefficients corresponding to the various abnormal causes.

[0075] In this step, a user to be verified may correspond to multiple abnormal reasons. Also, the user to be verified may correspond to multiple abnormal categories. There may be a correlation coefficient for each abnormal category corresponding to an abnormal reason. An abnormal reason may correspond to a preset impact factor. Optionally, the preset impact factor of each abnormal reason may be a preset value. The preset value may be obtained by a technician based on the big data analysis.

[0076] The server may determine the correlation coefficient between an abnormal category and each abnormal cause for an abnormal category. The server may calculate the product of a preset impact factor of each abnormal cause and the correlation coefficient. The server may calculate the cumulative sum of the products to obtain the impact cumulative index of the abnormal category corresponding to each abnormal cause. The cumulative index is the impact output parameter corresponding to the abnormal category.

[0077] The server can optimize the first risk level according to the impact parameter. During the optimization process, the server can add the impact of the abnormal cause to the abnormal category of the user to be verified, so that the final third risk level can add personalized information and be closer to the actual situation.

[0078] S104: If the updated third risk level is greater than or equal to the third threshold, a risk abnormality reminder is generated.

[0079] In this embodiment, the server can determine whether the updated third risk level is greater than or equal to the third preset threshold. If the third risk level is greater than or equal to the third preset threshold, it means that there is a high risk in the user behavior information of the user to be verified. Therefore, the server can generate a risk abnormality reminder based on the user to be verified to achieve timely monitoring and early warning of user behavior risks. Optionally, the risk abnormality reminder may include abnormal risk information and risk verification information.

[0080] The risk warning method provided in the embodiment of the present application is that the server first comprehensively collects the user behavior information of the user to be verified, and formats these user behaviors and inputs them into the warning model, and outputs abnormal risk information including the first risk level and at least one abnormal category. The server can also obtain the historical abnormal information of the user to be verified, and input the historical abnormal information into the analysis model, and output the risk verification information including the second risk level and the abnormal cause. If the first risk level is greater than or equal to the first threshold, and the second risk level is greater than or equal to the second threshold, the server can determine the impact parameters corresponding to each abnormal category based on the abnormal cause and the preset impact factor, and update the first risk level accordingly to obtain the third risk level. If the third risk level is greater than or equal to the third preset threshold, the server can generate a risk abnormality reminder based on the user to be verified. The present application achieves the effect of improving the effectiveness of risk analysis and the effectiveness of early warning by early warning of user behavior information and optimizing early warning based on historical abnormal information.

[0081] On the basis of the above embodiment, the early warning model is trained based on the user behavior information for which the risk label setting has been completed. The specific process may include:

[0082] S201. Obtain user behavior information and user behavior results.

[0083] In this embodiment, the server may obtain the user behavior result within a preset time after obtaining the user behavior information. Alternatively, when obtaining the user behavior result, the server may extract the user behavior information corresponding to the user behavior result from the stored data. The user behavior information and user behavior construction may form the basis of the model training data.

[0084] S202: Generate a risk tag corresponding to the user behavior information according to the user behavior result and the first mapping table. The first mapping table indicates the corresponding relationship between the user behavior result and the risk tag.

[0085] In this embodiment, the server can use the preset first mapping table to query the risk label corresponding to the user behavior result. The server can format the user behavior information using a preset format. The server can use the formatted user behavior information and the risk label to generate training data.

[0086] The first mapping table defines in detail the corresponding relationship between the user behavior results and the specific risk labels. The risk labels can be predefined by the technicians.

[0087] S203: Input the user behavior information and the risk label corresponding to the user behavior information into the early warning model for training, until the performance index of the early warning model matches the preset performance threshold, thereby obtaining a trained early warning model. The performance index is obtained by testing the early warning model through a preset verification algorithm.

[0088] In this embodiment, the server can input the training data generated according to the user behavior information and the risk label into the early warning model. The early warning model can use the training data for model training. After completing a stage of model training, the server can determine whether the early warning model has completed training by calculating the performance index of the early warning model.

[0089] Optionally, a verification algorithm of the early warning model may be preset in the server. The server may use the verification algorithm to verify the early warning model to obtain the performance index of the early warning model. Optionally, the verification algorithm may be determined by calculating the prediction accuracy of the early warning model using a test set. Alternatively, the server may measure the effectiveness of the prediction model by calculating performance indicators such as accuracy, recall, F1 score, etc.

[0090] The server can determine that the early warning model has completed training when it determines that the performance indicator matches a preset performance threshold. At this time, the server can end the training of the early warning model and output the early warning model. The early warning model can be tested by a preset verification algorithm.

[0091] The risk warning method provided in the embodiment of the present application collects user behavior information and its results, generates risk labels using a first mapping table, and then iteratively trains the warning model until a performance threshold is reached, thereby improving the effectiveness of user behavior information warning.

[0092] On the basis of the above embodiment, the present application may also send the risk abnormality reminder to a specific user after generating the risk abnormality reminder, specifically including:

[0093] S301: Determine at least one superior user of the user to be verified according to a preset organizational structure, wherein different superior users have different user levels in the organizational structure.

[0094] In this embodiment, the server may obtain a preset organizational structure. The organizational structure may include the position of the user to be verified in the organizational structure, and at least one superior user of the user to be verified. The server may clearly identify and record the position of the user to be verified in the organization and the information of the superior user according to the preset organizational structure chart. Optionally, these superior users generally include different user levels.

[0095] S302: Determine a target user level corresponding to the third risk level according to the third risk level and the third mapping table.

[0096] In this embodiment, the server can determine the user level of the highest-level superior user to be notified based on the determined third risk level and refer to the third mapping table, and use the user level as the target user level. The third mapping table specifies in detail the correspondence between the risk level and the user level to be notified.

[0097] S303: Send a risk abnormality reminder to a superior user whose user level is less than or equal to the target user level.

[0098] In this embodiment, the server can automatically screen out superior users whose user levels are less than or equal to the target user level according to the target user level. The server can send risk abnormality reminders to the user terminal of the superior user to ensure that key information can be conveyed to the relevant responsible persons in a timely and accurate manner so that countermeasures can be taken quickly.

[0099] The risk warning method provided in the embodiment of the present application identifies the parent user and level of the user to be verified, and determines the target notification level in combination with the third risk level and the third mapping table. The server implements the means of accurately sending risk abnormality reminders to the parent users of the corresponding level, thereby achieving the effect of improving the efficiency of handling user abnormal behavior.

[0100] Based on the above embodiments, Figure 2 The following is an execution flow chart of the risk warning method provided by the present application. The server can screen the warning information after generating it. The warning information is a risk abnormality reminder. After completing the screening, the server can push the warning information to the corresponding superior user. The server can obtain the verification result of the superior user's verification of the warning information. The server can also obtain the audit result of the superior user's review of the warning information. The server can send the warning information to the corresponding inquiring personnel when it is determined that feedback is required based on the audit result.

[0101] Figure 3 The schematic diagram of the structure of the risk warning device provided in this application is as follows: Figure 3 As shown, the risk warning device 400 provided in this embodiment includes:

[0102] The acquisition module 401 is used to acquire the user behavior information of the user to be verified, and input the user behavior information of the user to be verified into a preset early warning model to obtain the abnormal risk information of the user to be verified; the abnormal risk information includes a first risk level and at least one abnormal category; the abnormal category represents the business type corresponding to the abnormal user behavior information of the user to be verified; the early warning model is trained based on the user behavior information for which the risk label has been set; the risk label of the user behavior information is determined based on the abnormal behavior monitoring index; the historical abnormal information of the user to be verified is acquired, and the historical abnormal information is input into a preset analysis model to obtain the risk verification information of the user to be verified; the risk verification information includes a second risk level and at least one abnormal reason; the abnormal reason represents the reason for the historical abnormal information; the analysis model is a classification model generated based on multiple preset abnormal reasons;

[0103] Processing module 402 is used to determine the impact parameter corresponding to the abnormal category of the user to be verified based on the abnormal cause of the user to be verified and the preset impact factor when the first risk level is greater than or equal to the first threshold and the second risk level is greater than or equal to the second threshold; update the first risk level according to the abnormal category and the impact parameter to obtain a third risk level; and generate a risk abnormality reminder when the updated third risk level is greater than or equal to the third threshold.

[0104] Optionally, the acquisition module 401 is used to:

[0105] Obtain user behavior information and user behavior results;

[0106] Generating the risk label corresponding to the user behavior information according to the user behavior result and a first mapping table; the first mapping table indicates the corresponding relationship between the user behavior result and the risk label;

[0107] Inputting the user behavior information and the risk label corresponding to the user behavior information into the early warning model for training until the performance indicator of the early warning model matches a preset performance threshold, thereby obtaining the trained early warning model;

[0108] The performance indicator is obtained by testing the early warning model through a preset verification algorithm.

[0109] Optionally, the processing module 402 is configured to:

[0110] Determine the correlation coefficient between the abnormal cause and the abnormal category by querying a second mapping table; the second mapping table indicates the correlation coefficient between each abnormal cause and the abnormal category;

[0111] The influence parameter corresponding to the abnormal category is obtained according to the cumulative sum of the products of the preset influence factors corresponding to the various abnormal causes and the correlation coefficients.

[0112] Optionally, the processing module 402 is configured to:

[0113] Determine at least one superior user of the user to be verified according to a preset organizational structure; wherein different superior users have different user levels in the organizational structure;

[0114] Determining a target user level corresponding to the third risk level according to the third risk level and the third mapping table;

[0115] The risk abnormality reminder is sent to the superior user whose user level is less than or equal to the target user level.

[0116] The risk warning device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0117] Figure 4 The structural diagram of the risk warning system provided for this application is as follows: Figure 4 As shown, the risk warning system 500 includes: a system management module, a warning management module, a model training module, and a statistical analysis module. Based on the risk warning system 500, the present application can realize functions such as warning model training, label management, navigation, announcements, logs, warning release, warning assignment, warning verification, warning feedback, and statistical reports. The risk warning system 500 can also include system announcements, system logs, warning information release, assignment, verification, review, model management, and label management. The distribution of the system functions can be as follows: Figure 5 shown.

[0118] The system management module 501 is used to collect and record the user behavior information and abnormal information of the user to be verified. The abnormal information is recorded to form the historical abnormal information of the user to be verified.

[0119] Among them, the early warning management module 502 is used to generate abnormal risk information of the user to be verified based on the user behavior information of the user to be verified and the preset early warning model. The abnormal risk information includes a first risk level and at least one abnormal category. The abnormal category represents the business type corresponding to the abnormal user behavior information of the user to be verified. And, based on the historical abnormal information and the preset analysis model, the risk verification information of the user to be verified is generated. The risk verification information includes a second risk level and at least one abnormal reason. The abnormal reason represents the cause of the historical abnormal information. And based on the abnormal risk information and the risk verification information, a risk abnormality reminder is generated.

[0120] The statistical analysis module 503 is used to regularly summarize the abnormal risk information, risk verification information and risk abnormality reminders to obtain summary information, and to perform statistics on the summary information according to preset items to obtain analysis results, and to generate a statistical analysis report according to the analysis results.

[0121] The model training module 504 is used to generate training data from user behavior information and user behavior results, and use the training data to complete the training of the early warning model, and is used to evaluate the performance indicators of the early warning model obtained through training according to a preset verification algorithm.

[0122] The risk warning system provided in the embodiment of the present application can execute the method provided in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0123] Based on the above embodiment, the risk warning system 500 can be deployed on the suse12 linux operating system, the middleware uses tomcat, and the database uses mysql. The risk warning system 500 efficiently utilizes the existing framework and data resources, adopts the B / S architecture, the front-end development uses the head office TaihangBoot+vue framework, and the back-end processing relies on the branch data mart.

[0124] On the basis of the above embodiments, the risk warning system 500 can also use unified identity authentication to implement access control functions. The risk warning system 500 can also perform security audit records on user behavior, perform security control on input and output, and verify the compliance and validity of data. When sensitive information is involved, the risk warning system 500 can also develop protection functions. The protection function can include hiding names, mobile phone numbers, not displaying specific asset numbers, etc. The risk warning system 500 can set resource and operation chain processing monitoring based on a unified system monitoring platform, and the session session can be uniformly set to a 30-minute session validity period.

[0125] On the basis of the above embodiment, based on the abnormal warning system, the server can also perform the following operations:

[0126] First, the server can also collect the number of warnings of a user to be verified and generate warning information of the user to be verified. The server can also send the warning information to the terminal device of the corresponding superior user.

[0127] Second, the server can also select users to be verified in batches and verify the users to be verified.

[0128] Third, the server can also classify the warning information and perform batch processing on the classified warning information.

[0129] Fourthly, the server may also query at least one corresponding warning information in response to the screening condition, and perform batch processing on the classified warning information.

[0130] Fourthly, the server may also display a delete option after displaying the list of warning information that meets the query condition. The server may delete the corresponding warning information in response to the triggering operation of the delete option.

[0131] Fifth, the server may also generate an audit process according to the user authority of the user operating the abnormal warning system.

[0132] Sixth, the user interface of the abnormal warning system can also display reminder information.

[0133] Seventh, the server can also manage the early warning model. The server can define the start and stop and scheduling frequency of the early warning model. The server can query the usage log of the early warning model.

[0134] Figure 6 This is a schematic diagram of the server structure provided for this application. Figure 6 As shown, the electronic device 600 provided in this embodiment includes: at least one processor 601 and a memory 602. Optionally, the device 60 further includes a communication component 603. The processor 601, the memory 602 and the communication component 603 are connected via a bus 604.

[0135] In a specific implementation process, at least one processor 601 executes the computer execution instructions stored in the memory 602, so that at least one processor 601 executes the above method.

[0136] The specific implementation process of the processor 601 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0137] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in the invention may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0138] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0139] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0140] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0141] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0142] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0143] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0144] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0145] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0146] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0147] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0148] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0149] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A risk early warning method, characterized in that: include: Acquire user behavior information of the user to be verified, and input the user behavior information of the user to be verified into a preset early warning model to obtain abnormal risk information of the user to be verified; The abnormal risk information includes a first risk level and at least one abnormal category; The abnormal category represents the business type corresponding to the abnormal user behavior information of the user to be verified; The early warning model is trained based on user behavior information that has completed risk label setting; The risk tag of the user behavior information is determined according to the abnormal behavior monitoring index; Acquire historical abnormal information of the user to be verified, and input the historical abnormal information into a preset analysis model to obtain risk verification information of the user to be verified; The risk verification information includes a second risk level and at least one abnormal reason; the abnormal reason represents the cause of the historical abnormal information; the analysis model is a classification model generated according to a plurality of preset abnormal reasons; If the first risk level is greater than or equal to a first threshold, and the second risk level is greater than or equal to a second threshold, determining an impact parameter corresponding to the abnormal category of the user to be verified based on the abnormal cause of the user to be verified and a preset impact factor; updating the first risk level according to the abnormal category and the impact parameter to obtain a third risk level; If the updated third risk level is greater than or equal to the third threshold, a risk abnormality reminder is generated.

2. The method according to claim 1, characterized in that The early warning model is trained based on user behavior information that has completed risk label setting, including: Obtain user behavior information and user behavior results; Generating the risk label corresponding to the user behavior information according to the user behavior result and a first mapping table; the first mapping table indicates the corresponding relationship between the user behavior result and the risk label; Inputting the user behavior information and the risk label corresponding to the user behavior information into the early warning model for training until the performance indicator of the early warning model matches a preset performance threshold, thereby obtaining the trained early warning model; The performance indicator is obtained by testing the early warning model through a preset verification algorithm.

3. The method according to claim 1, characterized in that: Determining the impact parameter corresponding to the abnormal category of the user to be verified based on the abnormal cause of the user to be verified and the preset impact factor includes: Determine the correlation coefficient between the abnormal cause and the abnormal category by querying a second mapping table; the second mapping table indicates the correlation coefficient between each abnormal cause and the abnormal category; The influence parameter corresponding to the abnormal category is obtained according to the cumulative sum of the products of the preset influence factors corresponding to the various abnormal causes and the correlation coefficients.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Determine at least one superior user of the user to be verified according to a preset organizational structure; wherein different superior users have different user levels in the organizational structure; Determining a target user level corresponding to the third risk level according to the third risk level and the third mapping table; The risk abnormality reminder is sent to the superior user whose user level is less than or equal to the target user level.

5. A risk early warning system, characterized in that: include: System management module, used to collect and record user behavior information and abnormal information of the user to be verified; The abnormal information is recorded to form the historical abnormal information of the user to be verified; An early warning management module, used to generate abnormal risk information of the user to be verified based on the user behavior information of the user to be verified and a preset early warning model; The abnormal risk information includes a first risk level and at least one abnormal category; The abnormal category represents the business type corresponding to the abnormal user behavior information of the user to be verified; and, based on the historical abnormal information and a preset analysis model, generating risk verification information of the user to be verified; The risk verification information includes a second risk level and at least one abnormal reason; the abnormal reason represents the cause of the historical abnormal information; And based on the abnormal risk information and the risk verification information, a risk abnormality reminder is generated.

6. The method according to claim 5, characterized in that The system further comprises: The statistical analysis module is used to regularly summarize the abnormal risk information, the risk verification information and the risk abnormality reminder to obtain summary information; and to perform statistics on the summary information according to preset items to obtain analysis results; and to generate a statistical analysis report based on the analysis results.

7. The method according to claim 5, characterized in that The system further comprises: The model training module is used to generate training data based on user behavior information and user behavior results, and use the training data to complete the training of the early warning model; and is used to evaluate the performance indicators of the early warning model obtained through training according to a preset verification algorithm.

8. A server, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor runs the system according to any one of claims 5 to 7, and the system executes the method according to any one of claims 1 to 4.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to run the system according to any one of claims 5 to 7 and enable the system to execute the method according to any one of claims 1 to 4.

10. A computer program product, characterized in that The invention comprises a computer program, which is used to run the system according to any one of claims 5 to 7 when executed by a processor, and causes the system to perform the method according to any one of claims 1 to 4.

Images