Bank fraud risk determination method and system based on equipment data

Abstract

The invention provides a bank fraud risk determination method and system based on equipment data. The method comprises the following steps: acquiring risk control scenes related to equipment characteristics and equipment fraud characteristics in the corresponding risk control scenes; obtaining equipment related original data of each risk control scene; carding, cleaning and verifying the related original data of the equipment, and obtaining the cleaned and verified related original data of the equipment; constructing an equipment-related original data bottom table based on the cleaned and verified equipment-related original data; and according to the constructed equipment related original data bottom table, constructing an equipment fraud evaluation model, and outputting an equipment fraud score. According to the method, equipment fraud identification is introduced into the risk control credit field, the characteristics of multiple equipment fraud risk scenes and diversified fraud means in the credit field are considered, and a reference standard is provided for a practitioner to decide whether to be reliable or not when the practitioner depends on an equipment fraud risk index.

Description

Technical Field

[0001] The present application relates to the field of financial risk control technology, and in particular to a method and system for identifying bank fraud risks based on device data. Background Art

[0002] In the credit business, risk control scenarios generally include marketing customer acquisition, pre-loan credit, loan disbursement, post-loan collection, etc. Among them, pre-loan credit and loan disbursement are the high-risk links of equipment fraud. Based on the basic data of different links, relevant feature variables are derived to train equipment fraud models for pre-loan monitoring.

[0003] Fraud risks are increasingly showing the characteristics of industrial chain. Around the implementation of fraud, a professional technology development industry has been formed, such as false information, counterfeit applications, false transactions, equipment fraud, etc.; identity packaging and false equipment provision industry, such as equipment farms, cloud phones, machine modification tool sales, etc.; business loophole discovery and fraud method teaching industry, and people engaged in these industries have a high level of technology. They will test the anti-fraud rules of financial institutions in various ways, and then use the technology and information provided by the first two industries to commit fraud. This kind of equipment fraud is sometimes not easy to detect, and the use of artificial intelligence algorithms to identify may result in slipping through the net. The mining method based on equipment characteristics can effectively make up for this shortcoming. Summary of the invention

[0004] The present application provides a method and system for identifying bank fraud risks based on device data, which can solve the technical problem in the prior art that the methods used by fraudsters in the risk control field are systematic, technological and highly centralized, making it difficult to detect device farms, cloud simulators and modified machines in real time.

[0005] In a first aspect, the present application provides a method for identifying bank fraud risk based on device data, comprising the following steps:

[0006] Obtain risk control scenarios related to device features and device fraud features under corresponding risk control scenarios;

[0007] Obtain raw data related to equipment in each risk control scenario;

[0008] Sort, clean and verify the original data related to the equipment, and obtain the cleaned and verified original data related to the equipment;

[0009] Construct a base table of equipment-related raw data based on the cleaned and verified equipment-related raw data;

[0010] Based on the constructed base table of device-related original data, a device fraud assessment model is built to output the device fraud score.

[0011] In combination with the first aspect, in one implementation, obtaining the device-related raw data of each risk control scenario specifically includes the following steps:

[0012] According to the equipment fraud features to be derived, extract the equipment-related raw data of the corresponding nodes of the pre-loan credit risk control scenario and the mid-loan payment risk control scenario respectively;

[0013] How to obtain raw data related to the device;

[0014] Get the logic for generating level labels for device-related raw data.

[0015] In combination with the first aspect, in one implementation, combing, cleaning and verifying the device-related raw data to obtain the cleaned and verified device-related raw data specifically includes the following steps:

[0016] Divide the equipment-related raw data into basic information data and equipment information data;

[0017] Clean the original device-related data divided into basic information data and device information data to obtain the cleaned original device-related data;

[0018] Verify the source of the cleaned equipment-related original data and whether the logic meets the business needs, and obtain the verified equipment-related original data.

[0019] In combination with the first aspect, in one embodiment, constructing a base table of device-related raw data based on the cleaned and verified device-related raw data specifically includes the following steps:

[0020] The cleaned and verified equipment-related raw data is stored in the equipment-related raw data master table according to the order dimension;

[0021] Set the data update mode in the equipment-related raw data base table to real-time.

[0022] In combination with the first aspect, in one implementation, the device fraud assessment model is constructed based on the device-related original data base table, and the device fraud score is output, which specifically includes the following steps:

[0023] Constructing grade labels for basic user information, and using the basic information for constructing grade labels and equipment information as input equipment characteristic variables before missing value processing;

[0024] Based on the constructed feature base table, the pre-selected input mold equipment feature variables before missing value processing are processed by deletion or median filling to obtain the pre-selected input mold equipment feature variables;

[0025] A decision tree is used to screen all pre-selected mold-entry equipment characteristic variables to obtain the screened equipment characteristic variables;

[0026] Perform final modeling based on the screened device feature variables to obtain the final device fraud assessment model;

[0027] Evaluate the final equipment fraud assessment model's business demand assessment performance and effectiveness to obtain a trained equipment fraud assessment model that meets business needs;

[0028] Confirm the underlying data processing and storage management methods of the device fraud assessment model that is finally trained to meet business needs, rely on the database on the server to achieve real-time score derivation, and obtain the device fraud score.

[0029] In combination with the first aspect, in one implementation, after constructing the device fraud assessment model based on the constructed device-related original data base table and outputting the device fraud score, the following steps are also included:

[0030] The constructed device fraud assessment model is encapsulated into a standardized function.

[0031] In combination with the first aspect, in one implementation, after constructing the device fraud assessment model based on the constructed device-related original data base table and outputting the device fraud score, the following steps are also included:

[0032] Based on the obtained device fraud score, the user's device fraud characteristics are identified.

[0033] In combination with the first aspect, in one implementation, after constructing the device fraud assessment model based on the constructed device-related original data base table and outputting the device fraud score, the following steps are also included:

[0034] Provide device abnormality warning function for device fraud characteristics;

[0035] Build a list of abnormal devices based on device fraud scores and identified device fraud features.

[0036] In a second aspect, the present application provides a banking fraud risk identification system based on device data, comprising:

[0037] The device-related risk control scenario acquisition module is used to obtain risk control scenarios related to device features and device fraud features under corresponding risk control scenarios;

[0038] A device-related raw data acquisition module, which is in communication with the device-related risk control scenario acquisition module and is used to acquire device-related raw data for each risk control scenario;

[0039] A data combing and verification module is connected to the device-related raw data acquisition module for combing, cleaning and verifying the device-related raw data to obtain the cleaned and verified device-related raw data;

[0040] A data base table construction module, which is in communication with the data combing and verification module and is used to construct a base table of device-related original data based on the cleaned and verified device-related original data;

[0041] The device fraud score acquisition module is in communication with the data base table construction module and is used to construct a device fraud assessment model based on the constructed device-related original data base table and output a device fraud score.

[0042] In conjunction with the second aspect, in one implementation, the device-related raw data acquisition module includes:

[0043] A data acquisition unit is used to extract device-related raw data of nodes corresponding to the pre-loan credit risk control scenario and the mid-loan payment risk control scenario according to the device fraud features to be derived;

[0044] A data acquisition method acquisition unit, used for acquiring the acquisition method of the original data related to the device;

[0045] The data level label generation logic acquisition unit is used to acquire the level label generation logic of the device-related original data.

[0046] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0047] This application introduces device fraud identification into the risk control credit field, taking into account the characteristics of the credit field where there are many risk scenarios for device fraud and diverse fraud methods, and provides a reference standard for practitioners to determine whether they are reliable when relying on device fraud risk indicators to make decisions. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a flowchart of a bank fraud risk identification method based on device data in this application;

[0049] Figure 2 This is a functional module block diagram of the bank fraud risk identification system based on device data in this application. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] First, some technical terms in the present application are explained to facilitate those skilled in the art to understand the present application.

[0052] AUC; Area Under the Curve, area under the curve;

[0053] LIFT; lifting degree;

[0054] IV: Information Value, information value.

[0055] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0056] First, please refer to Figure 1 The present application embodiment provides a bank fraud risk identification method based on device data, comprising the following steps:

[0057] Step S1: Obtain risk control scenarios related to device features and device fraud features under corresponding risk control scenarios;

[0058] Step S2: Obtaining raw data related to equipment in each risk control scenario;

[0059] Step S3: sorting, cleaning and verifying the original data related to the equipment, and obtaining the cleaned and verified original data related to the equipment;

[0060] Step S4: constructing a base table of equipment-related raw data based on the cleaned and verified equipment-related raw data;

[0061] Step S5: Based on the constructed base table of device-related original data, a device fraud assessment model is constructed, and a device fraud score is output.

[0062] This application introduces device fraud identification into the field of risk control credit, taking into account the characteristics of the credit field where there are many risk scenarios for device fraud and diverse fraud methods, and provides a reference standard for practitioners to determine whether they are reliable when relying on device fraud risk indicators to make decisions.

[0063] In one embodiment, the step S1: obtaining risk control scenarios related to device features and device fraud features in corresponding risk control scenarios, specifically includes the following steps:

[0064] In the credit business, the risk control scenarios where device fraud may occur include pre-loan credit and mid-loan payments; the characteristics of device fraud in the pre-loan credit risk control scenario are mainly batch applications; the characteristics of device fraud in the mid-loan payment risk control scenario are mainly device replacement attacks, device hardware parameter tampering attacks, and IP / GPS / LBS change attacks.

[0065] In one embodiment, step S2: obtaining raw data related to equipment in each risk control scenario, specifically includes the following steps:

[0066] Step S21: According to the device fraud features to be derived, extract the device-related original data of the corresponding nodes of the pre-loan credit risk control scenario and the mid-loan payment risk control scenario, such as gender, age, residential address, household registration address, device jailbreak status, screen brightness, brand model, screen height, screen resolution, system version, compiled kernel version, standby time, number of installed cheating tools and simulator type in the pre-loan credit and loan payment links; specifically, the device-related original data of each risk control scenario obtained through the SDK maintains the coverage and accuracy of the basic device data;

[0067] Step S22: obtaining the device-related raw data, which is divided into a user-filled acquisition method and a user-authorized acquisition method. If the acquisition method is user-authorized, the missing tag situation needs to be considered;

[0068] Step S23: Obtain the logic for generating the level labels of the device-related raw data, such as how to classify the residential address and the registered residence address.

[0069] This application first targets the device fraud risks that may occur in different risk control scenarios, collects basic user information that can be legally obtained in different scenarios, and then constructs device feature variables. This approach starts from the original data related to the device and avoids the problems of difficult data acquisition, low accuracy and single dimension.

[0070] In one embodiment, step S3: sorting, cleaning and verifying the original data related to the device to obtain the cleaned and verified original data related to the device is specifically implemented as follows:

[0071] Step S31: Divide the device-related raw data into basic information data and device information data; the basic information data includes address-level labels such as gender, age, education, registered address city, current residence address city, operator address city, GPS address city, etc.; the device information data includes labels such as device parameters obtained based on the SDK authorized by the user, the number of cheating tools installed using the isolated forest, the simulator type, and the device jailbreak status;

[0072] Step S32: clean the device-related original data divided into basic information data and device information data to obtain cleaned device-related original data; for example, based on the latest national standards, the household registration address of the applicant is divided into first-tier, new first-tier, second-tier, third-tier, fourth-tier and fifth-tier cities to obtain cleaned device-related original data; based on the device-related original data, the isolation forest iforrest algorithm is used as the basis, and the lexicographic difference method is used to realize the continuity of the device-related original data to obtain cleaned device-related original data;

[0073] Step S33: Verify the source of the cleaned device-related original data and whether the logic meets the business needs, and obtain the verified device-related original data. For example, the household registration address needs to be parsed according to the identity document, and the current residential address needs to be obtained according to the user's authorized GPS, so as to ensure that the data complies with the business logic and obtain the verified device-related original data.

[0074] The implementation steps of the above steps S31, S33 and S34 are not in order, and the device-related original data can be divided into basic information data and device information data, data cleaning, and data source and logic verification.

[0075] In one embodiment, step S4: constructing a base table of device-related raw data based on the cleaned and verified device-related raw data, specifically includes the following steps:

[0076] Step S41: The cleaned and verified equipment-related raw data is stored according to the order dimension, and the equipment-related raw data base table is obtained to facilitate the subsequent model feature derivation, and the basic information and equipment information labels are classified and stored;

[0077] Step S42: Setting the data update method of the equipment-related original data base table to maintain data consistency; specifically, due to the nature of the business, the equipment-related original data base table needs to be updated in real time to ensure that its data is complete and unified.

[0078] In one embodiment, the step S5: constructing a device fraud assessment model based on the device-related original data table and outputting a device fraud score specifically includes the following steps:

[0079] Step S51: constructing level labels for basic user information such as gender, age, education level, and various types of addresses, such as constructing age-level labels, constructing education level labels, and constructing city-level labels for addresses, and using the basic information for constructing level labels and device information as input device feature variables before missing value processing;

[0080] Step S52: Based on the constructed feature base table, the feature variables of the input mold equipment before the missing value processing are processed by deletion or median filling to obtain the pre-selected feature variables of the input mold equipment;

[0081] Step S53: traverse all pre-selected mold-entering equipment characteristic variables, use decision tree to screen variables, build a single pre-selected mold-entering equipment characteristic variable with the target, and use the pre-selected mold-entering equipment characteristic variable with the best model result as the first round of equipment characteristic variable selection, and so on, until the newly added equipment characteristic variable no longer makes a significant contribution to the fitting result, and then stop adding the pre-selected mold-entering equipment characteristic variable;

[0082] Step S54: Calculate the AUC of the evaluation model based on the selected device feature variables such as gender, device compiled kernel version, device screen brightness, device standby time, etc., perform final modeling on the selected device feature variables, evaluate the model classification effect with 0.6 as the cutoff point, and obtain the final device fraud evaluation model;

[0083] Step S55: Based on AUC and LIFT, evaluate whether the business demand performance of the final device fraud assessment model meets the standard. If it does not meet the standard, manually intervene in single variable screening from the perspective of IV and consistency, and finally train a device fraud assessment model that meets the business demand;

[0084] Step S56: confirming the underlying data processing and storage management method of the device fraud assessment model that is finally trained to meet the business requirements, and relying on the database on the server to achieve real-time device fraud score derivation;

[0085] Step S57: Configure the trained device fraud score in the decision engine; manually determine whether there is a fraud risk of intermediary behavior in the pre-loan stage based on the device fraud score combined with the borrower's loan application time period and loan application frequency; manually determine whether there is a group batch application fraud risk in the pre-loan stage based on the device fraud score combined with device changes and correlation conditions.

[0086] In one embodiment, the step S5: constructing a device fraud assessment model based on the constructed device-related original data base table and outputting the device fraud score, further includes the following steps:

[0087] Step S6: Encapsulate the constructed device fraud assessment model into a standardized function;

[0088] Step S7: According to the obtained device fraud score, the device fraud characteristics of the user are identified;

[0089] Step S8: Providing corresponding anti-fraud strategies for device fraud characteristics;

[0090] Step S9: providing a device abnormality warning function for device fraud characteristics;

[0091] Step S10: Construct an abnormal device list based on the device fraud score and the identified device fraud features.

[0092] Based on step S6, a standardized tool that can be used in a generalized manner is formed. The user only needs to input the user's basic information and device information, such as gender, age, residential address, household registration address, device parameters, etc., and the corresponding device fraud score can be automatically calculated, so that production can be directly called, and the operation status of the pre-loan and mid-loan models can be responded to and handled in a timely manner, with strong reusability.

[0093] In one embodiment, step S7: identifying the device fraud characteristics of the user according to the acquired device fraud score is specifically implemented as follows:

[0094] Step S71: Manually conduct special investigation and analysis on customers with concentrated equipment or abnormal coordinates on a regular basis. The analysis content includes customer source, application time, basic information, equipment information, related information and historical lending behavior characteristics, and output an analysis report;

[0095] Step S72: Combine the basic application information of the customer and the abnormal association to identify the fraudulent customer or fraudulent device and save it in the database. When saving, the customer number and ID number must be retained as the primary key to facilitate subsequent analysis in combination with the application, loan and repayment tables;

[0096] Step S73: Accumulate customer labels that are identified as fraudulent and use them as Y values ​​for monthly strategy analysis or to tune the constructed device fraud assessment model.

[0097] This application investigates and analyzes customers whose devices appear in a concentrated manner in a specific time period or whose coordinates are abnormal (compared with the application coordinates, residential coordinates, and operator coordinates), combines basic information and associations with the obtained device fraud score, identifies the user's device fraud characteristics and saves them in the database for subsequent use as the Y value for strategy or model tuning.

[0098] In one embodiment, the step S8: providing a corresponding anti-fraud strategy for the device fraud feature is specifically implemented as follows:

[0099] Step S81: Based on the derived abnormal features of the device (such as forged token, total size of SDK, jailbreak status, whether it is a cloud phone, model version, time and space drift, whether it is injected, simulator type, device tampering status, VPN proxy status, etc.), a single or combined (including decision tree model) strategy analysis is performed;

[0100] Step S82: intercept and process customers who have devices with strong fraud attributes such as jailbreak, device modification, injection, and cloud phone, and can be set to directly reject or transfer to manual;

[0101] Step S83: Monitor the triggering of abnormal devices and abnormal device-related policies according to different risk control scenarios and traffic (such as different channel sources, different traffic ports, different loan links, etc.).

[0102] In one embodiment, step S9: providing a device abnormality warning function for device fraud characteristics, which is specifically implemented as follows:

[0103] Step S91: Design relevant rules for abnormal equipment monitoring reports and warnings to ensure that the reports are concise and easy to understand, with the functions of time window screening, channel scenario screening, and traffic port screening, with high warning accuracy, and ensure that no repeated or overly sensitive warnings occur;

[0104] Step S92: Analyze the data in the monitoring report and the warning situation to assist business personnel in locking down jailbreaks, device modifications, injection of related abnormal devices and fraudulent customers.

[0105] This application designs abnormal device monitoring reports and warning rules. The concise and clear monitoring reports are convenient for observing the proportion of abnormal devices on different ports under different risk control scenarios. The warning rules need to be optimized as the business develops to ensure the effectiveness of the warning, and then analyze and monitor according to the warning situation.

[0106] In one embodiment, step S10: constructing a list of abnormal devices based on the device fraud score and the identified device fraud features is specifically implemented as follows:

[0107] Step S101: Differentiated management and control is performed on abnormal devices and associated customer basic information (such as ID number, mobile phone number, device number, unit information, and contact information). The device number and applicant ID number involved can be directly blacklisted, and the associated contacts and units need to be determined based on the associated primary key, such as mobile phone number or device number, to determine whether to blacklist or graylist control;

[0108] Step S102: Regularly monitor the additions to the list of abnormal devices and the hits in various scenarios (such as different channel sources, different traffic ports, different loan links, etc.), analyze the abnormal data, find the causes of the abnormal additions and deal with them; specifically, blacken the abnormal devices (such as device ID, IMEI, IDFA, etc.) and the basic information of related customers (such as ID number, mobile phone number, abnormal related contact information, abnormal related unit information, etc.), regularly monitor the additions to the list and the hits in various scenarios, and determine whether a special investigation is needed.

[0109] Second, please refer to Figure 2 The present application provides a bank fraud risk identification system based on device data, including a device-related risk control scenario acquisition module 100, a device-related raw data acquisition module 200, a data combing and verification module 300, a data base table construction module 400 and a device fraud score acquisition module 500; the device-related risk control scenario acquisition module 100 is used to acquire risk control scenarios related to device features and device fraud features under corresponding risk control scenarios; the device-related raw data acquisition module 200 is connected to the device-related risk control scenario acquisition module 100 for acquiring device-related raw data for each risk control scenario; The data combing and verification module 300 is communicated with the device-related original data acquisition module 200, and is used to comb, clean and verify the device-related original data to obtain the cleaned and verified device-related original data; the data base table construction module 400 is communicated with the data combing and verification module 300, and is used to construct a device-related original data base table based on the cleaned and verified device-related original data; the device fraud score acquisition module 500 is communicated with the data base table construction module 400, and is used to construct a device fraud assessment model based on the constructed device-related original data base table, and output a device fraud score.

[0110] In one embodiment, the device-related raw data acquisition module includes:

[0111] A data acquisition unit is used to extract device-related raw data of nodes corresponding to the pre-loan credit risk control scenario and the mid-loan payment risk control scenario according to the device fraud features to be derived;

[0112] A data acquisition method acquisition unit, used for acquiring the acquisition method of the original data related to the device;

[0113] The data level label generation logic acquisition unit is used to acquire the level label generation logic of the device-related original data.

[0114] Among them, the functional implementation of each module in the above-mentioned bank fraud risk identification system based on device data corresponds to the steps in the above-mentioned bank fraud risk identification method embodiment based on device data, and its functions and implementation processes will not be repeated here one by one.

[0115] In a third aspect, an embodiment of the present application also provides a readable storage medium.

[0116] The readable storage medium of the present application stores a bank fraud risk identification program based on device data, wherein when the bank fraud risk identification program based on device data is executed by a processor, the steps of the bank fraud risk identification method based on device data as described above are implemented.

[0117] Among them, the method implemented when the bank fraud risk identification program based on device data is executed can refer to the various embodiments of the bank fraud risk identification method based on device data of this application, and will not be repeated here.

[0118] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0119] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0120] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A bank fraud risk identification method based on device data, characterized in that: The following steps are involved: Obtain risk control scenarios related to device features and device fraud features under corresponding risk control scenarios; Obtain raw data related to equipment in each risk control scenario; Sort, clean and verify the original data related to the equipment, and obtain the cleaned and verified original data related to the equipment; Construct a base table of equipment-related raw data based on the cleaned and verified equipment-related raw data; Based on the constructed base table of device-related original data, a device fraud assessment model is built to output the device fraud score.

2. The bank fraud risk identification method based on device data as claimed in claim 1, characterized in that: The method of obtaining the original data related to the equipment in each risk control scenario specifically includes the following steps: According to the equipment fraud features to be derived, extract the equipment-related raw data of the corresponding nodes of the pre-loan credit risk control scenario and the mid-loan payment risk control scenario respectively; How to obtain raw data related to the device; Get the logic for generating level labels for device-related raw data.

3. The bank fraud risk identification method based on device data as claimed in claim 1, characterized in that: The cleaning and verification of the original data related to the equipment to obtain the cleaned and verified original data related to the equipment specifically includes the following steps: Divide the equipment-related raw data into basic information data and equipment information data; Clean the original device-related data divided into basic information data and device information data to obtain the cleaned original device-related data; Verify the source of the cleaned equipment-related original data and whether the logic meets the business needs, and obtain the verified equipment-related original data.

4. The bank fraud risk identification method based on device data as claimed in claim 1, characterized in that: The base table of equipment-related raw data is constructed based on the cleaned and verified equipment-related raw data, specifically comprising the following steps: The cleaned and verified equipment-related raw data is stored in the equipment-related raw data master table according to the order dimension; Set the data update mode in the equipment-related raw data base table to real-time.

5. The bank fraud risk identification method based on device data as claimed in claim 1, characterized in that: The device fraud assessment model is constructed based on the device-related original data base table, and the device fraud score is output, which specifically includes the following steps: Constructing grade labels for basic user information, and using the basic information for constructing grade labels and equipment information as input equipment characteristic variables before missing value processing; Based on the constructed feature base table, the pre-selected input mold equipment feature variables before missing value processing are processed by deletion or median filling to obtain the pre-selected input mold equipment feature variables; A decision tree is used to screen all pre-selected mold-entry equipment characteristic variables to obtain the screened equipment characteristic variables; Perform final modeling based on the screened device feature variables to obtain the final device fraud assessment model; Evaluate the final equipment fraud assessment model's business demand assessment performance and effectiveness to obtain a trained equipment fraud assessment model that meets business needs; Confirm the underlying data processing and storage management methods of the device fraud assessment model that is finally trained to meet business needs, rely on the database on the server to achieve real-time score derivation, and obtain the device fraud score.

6. The bank fraud risk identification method based on device data as claimed in claim 1, characterized in that: After constructing the device fraud assessment model based on the constructed device-related original data base table and outputting the device fraud score, the following steps are also included: The constructed device fraud assessment model is encapsulated into a standardized function.

7. The bank fraud risk identification method based on device data as claimed in claim 1, characterized in that: After constructing the device fraud assessment model based on the constructed device-related original data base table and outputting the device fraud score, the following steps are also included: Based on the obtained device fraud score, the user's device fraud characteristics are identified.

8. The bank fraud risk identification method based on device data as claimed in claim 1, characterized in that: After constructing the device fraud assessment model based on the constructed device-related original data base table and outputting the device fraud score, the following steps are also included: Provide device abnormality warning function for device fraud characteristics; Build a list of abnormal devices based on device fraud scores and identified device fraud features.

9. A banking fraud risk identification system based on device data, characterized in that: include: The device-related risk control scenario acquisition module is used to obtain risk control scenarios related to device features and device fraud features under corresponding risk control scenarios; A device-related raw data acquisition module, which is in communication with the device-related risk control scenario acquisition module and is used to acquire device-related raw data for each risk control scenario; A data combing and verification module is connected to the device-related raw data acquisition module for combing, cleaning and verifying the device-related raw data to obtain the cleaned and verified device-related raw data; A data base table construction module, which is in communication with the data combing and verification module and is used to construct a base table of device-related original data based on the cleaned and verified device-related original data; The device fraud score acquisition module is in communication with the data base table construction module and is used to construct a device fraud assessment model based on the constructed device-related original data base table and output a device fraud score.

10. The bank fraud risk identification system based on device data as claimed in claim 9, characterized in that: The device-related raw data acquisition module includes: A data acquisition unit is used to extract device-related raw data of nodes corresponding to the pre-loan credit risk control scenario and the mid-loan payment risk control scenario according to the device fraud features to be derived; A data acquisition method acquisition unit, used for acquiring the acquisition method of the original data related to the device; The data level label generation logic acquisition unit is used to acquire the level label generation logic of the device-related original data.

Images