Financial abnormal behavior processing method based on combination of prior information and decision tree

Abstract

The invention provides a financial abnormal behavior processing method based on combination of prior information and a decision tree. The method comprises the following steps: acquiring prepared feature data and abnormal tag data, wherein the prepared feature data is data representing features of financial behaviors; calculating a correlation coefficient of the prepared feature data and the abnormal tag data, and determining the prepared feature data as candidate feature data when the correlation coefficient is greater than a preset threshold value; the candidate feature data is analyzed through a decision tree model to obtain target feature data, whether the financial behavior is abnormal or not is determined according to the target feature data, under the condition that the financial behavior is abnormal, the financial behavior is alarmed, and the decision tree model is obtained through training of multiple sets of data; each group of data in the plurality of groups of data at least comprises the historical feature data and a label for judging whether the historical feature data is the abnormal label data or not. According to the invention, the identification rate of financial abnormal behaviors is improved, and the effect of avoiding the property loss of the user is achieved.

Description

Technical Field

[0001] The present application relates to the technical field of identifying abnormal financial behavior, and in particular, to a method, device, computer-readable storage medium and electronic device for processing abnormal financial behavior based on a combination of prior information and a decision tree. Background Art

[0002] In financial scenarios, it is often necessary to select the most effective features from a large number of features given by domain experts and determine the thresholds to design real-time control rules and conduct secondary verification and interception of suspicious financial behaviors. Feature screening is an important part of the design of financial control rules. The basic principle of feature screening is based on statistical learning theory, which selects the most important features by examining the correlation, redundancy and stability between each feature and the prediction target.

[0003] One method in the prior art is based on a decision tree, which collects attack sample data and performs data preprocessing; stores the preprocessed attack sample data; extracts features and converts them into feature vectors; uses the extracted feature set as the input of the training model; establishes an improved decision tree algorithm: introduces feature weights into the decision tree algorithm, and performs feature screening by setting thresholds; samples are trained, and the improved decision tree algorithm is used to classify the samples to obtain the classification conditions and probability values ​​of the algorithm; and classifier parameters are adjusted to optimize algorithm performance. However, this method cannot process high-dimensional data and has low computational efficiency. Moreover, this method is suitable for WEB attack detection, while the present invention is used to obtain key features and corresponding thresholds to facilitate the design of anti-fraud control rules.

[0004] Another method of the prior art designs a feature screening method, system and equipment for predicting the health and remaining service life of lithium batteries. The method includes: collecting cycle data based on time series in the 1st to Nth charge and discharge cycles of lithium batteries, and dividing the cycle data into a training set and a test set; building a transformer model, inputting the training set into the transformer model for training, so as to learn the optimal cycle relationship and feature quantity; inputting the test set into the trained transformer model to extract features. This method can replace manual experience screening, quickly screen out the optimal features, and at the same time solve the problem that features cannot be extracted if a certain fixed number of cycles is not reached. The common point between this method and the present invention is that the application scenarios are all feature screening, and the difference is that this method is a deep learning method. However, the learning and training of deep learning models requires a large amount of data and computing resources, and the features screened have poor interpretability and cannot obtain feature thresholds. Therefore, an accurate feature screening method is needed. Summary of the invention

[0005] The main purpose of this application is to provide a method, device, computer-readable storage medium and electronic device for processing financial abnormal behavior based on the combination of prior information and decision trees, so as to at least alleviate the problem in the prior art that financial abnormal behavior cannot be effectively identified and causes user property losses.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for processing financial abnormal behavior based on the combination of prior information and decision trees is provided, including: obtaining preliminary feature data and abnormal label data, wherein the preliminary feature data is data characterizing the characteristics of financial behavior, and the abnormal label data is data characterizing the characteristics of financial abnormal behavior; calculating the correlation coefficient between the preliminary feature data and the abnormal label data, and when the correlation coefficient is greater than a preset threshold, determining that the preliminary feature data is candidate feature data; analyzing the candidate feature data through a decision tree model to obtain target feature data and a feature threshold, and determining whether the financial behavior is abnormal based on the target feature data and the feature threshold, and when the financial behavior is abnormal, issuing an alarm for the financial behavior, wherein the decision tree model is obtained by training multiple groups of data, and each group of the multiple groups of data at least includes historical feature data and a label of whether the historical feature data is the abnormal label data.

[0007] Optionally, the candidate feature data is analyzed through a decision tree model to obtain target feature data and feature thresholds, including: analyzing the candidate feature data through a decision tree model to obtain an importance coefficient of each candidate feature data, wherein the importance coefficient is used to characterize the importance of the candidate feature data; when the importance coefficient is greater than a preset coefficient threshold, determining that the candidate feature data corresponding to the importance coefficient is the target feature data.

[0008] Optionally, before analyzing the candidate feature data through a decision tree model, the method includes: obtaining the historical feature data, determining multiple values ​​of the historical feature data, and marking whether the historical feature data is the abnormal label data, wherein the historical feature data is data characterizing the characteristics of historical financial behavior; using the historical feature data as nodes of an initial decision tree model, using the values ​​corresponding to each of the historical feature data as branches of the nodes of the initial decision tree model, and using the label of whether the historical feature data is the abnormal label data as a leaf node of the initial decision tree model, training the initial decision tree model to obtain optimal model parameters; and configuring the initial decision tree model using the optimal model parameters to obtain the decision tree model.

[0009] Optionally, after obtaining the decision tree model, the method further includes: obtaining updated feature data, determining multiple values ​​of the updated feature data, and marking whether the updated feature data is the abnormal label data, wherein the updated feature data is data characterizing the characteristics of the latest financial behavior; using the updated feature data as nodes of the decision tree model, using the values ​​corresponding to each of the updated feature data as branches of the nodes of the decision tree model, and using the label of whether the updated feature data is the abnormal label data as a leaf node of the decision tree model, training the decision tree model to update the decision tree model.

[0010] Optionally, after obtaining the decision tree model, the method further includes: obtaining a test set, testing the decision tree model through the test set to obtain an accuracy test value, wherein the test set includes obtaining historical feature test data, multiple values ​​of the historical feature test data and label data of whether the historical feature test data is the abnormal label data, and the historical feature test data is test data that characterizes the characteristics of historical financial behavior; when the accuracy test value is greater than a preset test threshold, the decision tree model is determined to be accurate.

[0011] Optionally, determining whether the financial behavior is abnormal based on the target feature data and the feature threshold includes: extracting behavioral feature data of the financial behavior; and determining that the financial behavior is abnormal when the behavioral feature data meets the feature threshold requirement.

[0012] Optionally, after obtaining the preliminary feature data, the method further includes: performing data cleaning on the preliminary feature data to at least delete duplicate data; performing missing value processing on the preliminary feature data after data cleaning to at least delete missing values; and performing standardization on the preliminary feature data after missing value processing.

[0013] According to another aspect of the present application, there is provided a device for processing abnormal financial behavior based on a priori information combined with a decision tree, comprising: an acquisition unit, used to acquire preliminary feature data and abnormal label data, wherein the preliminary feature data is data characterizing the characteristics of the financial behavior, and the abnormal label data is data characterizing the characteristics of the abnormal financial behavior; a first determination unit, used to calculate the correlation coefficient between the preliminary feature data and the abnormal label data, and when the correlation coefficient is greater than a preset threshold, determine that the preliminary feature data is candidate feature data; a second determination unit, used to analyze the candidate feature data through a decision tree model to obtain target feature data and a feature threshold, and determine whether the financial behavior is abnormal based on the target feature data and the feature threshold, and when the financial behavior is abnormal, issue an alarm for the financial behavior, wherein the decision tree model is obtained by training multiple groups of data, and each group of the multiple groups of data at least includes historical feature data and a label of whether the historical feature data is the abnormal label data.

[0014] According to another aspect of the present application, a computer-readable storage medium is provided, which includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the methods for processing financial abnormal behaviors based on the combination of prior information and decision trees.

[0015] According to another aspect of the present application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing any one of the processing methods for abnormal financial behaviors based on the combination of prior information and decision trees.

[0016] The technical solution of the present application is applied to obtain preliminary feature data and abnormal label data, wherein the preliminary feature data is data that characterizes the characteristics of financial behavior; the correlation coefficient between the preliminary feature data and the target feature data is calculated, and when the correlation coefficient is greater than a preset threshold, the preliminary feature data is determined to be candidate feature data; the candidate feature data is analyzed by a decision tree model to obtain target feature data, and whether the financial behavior is abnormal is determined based on the target feature data, wherein the decision tree model is obtained by training multiple sets of data, and each set of data in the multiple sets of data at least includes historical feature data and a label indicating whether the historical feature data is abnormal label data. Compared with the prior art, which cannot identify abnormal behavior leading to user property loss, the present application obtains candidate feature data with high correlation by pre-screening, and then trains and analyzes the decision tree model to obtain the final target feature data, and determines whether it is financial abnormal behavior based on the screened target feature data, so as to timely identify financial abnormalities, thereby improving the recognition rate of financial abnormal behavior and achieving the effect of avoiding user property loss. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 A hardware structure block diagram of a mobile terminal for executing a method for processing financial abnormal behavior based on a priori information combined with a decision tree provided in an embodiment of the present application is shown;

[0019] Figure 2 A flowchart of a method for processing abnormal financial behavior based on a priori information combined with a decision tree provided in an embodiment of the present application is shown;

[0020] Figure 3 A flowchart of a specific method for processing abnormal financial behavior based on a priori information combined with a decision tree provided in an embodiment of the present application is shown;

[0021] Figure 4 A structural block diagram of a device for processing abnormal financial behavior based on a priori information combined with a decision tree provided in an embodiment of the present application is shown.

[0022] The above drawings include the following reference numerals:

[0023] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0024] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] For the convenience of description, some nouns or terms involved in the embodiments of the present application are explained below:

[0028] Decision Tree: Based on the known probability of occurrence of various situations, a decision tree is constructed to obtain the probability that the expected value of the net present value is greater than or equal to zero, evaluate project risks, and determine its feasibility. It is a graphical method of intuitively applying probability analysis. Since this decision branch is drawn into a graph that looks like a tree branch, it is called a decision tree. In machine learning, a decision tree is a prediction model that represents a mapping relationship between object attributes and object values.

[0029] As introduced in the background technology, the feature screening methods in the prior art have poor interpretability and accuracy, so that abnormal financial behavior cannot be accurately identified. In order to solve the problem of being unable to accurately identify abnormal financial behavior and avoid property losses, the embodiments of the present application provide a method, device, computer-readable storage medium and electronic device for processing abnormal financial behavior based on the combination of prior information and decision trees.

[0030] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0031] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 1 is a hardware structure block diagram of a mobile terminal of an embodiment of the present invention for a method for processing financial abnormal behavior based on a priori information combined with a decision tree. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is for illustration only and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0032] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for processing abnormal financial behavior based on prior information and decision tree in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above network include but are not limited to the Internet, corporate intranets, local area networks, mobile communication networks and combinations thereof. The transmission device 106 is used to receive or send data via a network. The above network specific examples may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0033] In this embodiment, a method for processing abnormal financial behavior based on a priori information combined with a decision tree and running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0034] Figure 2 1 is a flowchart of a method for processing financial abnormal behavior based on a priori information combined with a decision tree according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0035] Step S201, obtaining preliminary feature data and abnormal label data, wherein the preliminary feature data is data characterizing the characteristics of financial behavior, and the abnormal label data is data characterizing the characteristics of abnormal financial behavior;

[0036] Specifically, we first need to collect a data set containing multiple transaction features, each of which corresponds to a column or attribute in the data set. These features include continuous values ​​such as transaction amounts, as well as discrete categories such as transaction locations. The above feature data becomes preliminary feature data, which is used for the preliminary selection of subsequent features.

[0037] Step S202, calculating the correlation coefficient between the preliminary feature data and the abnormal label data, and determining the preliminary feature data as candidate feature data when the correlation coefficient is greater than a preset threshold;

[0038] Specifically, after data preprocessing, preliminary feature selection is required. The goal of the initial feature selection is to select features that are effective for the prediction target from the data set of the above-mentioned prepared feature data to reduce the complexity of the model and improve the prediction performance of the model. The data corresponding to the prediction target is the abnormal label data. By calculating the correlation coefficient between the prepared feature data and the abnormal label data, when the correlation coefficient is greater than a preset threshold, the prepared feature data is determined to be candidate feature data. The abnormal label data can be: abnormal financial accounts, amounts, transaction frequencies, etc.

[0039] Step S203, analyzing the candidate feature data through a decision tree model to obtain target feature data and feature thresholds, and determining whether the financial behavior is abnormal based on the target feature data and the feature thresholds, and in the case where the financial behavior is abnormal, issuing an alarm for the financial behavior, wherein the decision tree model is obtained by training with multiple groups of data, and each group of the multiple groups of data includes at least historical feature data and a label of whether the historical feature data is the abnormal label data.

[0040] Specifically, a decision tree model is constructed based on the selected features. The decision tree model is a tree structure in which each node represents a candidate feature data. After the decision tree is constructed, the importance and threshold of each feature can be fully determined based on information gain or Gini index. Select several features with higher feature importance and their thresholds to combine (the combination method is an or relationship or an and relationship) to form a rule model (for example, the number of transactions in the past XX hours is greater than XX and the minimum amount in the past XX hours is less than XX). The specific selection of several features depends on the requirements of the precision and recall rate of the rule model. The full amount of flow is screened using the rule model, and there will be accounts that meet the conditions of the rule model (trigger quantity), among which there will be real financial abnormal behavior accounts (hit quantity). The hit quantity / trigger quantity constitutes the precision of the rule model, and the hit quantity / all real financial abnormal behavior accounts in the same period constitute the recall rate. In the case of identifying anomalies, an alarm is issued for financial behavior, and financial institution staff are promptly reminded to track and handle abnormal behaviors to avoid customer property losses.

[0041] Through this embodiment, the preliminary feature data and abnormal label data are obtained, and the preliminary feature data is data that characterizes the characteristics of financial behavior; the correlation coefficient between the preliminary feature data and the target feature data is calculated, and when the correlation coefficient is greater than a preset threshold, the preliminary feature data is determined to be candidate feature data; the candidate feature data is analyzed by a decision tree model to obtain target feature data, and whether the financial behavior is abnormal is determined based on the target feature data. The decision tree model is obtained by training multiple groups of data, and each group of data in the multiple groups of data at least includes historical feature data and a label of whether the historical feature data is abnormal label data. Compared with the prior art, which cannot identify abnormal behavior leading to user property loss, the present application obtains candidate feature data with high correlation by pre-screening, and then trains and analyzes through a decision tree model to obtain the final target feature data, and determines whether it is financial abnormal behavior based on the screened target feature data, so as to timely identify financial anomalies, thereby improving the recognition rate of financial abnormal behavior and achieving the effect of avoiding user property loss.

[0042] In the specific implementation process, the above step S203 analyzes the candidate feature data through a decision tree model to obtain target feature data and feature thresholds, which can be achieved by the following steps: analyzing the candidate feature data through a decision tree model to obtain an importance coefficient of each candidate feature data, wherein the importance coefficient is used to characterize the importance of the candidate feature data; when the importance coefficient is greater than a preset coefficient threshold, the candidate feature data corresponding to the importance coefficient is determined to be the target feature data. The method determines the target feature data through the above steps, so that the target feature data can be accurately determined to accurately identify abnormal behavior.

[0043] Specifically, each node of the decision tree model represents a candidate feature data, each branch represents a possible feature value, and each leaf node represents a prediction result. You can choose algorithms such as ID3 and CART to build a decision tree. After the training is completed, a complete decision tree model can be obtained, and the importance index of each feature can be obtained by visualizing it. The feature importance index here includes information gain, Gini index, etc. According to the evaluation results, the most important features are selected as the target feature data. The important features are generally in the upper layer of the decision tree. In order to accurately determine the target feature data, the importance coefficient greater than the preset coefficient threshold can be used as the target feature data.

[0044] In some optional implementations, before analyzing the candidate feature data through a decision tree model, the method includes the following steps: Step S204: Acquire the historical feature data, determine multiple values ​​of the historical feature data, and mark whether the historical feature data is the abnormal label data, wherein the historical feature data is data that characterizes the characteristics of historical financial behavior; Step S205: Use the historical feature data as nodes of the initial decision tree model, use the values ​​corresponding to each of the historical feature data as branches of the nodes of the initial decision tree model, and use the labels of whether the historical feature data is the abnormal label data as leaf nodes of the initial decision tree model, train the initial decision tree model, and obtain optimal model parameters; Step S206: Use the optimal model parameters to configure the initial decision tree model to obtain the decision tree model. The method performs model training through the above steps, so that the decision tree model can be accurately determined to accurately determine the target feature data.

[0045] In the specific implementation process, the decision tree model is trained through historical feature data, corresponding feature values, and whether the feature is an abnormal label data. The training process will automatically find the structure and parameters of the decision tree so that the model has the best prediction performance on the training set. In the actual application process, the exit condition of the decision tree model can be determined by setting the number of iterations and the loss value of the loss function. After the conditions are met, the iteration exits and the final trained decision tree model is obtained.

[0046] In some other optional embodiments, after obtaining the decision tree model, the method further includes the following steps: Step 207: Acquire update feature data, determine multiple values ​​of the update feature data, and mark whether the update feature data is the abnormal label data, wherein the update feature data is data characterizing the characteristics of the latest financial behavior; Step 208: Use the update feature data as a node of the decision tree model, use the value corresponding to each update feature data as a branch of the node of the decision tree model, and use the label of whether the update feature data is the abnormal label data as a leaf node of the decision tree model, train the decision tree model, and update the decision tree model.

[0047] Specifically, the model performance is further optimized to obtain the best model prediction result. This is achieved by adjusting the parameters of the decision tree or introducing new features, namely the above-mentioned updated feature data. The subsequent training steps are the same as the model training steps mentioned above.

[0048] In some optional implementations, after obtaining the decision tree model, the method further includes the following steps: obtaining a test set, testing the decision tree model through the test set, and obtaining an accuracy test value, wherein the test set includes obtaining historical feature test data, multiple values ​​of the historical feature test data, and label data of whether the historical feature test data is the abnormal label data, and the historical feature test data is test data that characterizes the characteristics of historical financial behavior; when the accuracy test value is greater than a preset test threshold, determining that the decision tree model is accurate. The method tests the model through the above steps, so that the accuracy of the model can be tested.

[0049] In the specific implementation process, after the model is trained, the model needs to be evaluated. The test set can be used to evaluate the prediction performance of the model. Common evaluation indicators include accuracy, precision, recall, F1 value, etc. When the above evaluation indicators have a preset test threshold, it is determined that the decision tree model is accurate. In addition, cross-validation and other techniques can be used to evaluate the stability and generalization ability of the model.

[0050] In some optional implementations, the above step S203 determines whether the financial behavior is abnormal according to the target characteristic data and the characteristic threshold, which can be achieved by the following steps: extracting the behavior characteristic data of the financial behavior; and determining that the financial behavior is abnormal when the behavior characteristic data meets the characteristic threshold requirement, wherein the characteristic threshold requirement is a requirement determined according to the characteristic threshold. The method can accurately determine the abnormality of the financial behavior through the above steps.

[0051] Specifically, after the model training is completed, the target feature data is obtained, and the feature threshold corresponding to the target feature data can be obtained. When the behavior feature data of the current financial behavior is greater than the feature threshold, the financial behavior is determined to be abnormal. For example, if the transfer amount of a financial account is greater than a certain amount threshold or the number of transfers exceeds a predetermined number, it is determined to be an abnormal financial behavior.

[0052] In some other optional implementations, after obtaining the preliminary feature data, the method further includes the following steps: performing data cleaning on the preliminary feature data to at least delete duplicate data; performing missing value processing on the preliminary feature data after data cleaning to at least delete missing values; and performing standardization processing on the preliminary feature data after missing value processing. The method performs data preprocessing through the above steps, so that more standardized feature data can be obtained to facilitate model training.

[0053] In the specific implementation process, feature data needs to be preprocessed before feature screening. This includes data cleaning, missing value processing, standardization and normalization. Data cleaning can remove or replace outliers, delete duplicate data, etc. Missing value processing can fill missing values ​​or directly delete rows or columns with missing values. Standardization and normalization can adjust feature values ​​to the same scale so that each feature has equal weight when training the model.

[0054] The advantages of using prior information and decision tree models for feature selection are analyzed as follows: Existing feature screening methods include statistical methods, traditional model-based methods, and deep learning-based feature screening methods. The statistical method evaluates the importance of features by calculating the statistics of each feature and the target, such as correlation coefficient, mutual information, etc. This method cannot give a feature threshold. The method based on the traditional model uses a machine learning algorithm to evaluate and select features. This method can automatically select features related to the prediction target, but it is difficult to process high-dimensional data. The feature screening method based on deep learning is to automatically learn and select relevant features from the original data through a deep neural network model. This method can use the model's automatic learning ability and representation ability to discover more complex feature relationships from the data. However, the learning and training of deep learning models requires a large amount of data and computing resources, with low computing efficiency, and the screened features cannot give a specific threshold and have poor interpretability.

[0055] This embodiment uses a combined method of prior information and decision trees for feature screening. First, the correlation coefficient between each feature and the target variable is calculated as prior information, and several key features with large correlation coefficients are screened out, and then the key features are sent to the decision tree model for training. Therefore, this method first performs feature screening by calculating the correlation coefficient, which can reduce the dimension of high-dimensional feature data, effectively avoid overfitting, and reduce computational complexity; then a clear feature threshold is determined by the decision tree model to solve the problem that the existing method cannot give a feature threshold and is poorly interpretable. Finally, each feature is evaluated using information gain and Gini coefficient evaluation indicators to determine their importance for predicting the target. According to the evaluation results, the most influential features are selected, so the screened features have strong interpretability. It is conducive to subsequent analysis and application, especially suitable for scenarios with high interpretability requirements such as financial risk control, and is convenient for the subsequent design of abnormal behavior rule models.

[0056] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the method for processing financial abnormal behavior based on the combination of prior information and decision tree of the present application will be described in detail below in combination with specific embodiments.

[0057] This embodiment relates to a specific method for processing financial abnormal behavior based on the combination of prior information and decision trees, such as Figure 3 As shown, the following steps are included:

[0058] Step S1: data collection;

[0059] Step S2: data preprocessing;

[0060] Step S3: feature rough screening (screening by correlation coefficient);

[0061] Step S4: construct a decision tree;

[0062] Step S5: model training;

[0063] Step S6: model evaluation;

[0064] Step S7: model optimization;

[0065] Step S8: Feature fine screening (screening by importance coefficient).

[0066] The embodiment of the present application also provides a processing device for financial abnormal behavior based on the combination of prior information and decision tree. It should be noted that the processing device for financial abnormal behavior based on the combination of prior information and decision tree in the embodiment of the present application can be used to execute the processing method for financial abnormal behavior based on the combination of prior information and decision tree provided in the embodiment of the present application. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0067] The following introduces a device for processing abnormal financial behavior based on a priori information and a decision tree provided in an embodiment of the present application.

[0068] Figure 4 Schematic diagram of a device for processing financial abnormal behavior based on a priori information combined with a decision tree according to an embodiment of the present application. Figure 4 As shown, the device comprises:

[0069] An acquisition unit 10 is used to acquire preliminary feature data and abnormal label data, wherein the preliminary feature data is data characterizing the features of financial behavior, and the abnormal label data is data characterizing the features of abnormal financial behavior;

[0070] Specifically, we first need to collect a data set containing multiple transaction features, each of which corresponds to a column or attribute in the data set. These features include continuous values ​​such as transaction amounts, as well as discrete categories such as transaction locations. The above feature data becomes preliminary feature data, which is used for the preliminary selection of subsequent features.

[0071] A first determining unit 20 is used to calculate a correlation coefficient between the preliminary feature data and the abnormal label data, and determine that the preliminary feature data is candidate feature data when the correlation coefficient is greater than a preset threshold;

[0072] Specifically, after data preprocessing, preliminary feature selection is required. The goal of the initial feature selection is to select features that are effective for the prediction target from the data set of the above-mentioned prepared feature data to reduce the complexity of the model and improve the prediction performance of the model. The data corresponding to the prediction target is the abnormal label data. By calculating the correlation coefficient between the prepared feature data and the abnormal label data, when the correlation coefficient is greater than a preset threshold, the prepared feature data is determined to be candidate feature data. The abnormal label data can be: abnormal financial accounts, amounts, transaction frequencies, etc.

[0073] The second determination unit 30 is used to analyze the candidate feature data through a decision tree model to obtain target feature data and feature thresholds, and determine whether the financial behavior is abnormal based on the target feature data and the feature thresholds, and in the case where the financial behavior is abnormal, issue an alarm for the financial behavior, wherein the decision tree model is obtained by training with multiple groups of data, and each group of the multiple groups of data includes at least historical feature data and a label of whether the historical feature data is the abnormal label data.

[0074] Specifically, a decision tree model is constructed based on the selected features. The decision tree model is a tree structure in which each node represents a candidate feature data. After the decision tree is constructed, the importance and threshold of each feature can be fully determined based on information gain or Gini index. Select several features with higher feature importance and their thresholds to combine (the combination method is an or relationship or an and relationship) to form a rule model (for example, the number of transactions in the past XX hours is greater than XX and the minimum amount in the past XX hours is less than XX). The specific selection of several features depends on the requirements of the precision and recall rate of the rule model. The full amount of flow is screened using the rule model, and there will be accounts that meet the conditions of the rule model (trigger quantity), among which there will be real financial abnormal behavior accounts (hit quantity). The hit quantity / trigger quantity constitutes the precision of the rule model, and the hit quantity / all real financial abnormal behavior accounts in the same period constitute the recall rate. In the case of identifying anomalies, an alarm is issued for financial behavior, and financial institution staff are promptly reminded to track and handle abnormal behaviors to avoid customer property losses.

[0075] Through this embodiment, the preliminary feature data and abnormal label data are obtained, and the preliminary feature data is data that characterizes the characteristics of financial behavior; the correlation coefficient between the preliminary feature data and the target feature data is calculated, and when the correlation coefficient is greater than a preset threshold, the preliminary feature data is determined to be candidate feature data; the candidate feature data is analyzed by a decision tree model to obtain target feature data, and whether the financial behavior is abnormal is determined based on the target feature data. The decision tree model is obtained by training multiple groups of data, and each group of data in the multiple groups of data at least includes historical feature data and a label of whether the historical feature data is abnormal label data. Compared with the prior art, which cannot identify abnormal behavior leading to user property loss, the present application obtains candidate feature data with high correlation by pre-screening, and then trains and analyzes through a decision tree model to obtain the final target feature data, and determines whether it is financial abnormal behavior based on the screened target feature data, so as to timely identify financial anomalies, thereby improving the recognition rate of financial abnormal behavior and achieving the effect of avoiding user property loss.

[0076] In the specific implementation process, the second determination unit includes an analysis module and a determination module. The analysis module is used to analyze the candidate feature data through a decision tree model to obtain the importance coefficient of each candidate feature data, wherein the importance coefficient is used to characterize the importance of the candidate feature data; the determination module is used to determine that the candidate feature data corresponding to the importance coefficient is the target feature data when the importance coefficient is greater than a preset coefficient threshold. The device determines the target feature data through the above steps, so that the target feature data can be accurately determined to accurately identify abnormal behavior.

[0077] Specifically, each node of the decision tree model represents a candidate feature data, each branch represents a possible feature value, and each leaf node represents a prediction result. You can choose algorithms such as ID3 and CART to build a decision tree. After the training is completed, a complete decision tree model can be obtained, and the importance index of each feature can be obtained by visualizing it. The feature importance index here includes information gain, Gini index, etc. According to the evaluation results, the most important features are selected as the target feature data. The important features are generally in the upper layer of the decision tree. In order to accurately determine the target feature data, the importance coefficient greater than the preset coefficient threshold can be used as the target feature data.

[0078] In some optional embodiments, before analyzing the candidate feature data through a decision tree model, the device includes a first marking unit, a second training unit, and a configuration unit, wherein the first marking unit is used to obtain the historical feature data, determine multiple values ​​of the historical feature data, and mark whether the historical feature data is the abnormal label data, wherein the historical feature data is data that characterizes the characteristics of historical financial behavior; the first training unit is used to use the historical feature data as a node of an initial decision tree model, use the value corresponding to each of the historical feature data as a branch of the node of the initial decision tree model, and use the label of whether the historical feature data is the abnormal label data as a leaf node of the initial decision tree model, train the initial decision tree model, and obtain the optimal model parameters; the configuration unit is used to configure the initial decision tree model using the optimal model parameters to obtain the decision tree model. The device performs model training through the above steps, so that the decision tree model can be accurately determined to accurately determine the target feature data.

[0079] In the specific implementation process, the decision tree model is trained through historical feature data, corresponding feature values, and whether the feature is an abnormal label data. The training process will automatically find the structure and parameters of the decision tree so that the model has the best prediction performance on the training set. In the actual application process, the exit condition of the decision tree model can be determined by setting the number of iterations and the loss value of the loss function. After the conditions are met, the iteration exits and the final trained decision tree model is obtained.

[0080] In other optional embodiments, after obtaining the decision tree model, the device also includes a second marking unit and a second training unit, the second marking unit is used to obtain updated feature data, determine multiple values ​​of the updated feature data, and mark whether the updated feature data is the abnormal label data, wherein the updated feature data is data that characterizes the characteristics of the latest financial behavior; the second training unit is used to use the updated feature data as a node of the decision tree model, use the value corresponding to each of the updated feature data as a branch of the node of the decision tree model, and use the label of whether the updated feature data is the abnormal label data as a leaf node of the decision tree model, to train the decision tree model so as to update the decision tree model.

[0081] Specifically, the model performance is further optimized to obtain the best model prediction result. This is achieved by adjusting the parameters of the decision tree or introducing new features, namely the above-mentioned updated feature data. The subsequent training steps are the same as the model training steps mentioned above.

[0082] In some optional implementations, after obtaining the decision tree model, the device further includes a testing unit and a third determination unit, the testing unit is used to obtain a test set, and the decision tree model is tested by the test set to obtain an accuracy test value, wherein the test set includes obtaining historical feature test data, multiple values ​​of the historical feature test data, and label data of whether the historical feature test data is the abnormal label data, and the historical feature test data is test data that characterizes the characteristics of historical financial behavior; the third determination unit is used to determine that the decision tree model is accurate when the accuracy test value is greater than a preset test threshold. The device tests the model through the above steps, so that the accuracy of the model can be tested.

[0083] In the specific implementation process, after the model is trained, the model needs to be evaluated. The test set can be used to evaluate the prediction performance of the model. Common evaluation indicators include accuracy, precision, recall, F1 value, etc. When the above evaluation indicators have a preset test threshold, it is determined that the decision tree model is accurate. In addition, cross-validation and other techniques can be used to evaluate the stability and generalization ability of the model.

[0084] In some optional implementations, the second determination unit includes an extraction module and a determination module, the extraction module is used to extract the behavior feature data of the financial behavior; the determination module is used to determine that the financial behavior is abnormal when the behavior feature data meets the feature threshold requirement. The device can accurately determine the abnormality of the financial behavior through the above steps.

[0085] Specifically, after the model training is completed, the target feature data is obtained, and the feature threshold corresponding to the target feature data can be obtained. When the behavior feature data of the current financial behavior is greater than the feature threshold, the financial behavior is determined to be abnormal. For example, if the transfer amount of a financial account is greater than a certain amount threshold or the number of transfers exceeds a predetermined number, it is determined to be an abnormal financial behavior.

[0086] In some other optional embodiments, after obtaining the preliminary feature data, the device further includes a data cleaning unit, a missing value processing unit and a standardization processing unit, wherein the data cleaning unit is used to clean the preliminary feature data to at least delete duplicate data; the missing value processing unit is used to perform missing value processing on the preliminary feature data after data cleaning to at least delete missing values; and the standardization processing unit is used to perform standardization processing on the preliminary feature data after missing value processing. The device performs data preprocessing through the above steps, so that more standardized feature data can be obtained to facilitate model training.

[0087] In the specific implementation process, feature data needs to be preprocessed before feature screening. This includes data cleaning, missing value processing, standardization and normalization. Data cleaning can remove or replace outliers, delete duplicate data, etc. Missing value processing can fill missing values ​​or directly delete rows or columns with missing values. Standardization and normalization can adjust feature values ​​to the same scale so that each feature has equal weight when training the model.

[0088] The processing device for abnormal financial behavior based on the combination of prior information and decision tree includes a processor and a memory, and the acquisition unit, the first determination unit, the second determination unit, etc. are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions. The above modules are all located in the same processor; or, the above modules are located in different processors in any combination.

[0089] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the recognition rate of financial abnormal behavior can be improved by adjusting the kernel parameters.

[0090] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0091] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored program, wherein when the program is run, the device where the computer-readable storage medium is located is controlled to execute the method for processing financial abnormal behavior based on the combination of prior information and decision tree.

[0092] Specifically, the method for processing abnormal financial behavior based on the combination of prior information and decision tree includes:

[0093] Step S201, obtaining preliminary feature data and abnormal label data, wherein the preliminary feature data is data characterizing the characteristics of financial behavior, and the abnormal label data is data characterizing the characteristics of abnormal financial behavior;

[0094] Specifically, we first need to collect a data set containing multiple transaction features, each of which corresponds to a column or attribute in the data set. These features include continuous values ​​such as transaction amounts, as well as discrete categories such as transaction locations. The above feature data becomes preliminary feature data, which is used for the preliminary selection of subsequent features.

[0095] Step S202, calculating the correlation coefficient between the preliminary feature data and the abnormal label data, and determining the preliminary feature data as candidate feature data when the correlation coefficient is greater than a preset threshold;

[0096] Specifically, after data preprocessing, preliminary feature selection is required. The goal of the initial feature selection is to select features that are effective for the prediction target from the data set of the above-mentioned prepared feature data to reduce the complexity of the model and improve the prediction performance of the model. The data corresponding to the prediction target is the abnormal label data. By calculating the correlation coefficient between the prepared feature data and the abnormal label data, when the correlation coefficient is greater than a preset threshold, the prepared feature data is determined to be candidate feature data. The abnormal label data can be: abnormal financial accounts, amounts, transaction frequencies, etc.

[0097] Step S203, analyzing the candidate feature data through a decision tree model to obtain target feature data and feature thresholds, and determining whether the financial behavior is abnormal based on the target feature data and the feature thresholds, and in the case where the financial behavior is abnormal, issuing an alarm for the financial behavior, wherein the decision tree model is obtained by training with multiple groups of data, and each group of the multiple groups of data includes at least historical feature data and a label of whether the historical feature data is the abnormal label data.

[0098] Specifically, a decision tree model is constructed based on the selected features. The decision tree model is a tree structure in which each node represents a candidate feature data. The final prediction result of whether it is the target feature data is obtained by traversing the model. If it is, it indicates that the feature can identify abnormal financial behavior and is used as the target feature data to identify financial behavior. When an abnormality is identified, an alarm is issued for the financial behavior, and the staff of the financial institution is promptly reminded to track and handle the abnormal behavior to avoid customer property losses.

[0099] An embodiment of the present invention provides an electronic device, including a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the processor executes the program, at least the following steps are implemented:

[0100] Step S201, obtaining preliminary feature data and abnormal label data, wherein the preliminary feature data is data characterizing the characteristics of financial behavior, and the abnormal label data is data characterizing the characteristics of abnormal financial behavior;

[0101] Specifically, we first need to collect a data set containing multiple transaction features, each of which corresponds to a column or attribute in the data set. These features include continuous values ​​such as transaction amounts, as well as discrete categories such as transaction locations. The above feature data becomes preliminary feature data, which is used for the preliminary selection of subsequent features.

[0102] Step S202, calculating the correlation coefficient between the preliminary feature data and the abnormal label data, and determining the preliminary feature data as candidate feature data when the correlation coefficient is greater than a preset threshold;

[0103] Specifically, after data preprocessing, preliminary feature selection is required. The goal of the initial feature selection is to select features that are effective for the prediction target from the data set of the above-mentioned prepared feature data to reduce the complexity of the model and improve the prediction performance of the model. The data corresponding to the prediction target is the abnormal label data. By calculating the correlation coefficient between the prepared feature data and the abnormal label data, when the correlation coefficient is greater than a preset threshold, the prepared feature data is determined to be candidate feature data. The abnormal label data can be: abnormal financial accounts, amounts, transaction frequencies, etc.

[0104] Step S203, analyzing the candidate feature data through a decision tree model to obtain target feature data and feature thresholds, and determining whether the financial behavior is abnormal based on the target feature data and the feature thresholds, and in the case where the financial behavior is abnormal, issuing an alarm for the financial behavior, wherein the decision tree model is obtained by training with multiple groups of data, and each group of the multiple groups of data includes at least historical feature data and a label of whether the historical feature data is the abnormal label data.

[0105] Specifically, a decision tree model is constructed based on the selected features. The decision tree model is a tree structure in which each node represents a candidate feature data. The final prediction result of whether it is the target feature data is obtained by traversing the model. If it is, it indicates that the feature can identify abnormal financial behavior and is used as the target feature data to identify financial behavior. When an abnormality is identified, an alarm is issued for the financial behavior, and the staff of the financial institution is promptly reminded to track and handle the abnormal behavior to avoid customer property losses.

[0106] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0107] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method described in each embodiment of the present application:

[0108] Step S201, obtaining preliminary feature data and abnormal label data, wherein the preliminary feature data is data characterizing the characteristics of financial behavior, and the abnormal label data is data characterizing the characteristics of abnormal financial behavior;

[0109] Specifically, we first need to collect a data set containing multiple transaction features, each of which corresponds to a column or attribute in the data set. These features include continuous values ​​such as transaction amounts, as well as discrete categories such as transaction locations. The above feature data becomes preliminary feature data, which is used for the preliminary selection of subsequent features.

[0110] Step S202, calculating the correlation coefficient between the preliminary feature data and the abnormal label data, and determining the preliminary feature data as candidate feature data when the correlation coefficient is greater than a preset threshold;

[0111] Specifically, after data preprocessing, preliminary feature selection is required. The goal of the initial feature selection is to select features that are effective for the prediction target from the data set of the above-mentioned prepared feature data to reduce the complexity of the model and improve the prediction performance of the model. The data corresponding to the prediction target is the abnormal label data. By calculating the correlation coefficient between the prepared feature data and the abnormal label data, when the correlation coefficient is greater than a preset threshold, the prepared feature data is determined to be candidate feature data. The abnormal label data can be: abnormal financial accounts, amounts, transaction frequencies, etc.

[0112] Step S203, analyzing the candidate feature data through a decision tree model to obtain target feature data and feature thresholds, and determining whether the financial behavior is abnormal based on the target feature data and the feature thresholds, and in the case where the financial behavior is abnormal, issuing an alarm for the financial behavior, wherein the decision tree model is obtained by training with multiple groups of data, and each group of the multiple groups of data includes at least historical feature data and a label of whether the historical feature data is the abnormal label data.

[0113] Specifically, a decision tree model is constructed based on the selected features. The decision tree model is a tree structure in which each node represents a candidate feature data. The final prediction result of whether it is the target feature data is obtained by traversing the model. If it is, it indicates that the feature can identify abnormal financial behavior and is used as the target feature data to identify financial behavior. When an abnormality is identified, an alarm is issued for the financial behavior, and the staff of the financial institution is promptly reminded to track and handle the abnormal behavior to avoid customer property losses.

[0114] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0115] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0116] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0117] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0118] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0119] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0120] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0121] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0122] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0123] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0124] 1) The processing method of financial abnormal behavior based on the combination of prior information and decision tree of the present application obtains preliminary feature data and abnormal label data, the preliminary feature data is data that characterizes the characteristics of financial behavior; calculates the correlation coefficient between the preliminary feature data and the target feature data, and determines the preliminary feature data as candidate feature data when the correlation coefficient is greater than a preset threshold; analyzes the candidate feature data through a decision tree model to obtain target feature data, and determines whether the financial behavior is abnormal based on the target feature data. The decision tree model is obtained by training multiple groups of data, and each group of data in the multiple groups of data at least includes historical feature data and a label of whether the historical feature data is abnormal label data. Compared with the prior art, which cannot identify abnormal behavior leading to user property loss, the present application obtains candidate feature data with high correlation by pre-screening, and then trains and analyzes through a decision tree model to obtain the final target feature data, and determines whether it is financial abnormal behavior based on the screened target feature data, so as to timely identify financial abnormalities, thereby improving the recognition rate of financial abnormal behavior and achieving the effect of avoiding user property loss.

[0125] 2) The processing device for abnormal financial behavior based on prior information and decision tree of the present application obtains preliminary feature data and abnormal label data, wherein the preliminary feature data is data that characterizes the characteristics of financial behavior; calculates the correlation coefficient between the preliminary feature data and the target feature data, and determines the preliminary feature data as candidate feature data when the correlation coefficient is greater than a preset threshold; analyzes the candidate feature data through a decision tree model to obtain target feature data, and determines whether the financial behavior is abnormal based on the target feature data. The decision tree model is obtained by training multiple sets of data, and each set of data in the multiple sets of data at least includes historical feature data and a label indicating whether the historical feature data is abnormal label data. Compared with the prior art, which cannot identify abnormal behavior leading to user property loss, the present application obtains candidate feature data with high correlation through pre-screening, and then trains and analyzes through a decision tree model to obtain the final target feature data, and determines whether it is abnormal financial behavior based on the screened target feature data, so as to timely identify financial anomalies, thereby improving the recognition rate of abnormal financial behavior and achieving the effect of avoiding user property loss.

[0126] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for processing financial abnormal behavior based on the combination of prior information and decision tree, characterized in that: include: Acquire preliminary feature data and abnormal label data, wherein the preliminary feature data is data characterizing features of financial behavior, and the abnormal label data is data characterizing features of abnormal financial behavior; Calculating a correlation coefficient between the preliminary feature data and the abnormal label data, and determining the preliminary feature data as candidate feature data when the correlation coefficient is greater than a preset threshold; The candidate feature data is analyzed by a decision tree model to obtain target feature data and feature thresholds, and whether the financial behavior is abnormal is determined based on the target feature data and the feature thresholds. In the case where the financial behavior is abnormal, an alarm is issued for the financial behavior, wherein the decision tree model is obtained by training with multiple groups of data, and each group of the multiple groups of data includes at least historical feature data and a label of whether the historical feature data is the abnormal label data.

2. The method for processing financial abnormal behavior based on the combination of prior information and decision tree according to claim 1 is characterized in that: The candidate feature data is analyzed by a decision tree model to obtain target feature data and feature thresholds, including: Analyze the candidate feature data by using a decision tree model to obtain an importance coefficient of each candidate feature data, wherein the importance coefficient is used to characterize the importance of the candidate feature data; When the importance coefficient is greater than a preset coefficient threshold, the candidate feature data corresponding to the importance coefficient is determined as the target feature data.

3. The method for processing financial abnormal behavior based on the combination of prior information and decision tree according to claim 1 is characterized in that: Before analyzing the candidate feature data by a decision tree model, the method includes: Acquire the historical characteristic data, determine multiple values ​​of the historical characteristic data, and mark whether the historical characteristic data is the abnormal label data, wherein the historical characteristic data is data characterizing the characteristics of historical financial behavior; The historical feature data is used as a node of an initial decision tree model, the value corresponding to each of the historical feature data is used as a branch of the node of the initial decision tree model, and the label of whether the historical feature data is the abnormal label data is used as a leaf node of the initial decision tree model, and the initial decision tree model is trained to obtain optimal model parameters; The initial decision tree model is configured using the optimal model parameters to obtain the decision tree model.

4. The method for processing financial abnormal behavior based on the combination of prior information and decision tree according to claim 3 is characterized in that: After obtaining the decision tree model, the method further includes: Acquire update characteristic data, determine multiple values ​​of the update characteristic data, and mark whether the update characteristic data is the abnormal label data, wherein the update characteristic data is data characterizing the characteristics of the latest financial behavior; The updated feature data is used as the node of the decision tree model, the value corresponding to each of the updated feature data is used as the branch of the node of the decision tree model, and the label of whether the updated feature data is the abnormal label data is used as the leaf node of the decision tree model, and the decision tree model is trained to update the decision tree model.

5. The method for processing financial abnormal behavior based on the combination of prior information and decision tree according to claim 3 is characterized in that: After obtaining the decision tree model, the method further includes: Obtain a test set, and test the decision tree model through the test set to obtain an accuracy test value, wherein the test set includes obtaining historical feature test data, multiple values ​​of the historical feature test data, and label data of whether the historical feature test data is the abnormal label data, and the historical feature test data is test data that characterizes the characteristics of historical financial behavior; When the accuracy test value is greater than a preset test threshold, it is determined that the decision tree model is accurate.

6. The method for processing financial abnormal behavior based on the combination of prior information and decision tree according to claim 1 is characterized in that: Determining whether the financial behavior is abnormal according to the target feature data and the feature threshold includes: Extracting behavioral characteristic data of the financial behavior; In the case where the behavior characteristic data meets a characteristic threshold requirement, the financial behavior is determined to be abnormal, wherein the characteristic threshold requirement is a requirement determined according to the characteristic threshold.

7. The method for processing financial abnormal behavior based on the combination of prior information and decision tree according to claim 1 is characterized in that: After obtaining the preliminary feature data, the method further includes: Performing data cleaning on the prepared feature data to at least delete duplicate data; Performing missing value processing on the prepared feature data after data cleaning to at least delete the missing values; The prepared feature data after the missing value processing is standardized.

8. A device for processing financial abnormal behavior based on a priori information combined with a decision tree, characterized in that: include: An acquisition unit, used to acquire preliminary feature data and abnormal label data, wherein the preliminary feature data is data characterizing the characteristics of financial behavior, and the abnormal label data is data characterizing the characteristics of abnormal financial behavior; A first determining unit, configured to calculate a correlation coefficient between the preliminary feature data and the abnormal label data, and determine the preliminary feature data as candidate feature data when the correlation coefficient is greater than a preset threshold; The second determination unit is used to analyze the candidate feature data through a decision tree model to obtain target feature data and feature thresholds, and determine whether the financial behavior is abnormal based on the target feature data and the feature thresholds, and in the case where the financial behavior is abnormal, issue an alarm for the financial behavior, wherein the decision tree model is obtained by training with multiple groups of data, and each group of the multiple groups of data includes at least historical feature data and a label of whether the historical feature data is the abnormal label data.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the method for processing financial abnormal behavior based on the combination of prior information and decision tree as described in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing the processing of abnormal financial behavior based on the combination of prior information and decision trees as described in any one of claims 1 to 7.

Images