An intelligent trading engine risk warning system

Abstract

The present invention discloses an intelligent transaction engine risk warning system, which relates to the field of transaction risk technology. It includes classifying all user groups on the transaction engine according to the user's transaction records, accurately classifying the user groups according to the user's transaction habits, and providing a basis for subsequent multi-layer user risk profile structure and model training. A multi-layer user risk profile structure corresponding to each user group is generated for the transaction records of each user group to assist in the training of subsequent models. The risk difficulty of each user group is determined by the multi-layer user risk profile structure of each user group, and the model parameters are defined by the risk difficulty of each user group. The security risk warning model of each user group is trained by the model parameters and the multi-layer user risk profile structure. The accuracy and adaptability of risk warning are improved, and the safe conduct of transactions on the transaction platform is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of transaction risk technology, and in particular to an intelligent transaction engine risk early warning system. Background Art

[0002] The trading engine risk warning solution was developed against the backdrop of the rapid development of financial technology, addressing the shortcomings of traditional risk warning systems in data acquisition, analysis efficiency, and accuracy. With the widespread adoption of technologies such as big data, cloud computing, and artificial intelligence, financial market transaction data has experienced explosive growth, making traditional risk warning methods increasingly unable to meet the needs of real-time, accurate risk management. The intelligent trading engine risk warning solution integrates internal and external data resources and utilizes advanced machine learning and artificial intelligence technologies to achieve real-time monitoring, dynamic analysis, and precise warning of market risks.

[0003] In the existing technology, there are a large number of users flowing on the trading platform or engine, and different users have different trading habits. However, the platform uses a unified risk warning algorithm to detect or predict risks, resulting in poor accuracy and adaptability of risk warnings, and cannot guarantee the security of transactions.

[0004] Therefore, how to improve the accuracy and adaptability of risk warning is a technical problem that needs to be solved. Summary of the Invention

[0005] The purpose of the present invention is to solve the problem of poor accuracy and adaptability of risk warning in the existing technology, and to propose an intelligent trading engine risk warning system, which includes a classification module, a generation module, a determination module, a training module and an early warning module.

[0006] The classification module is used to obtain transaction records of users on the transaction engine and classify all user groups on the transaction engine according to the user transaction records;

[0007] The generating module is used to generate a multi-layer user risk profile structure corresponding to each user group based on the transaction records of each user group;

[0008] The determination module is used to determine the risk difficulty of each type of user group through a multi-layer user risk profile structure of each type of user group;

[0009] The training module is used to define model parameters according to the risk difficulty of each user group, and train the security risk warning model through the model parameters and the multi-layer user risk profile structure;

[0010] The early warning module is used to implement risk identification and early warning functions on the intelligent transaction engine based on the security risk early warning model.

[0011] In some embodiments of the present application, the classification module is used to classify all user groups on the transaction engine based on the user's transaction records, specifically:

[0012] The user's transaction records include transaction volume information, transaction behavior information, and transaction business type. Transaction volume features and transaction behavior features are extracted from the transaction volume information and transaction behavior information.

[0013] Build a transaction type set for each user based on the transaction type, and compare the intersection of multiple users' transaction type sets to perform the first classification of users on the transaction engine;

[0014] Normalize the trading behavior features. The trading volume features include average trading volume and trading volume volatility. The user group after the first classification is recorded as a single user group. For each user in the same single user group, calculate the similarity of each trading behavior feature between two users.

[0015] Determine the similarity between two users in the same user group based on the similarity of transaction behavior characteristics and transaction volume characteristics;

[0016]

[0017] in, is the similarity between the i2th user and the i3th user in the i1th user group, τ is the conversion coefficient, n is the number of transaction behavior features, is the similarity weight of the i4th transaction behavior feature, is the similarity of the i4th trading behavior characteristics between the i2th user and the i3th user in the i1th category, β1 and β2 are the combined weights of the average trading volume and the trading volume volatility, respectively. are the average transaction volumes of the i2th user and the i3th user, are the transaction volume volatility of the i2th user and the i3th user respectively, is the constant corresponding to the i2th user and the i3th user;

[0018] The user groups are classified a second time by measuring the similarity between two users in the same user group.

[0019] In some embodiments of the present application, the generation module includes a first unit, a second unit, a third unit, and a fourth unit. The multi-layer user risk profile structure includes a basic information layer, a common feature layer, a risk feature layer, and an association layer. The first unit is used to:

[0020] Filter out the transaction records of each user group from the user's transaction records, obtain transaction-related information of each user group from the transaction records of each user group, perform data preprocessing on the transaction-related information of each user group, and construct a basic information layer through the preprocessed transaction-related information.

[0021] In some embodiments of the present application, the second unit is used to:

[0022] The pre-processed transaction-related information is divided into two parts: numerical category information and non-numerical category information;

[0023] For non-numerical category information, filter out the same or similar information of multiple users in the same user group to obtain the common features of the non-numerical category;

[0024] For the numerical category information, calculate the characteristic value range of each numerical category information of multiple users in the same user group, determine a first intersection degree range based on the business security involved in each numerical category information, determine a second intersection degree range based on the characteristic value range of each numerical category information, and use the intersection of the first intersection degree range and the second intersection degree range to screen out the common feature types and value ranges of the numerical categories of multiple users in the same user group, and use these as the common features of the numerical categories;

[0025] A common feature layer is constructed based on the common features of non-numerical categories and the common features of numerical categories.

[0026] In some embodiments of the present application, the third unit is used to:

[0027] Extract all risk features in the basic information layer and record them as the first risk features; extract all risk features in the common feature layer and record them as the second risk features;

[0028] The first risk feature and the second risk feature are compared to determine the type of risk feature. The types of risk features include common risk features and non-common risk features. Different weights are assigned to the common risk features and non-common risk features respectively to construct a risk feature layer.

[0029] In some embodiments of the present application, the fourth unit is used to:

[0030] Conduct correlation analysis among the basic information layer, common feature layer, and risk feature layer, quantify the degree of correlation, use a network diagram to display the correlation relationship among the basic information layer, common feature layer, and risk feature layer, and construct a correlation layer.

[0031] In some embodiments of the present application, the generation module further includes a fifth unit, which is configured to:

[0032] The multi-layer user risk profile structure also includes a balance information layer;

[0033] Calculate the data volume of the common feature layer and the risk feature layer in the multi-layer user risk profile structure of the target user group, and calculate the similarity between the multi-layer user risk profile structure of the target user group and the multi-layer user risk profile structure of other user groups. Extract data from the common feature layer and the risk feature layer of the multi-layer user risk profile structure of other user groups through the data volume and similarity of the common feature layer and the risk feature layer of the target user group, and add these data to the balanced information layer in the multi-layer user risk profile structure of the target user group, so as to construct the balanced information layer of the multi-layer user risk profile structure of all user groups.

[0034] In some embodiments of the present application, the determination module is used to determine the risk difficulty of each user group through a multi-layer user risk profile structure of each user group, which is specifically:

[0035] Calculate the risk difficulty level corresponding to each user group based on the common risk features and non-common risk features in the risk feature layer within the multi-layer user risk profile structure of each user group;

[0036]

[0037] in, is the risk difficulty level corresponding to the j1-th user group, m1 and m2 are the number of shared risk features and non-shared risk features in the risk feature layer of the multi-layer user risk profile structure corresponding to the j1-th user group, are the weight of the j1th shared risk feature and the weight of the j2th non-shared risk feature, respectively. are the size of the j1th shared risk feature and the size of the j2th non-shared risk feature, respectively, and max(γ3D3) is and The maximum value in are the first constant and the second constant respectively, and [] is the rounding symbol.

[0038] In some embodiments of the present application, the training module is used to define model parameters based on the risk difficulty of each user group, and train the security risk warning model using the model parameters and the multi-layer user risk profile structure, specifically:

[0039] For the same type of user group, the model parameter combination is determined according to the risk difficulty level, and the multi-layer user risk profile structure of this type of user group is converted into samples. The security risk warning model of this type of user group is trained through the combination of samples and model parameters, thereby training the security risk warning model corresponding to each type of user group.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] 1. Classify all user groups on the trading engine based on their transaction records. Accurately categorize user groups based on their trading habits, providing a foundation for subsequent multi-layer user risk profile structures and model training. Generate a corresponding multi-layer user risk profile structure for each user group based on their transaction records. This multi-layer user risk profile structure describes the transaction risk of each user group and the relationships between multiple layers of information, facilitating subsequent model training.

[0042] 2. The risk difficulty of each user group is determined through a multi-layered user risk profile structure. Model parameters are defined based on the risk difficulty of each user group. The security risk warning model for each user group is trained using the model parameters and the multi-layered user risk profile structure. This improves the accuracy and adaptability of risk warnings and ensures the security of transactions on the trading platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a structural diagram of an intelligent trading engine risk warning system proposed by the present invention;

[0044] Figure 2 This is a structural diagram of the generation module in the intelligent trading engine risk warning system proposed by the present invention. DETAILED DESCRIPTION

[0045] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0046] Reference Figure 1 , an intelligent trading engine risk warning system, including the following modules,

[0047] It includes classification module, generation module, determination module, training module and early warning module.

[0048] The classification module is used to obtain transaction records of users on the transaction engine and classify all user groups on the transaction engine according to the user transaction records.

[0049] In this embodiment, the system is connected to the trading engine to ensure real-time or periodic access to user transaction records. This typically involves calling an API, connecting to a database, or transferring data files. Transaction records include information such as transaction volume, transaction behavior, and transaction type.

[0050] In some embodiments of the present application, the classification module is used to classify all user groups on the transaction engine based on the user's transaction records, specifically:

[0051] The user's transaction records include transaction volume information, transaction behavior information, and transaction business type. Transaction volume features and transaction behavior features are extracted from the transaction volume information and transaction behavior information.

[0052] Build a transaction type set for each user based on the transaction type, and compare the intersection of multiple users' transaction type sets to perform the first classification of users on the transaction engine;

[0053] Normalize the trading behavior features. The trading volume features include average trading volume and trading volume volatility. The user group after the first classification is recorded as a single user group. For each user in the same single user group, calculate the similarity of each trading behavior feature between two users.

[0054] Determine the similarity between two users in the same user group based on the similarity of transaction behavior characteristics and transaction volume characteristics;

[0055]

[0056] in, is the similarity between the i2th user and the i3th user in the i1th user group, τ is the conversion coefficient, n is the number of transaction behavior features, is the similarity weight of the i4th transaction behavior feature, is the similarity of the i4th trading behavior characteristics between the i2th user and the i3th user in the i1th category, β1 and β2 are the combined weights of the average trading volume and the trading volume volatility, respectively. are the average transaction volumes of the i2th user and the i3th user, are the transaction volume volatility of the i2th user and the i3th user respectively, is the constant corresponding to the i2th user and the i3th user;

[0057] The user groups are classified a second time by measuring the similarity between two users in the same user group.

[0058] In this embodiment, transaction types include stock trading, fund subscription, etc., and transaction behavior characteristics include transaction frequency (number of buys, sells, and holds), transaction duration, etc. The similarity between each transaction behavior characteristic of two users can be calculated using methods such as Euclidean distance and cosine similarity. It represents the correction of the comprehensive characteristics of trading behavior by similar situations of trading volume.

[0059] The generating module is used to generate a multi-layer user risk profile structure corresponding to each type of user group based on the transaction records of each type of user group.

[0060] In this embodiment, a multi-layer user risk profile structure is constructed for each type of user group. The multi-layer user risk profile structure is used to describe the risk characteristics of the user group and the association between the multi-layer information.

[0061] In some embodiments of the present application, Figure 2 As shown, the generation module includes a first unit, a second unit, a third unit and a fourth unit. The multi-layer user risk profile structure includes a basic information layer, a common feature layer, a risk feature layer and an association layer. The first unit is used to:

[0062] Filter out the transaction records of each user group from the user's transaction records, obtain transaction-related information of each user group from the transaction records of each user group, perform data preprocessing on the transaction-related information of each user group, and construct a basic information layer through the preprocessed transaction-related information.

[0063] In this embodiment, the multi-layered user risk profile structure includes a basic information layer, a common feature layer, a risk feature layer, a correlation layer, and a balance information layer. The basic information layer contains the original user transaction data, the common feature layer contains the common features of this group of users, the risk feature layer contains the risk characteristics of this group of users, the correlation layer describes the relationship between the basic information layer, the common feature layer, and the risk feature layer, and the balance information layer extracts data from other user groups to ensure data diversity.

[0064] In some embodiments of the present application, the second unit is used to:

[0065] The pre-processed transaction-related information is divided into two parts: numerical category information and non-numerical category information;

[0066] For non-numerical category information, filter out the same or similar information of multiple users in the same user group to obtain the common features of the non-numerical category;

[0067] For the numerical category information, calculate the characteristic value range of each numerical category information of multiple users in the same user group, determine a first intersection degree range based on the business security involved in each numerical category information, determine a second intersection degree range based on the characteristic value range of each numerical category information, and use the intersection of the first intersection degree range and the second intersection degree range to screen out the common feature types and value ranges of the numerical categories of multiple users in the same user group, and use these as the common features of the numerical categories;

[0068] A common feature layer is constructed based on the common features of non-numerical categories and the common features of numerical categories.

[0069] In this embodiment, the shared features can be numerical (such as transaction volume, transaction frequency, etc.) or non-numerical category (such as user occupation, region, etc.). The cross-degree range is the degree of overlap of the same numerical category information between different users. Different numerical category information involves different business security situations, and the corresponding first cross-degree ranges are also different. The feature value range corresponds to different first cross-degree ranges. The intersection of the first cross-degree range and the second cross-degree range is used to screen out the common feature types and numerical ranges of the numerical categories of multiple users in the same user group.

[0070] In some embodiments of the present application, the third unit is used to:

[0071] Extract all risk features in the basic information layer and record them as the first risk features; extract all risk features in the common feature layer and record them as the second risk features;

[0072] The first risk feature and the second risk feature are compared to determine the type of risk feature. The types of risk features include common risk features and non-common risk features. Different weights are assigned to the common risk features and non-common risk features respectively to construct a risk feature layer.

[0073] In this embodiment, the shared risk features are risk features that are shared by multiple users in this user group, and the remaining risk features are non-shared risk features. Generally speaking, the weight of the shared risk features is greater than the weight of the non-shared risk features.

[0074] In some embodiments of the present application, the fourth unit is used to:

[0075] Conduct correlation analysis among the basic information layer, common feature layer, and risk feature layer, quantify the degree of correlation, use a network diagram to display the correlation relationship among the basic information layer, common feature layer, and risk feature layer, and construct a correlation layer.

[0076] In this embodiment, for example, the basic information layer and the risk feature layer can use statistical methods (such as correlation analysis, chi-square test, etc.) to quantify these associations. A series of numerical correlation degree indicators can be obtained, such as correlation coefficients, feature importance scores, etc. According to the complexity and data type of the correlation relationship, select the appropriate chart type to display the correlation situation. Use a network diagram to display the correlation relationship network between features, and use Python's matplotlib, seaborn, networkx and other libraries, or R language ggplot2, igraph and other packages to draw charts. These tools provide rich visualization options and high customization capabilities. Provide a brief explanation and interpretation next to the chart to help users understand the meaning of the correlation relationship and the significance of the quantitative results.

[0077] In this embodiment, the correlations between multiple layers of information provide richer context for the security risk warning model. By incorporating these correlations into model training, the model can better understand user behavior, transaction patterns, and potential risk points, thereby improving the model's ability to identify security risks. Correlations reveal the paths and processes of risk transmission, enabling the model to more accurately capture risk signals and issue warnings before risks occur. By training a model that incorporates these correlations, the accuracy and timeliness of security risk warnings can be significantly improved.

[0078] In some embodiments of the present application, the generation module further includes a fifth unit, which is configured to:

[0079] The multi-layer user risk profile structure also includes a balance information layer;

[0080] Calculate the data volume of the common feature layer and the risk feature layer in the multi-layer user risk profile structure of the target user group, and calculate the similarity between the multi-layer user risk profile structure of the target user group and the multi-layer user risk profile structure of other user groups. Extract data from the common feature layer and the risk feature layer of the multi-layer user risk profile structure of other user groups through the data volume and similarity of the common feature layer and the risk feature layer of the target user group, and add these data to the balanced information layer in the multi-layer user risk profile structure of the target user group, so as to construct the balanced information layer of the multi-layer user risk profile structure of all user groups.

[0081] In this embodiment, the information in the multi-layer user risk profile structure is all information under the same type of user group. There may be overfitting problems in subsequent model training. The balanced information layer is designed to solve this problem, and the information of other categories of user groups is added to it. Increase sample diversity: If the original data set only contains information on one type of user group, adding information on other types of user groups can significantly increase the diversity of samples and help the model learn a wider data distribution. Avoid data imbalance: When adding information on other types of user groups, pay attention to maintaining data balance between categories to avoid the model being biased towards users of that type due to excessive data from a certain type of user group.

[0082] In this embodiment, data is extracted from the common feature layer and risk feature layer of other types of user groups based on the data volume and similarity of the common feature layer and risk feature layer, and data is extracted from both similar groups and dissimilar groups.

[0083] The determination module is used to determine the risk difficulty of each type of user group through a multi-layer user risk profile structure of each type of user group.

[0084] In this embodiment, risk difficulty refers to the difficulty of risk detection, assessment, and early warning. The higher the difficulty, the higher the complexity requirement for the model.

[0085] In some embodiments of the present application, the determination module is used to determine the risk difficulty of each user group through a multi-layer user risk profile structure of each user group, which is specifically:

[0086] Calculate the risk difficulty level corresponding to each user group based on the common risk features and non-common risk features in the risk feature layer within the multi-layer user risk profile structure of each user group;

[0087]

[0088] in, is the risk difficulty level corresponding to the j1-th user group, m1 and m2 are the number of shared risk features and non-shared risk features in the risk feature layer of the multi-layer user risk profile structure corresponding to the j1-th user group, are the weight of the j1th shared risk feature and the weight of the j2th non-shared risk feature, respectively. are the size of the j1th shared risk feature and the size of the j2th non-shared risk feature, respectively, and max(γ3D3) is and The maximum value in are the first constant and the second constant respectively, and [] is the rounding symbol.

[0089] In this embodiment, max(γ3D3) is and The maximum value in and Pick out the maximum value from each of them and compare which one is greater between the two maximum values. It represents the correction of the maximum risk characteristic impact on the combined effect of shared risk characteristics and non-shared risk characteristics.

[0090] The training module is used to define model parameters according to the risk difficulty of each type of user group, and to train the security risk warning model through the model parameters and the multi-layer user risk profile structure.

[0091] In this embodiment, if a security risk warning model is to be able to provide targeted risk warnings for all categories of user groups, it must have a high degree of plasticity and adaptability. This means that the model needs to be able to automatically adjust its parameters and strategies according to the characteristics of different user groups to adapt to different risk environments and detection needs. However, in actual applications, this high degree of plasticity and adaptability is often difficult to achieve. Therefore, a corresponding security risk warning model is trained here for each type of user group. Strong data targeting: The training data is more focused on the behavior patterns and risk characteristics of a specific user group, which improves the model's prediction accuracy for the user group. More accurate features: It is possible to select more relevant and significant risk features for a specific user group, thereby improving the sensitivity and specificity of the model. Model structure optimization: The structure and complexity of the model can be adjusted according to the risk patterns of specific user groups, making it more adaptable to the actual risk environment.

[0092] In some embodiments of the present application, the training module is used to define model parameters based on the risk difficulty of each user group, and train the security risk warning model using the model parameters and the multi-layer user risk profile structure, specifically:

[0093] For the same type of user group, the model parameter combination is determined according to the risk difficulty level, and the multi-layer user risk profile structure of this type of user group is converted into samples. The security risk warning model of this type of user group is trained through the combination of samples and model parameters, thereby training the security risk warning model corresponding to each type of user group.

[0094] In this embodiment, the model parameter combination (model architecture parameters, such as the number of layers, number of neurons, and other model architecture parameters) is determined according to the risk difficulty level. The model parameter combination is a combination of different model architecture parameter sizes. The higher the risk difficulty level, the more complex the corresponding model and the more diverse the architecture.

[0095] In this embodiment, the revealed associations are converted into features that the model can understand. This may include encoding the associations as numerical features (such as association strength, association frequency, etc.) or converting the associations into graph data (such as a user-transaction-risk feature graph). An appropriate security risk warning model (such as a machine learning model or a deep learning model) is selected and the converted association features are used as input data for model training.

[0096] The early warning module is used to implement risk identification and early warning functions on the intelligent transaction engine based on the security risk early warning model.

[0097] Compared with the prior art, the present invention has the following beneficial effects:

[0098] 1. Classify all user groups on the trading engine based on their transaction records. Accurately categorize user groups based on their trading habits, providing a foundation for subsequent multi-layer user risk profile structures and model training. Generate a corresponding multi-layer user risk profile structure for each user group based on their transaction records. This multi-layer user risk profile structure describes the transaction risk of each user group and the relationships between multiple layers of information, facilitating subsequent model training.

[0099] 2. The risk difficulty of each user group is determined through a multi-layered user risk profile structure. Model parameters are defined based on the risk difficulty of each user group. The security risk warning model for each user group is trained using the model parameters and the multi-layered user risk profile structure. This improves the accuracy and adaptability of risk warnings and ensures the security of transactions on the trading platform.

[0100] Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented through hardware or by using software plus the necessary general hardware platform. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, a USB flash drive, a mobile hard disk, etc.) and includes a number of instructions for enabling a computer device (such as a personal computer, a server, or a network device) to execute the methods described in various implementation scenarios of the present invention.

[0101] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily required to implement the present invention.

[0102] Those skilled in the art will appreciate that the modules in the system of the implementation scenario can be distributed in the system of the implementation scenario according to the implementation scenario description, or can be modified accordingly and located in one or more systems different from the implementation scenario. The modules of the above implementation scenario can be combined into one module or further divided into multiple submodules.

[0103] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. An intelligent trading engine risk warning system, characterized by: Including classification module, generation module, determination module, training module and early warning module, The classification module is used to obtain transaction records of users on the transaction engine and classify all user groups on the transaction engine according to the user transaction records; The generating module is used to generate a multi-layer user risk profile structure corresponding to each user group based on the transaction records of each user group; The determination module is used to determine the risk difficulty of each type of user group through a multi-layer user risk profile structure of each type of user group; The training module is used to define model parameters according to the risk difficulty of each user group, and train the security risk warning model through the model parameters and the multi-layer user risk profile structure; The warning module is used to implement risk identification and warning functions on the intelligent transaction engine based on the security risk warning model; in, The classification module is used to classify all user groups on the transaction engine according to the user's transaction records, specifically: The user's transaction records include transaction volume information, transaction behavior information, and transaction business type. Transaction volume features and transaction behavior features are extracted from the transaction volume information and transaction behavior information. Build a transaction type set for each user based on the transaction type, and compare the intersection of multiple users' transaction type sets to perform the first classification of users on the transaction engine; Normalize the trading behavior features. The trading volume features include average trading volume and trading volume volatility. The user group after the first classification is recorded as a single user group. For each user in the same single user group, calculate the similarity of each trading behavior feature between two users. Determine the similarity between two users in the same user group based on the similarity of transaction behavior characteristics and transaction volume characteristics; ； in, For the The first user group of the category users and The similarity between two users, is the conversion factor, is the number of transaction behavior features, For the The similarity weight of each transaction behavior feature, For the The first user group of the category users and Between two users The similarity of transaction behavior characteristics, 、 are the combined weights of average trading volume and trading volume volatility, 、 Respectively users and The average transaction volume of each user, 、 Respectively users and The volatility of each user's trading volume, For the users and The constant corresponding to each user; Perform a second classification of the user groups based on the similarity between two users in the same user group; The generating module further includes a fifth unit, wherein the fifth unit is configured to: The multi-layer user risk profile structure also includes a balance information layer; Calculate the data volume of the common feature layer and the risk feature layer in the multi-layer user risk profile structure of the target user group, and calculate the similarity between the multi-layer user risk profile structure of the target user group and the multi-layer user risk profile structure of other user groups. Extract data from the common feature layer and the risk feature layer of the multi-layer user risk profile structure of other user groups through the data volume and similarity of the common feature layer and the risk feature layer of the target user group, and add these data to the balanced information layer in the multi-layer user risk profile structure of the target user group, so as to construct the balanced information layer of the multi-layer user risk profile structure of all user groups.

2. The intelligent trading engine risk warning system according to claim 1 is characterized in that: The generation module includes a first unit, a second unit, a third unit and a fourth unit. The multi-layer user risk profile structure includes a basic information layer, a common feature layer, a risk feature layer and an association layer. The first unit is used to: Filter out the transaction records of each user group from the user's transaction records, obtain transaction-related information of each user group from the transaction records of each user group, perform data preprocessing on the transaction-related information of each user group, and construct a basic information layer through the preprocessed transaction-related information.

3. The intelligent trading engine risk warning system according to claim 2, characterized in that: The second unit is used to: The pre-processed transaction-related information is divided into two parts: numerical category information and non-numerical category information; For non-numerical category information, filter out the same or similar information of multiple users in the same user group to obtain the common features of the non-numerical category; For the numerical category information, calculate the characteristic value range of each numerical category information of multiple users in the same user group, determine a first intersection degree range based on the business security involved in each numerical category information, determine a second intersection degree range based on the characteristic value range of each numerical category information, and use the intersection of the first intersection degree range and the second intersection degree range to screen out the common feature types and value ranges of the numerical categories of multiple users in the same user group, and use these as the common features of the numerical categories; A common feature layer is constructed based on the common features of non-numerical categories and the common features of numerical categories.

4. The intelligent trading engine risk warning system according to claim 3, characterized in that: The third unit is used to: Extract all risk features in the basic information layer and record them as the first risk features; extract all risk features in the common feature layer and record them as the second risk features; The first risk feature and the second risk feature are compared to determine the type of risk feature. The types of risk features include common risk features and non-common risk features. Different weights are assigned to the common risk features and non-common risk features respectively to construct a risk feature layer.

5. The intelligent trading engine risk warning system according to claim 2, characterized in that: The fourth unit is used to: Conduct correlation analysis among the basic information layer, common feature layer, and risk feature layer, quantify the degree of correlation, use a network diagram to display the correlation relationship among the basic information layer, common feature layer, and risk feature layer, and construct a correlation layer.

6. The intelligent trading engine risk warning system according to claim 4, characterized in that: The determination module is used to determine the risk difficulty of each user group through the multi-layer user risk profile structure of each user group, which is specifically: Calculate the risk difficulty level corresponding to each user group based on the common risk features and non-common risk features in the risk feature layer within the multi-layer user risk profile structure of each user group; ； in, For the The risk difficulty level corresponding to the user group, 、 Respectively The number of shared risk features and non-shared risk features in the risk feature layer of the multi-layer user risk profile structure corresponding to the user group class, 、 Respectively The weight of the shared risk characteristics, The weights of the non-shared risk characteristics, 、 Respectively The size of the shared risk characteristics, The size of the non-shared risk characteristics, for and The maximum value in 、 are the first constant and the second constant respectively, and [] is the rounding symbol.

7. The intelligent trading engine risk warning system according to claim 6, characterized in that: The training module is used to define model parameters based on the risk difficulty of each user group, and train the security risk warning model using the model parameters and the multi-layer user risk profile structure, specifically: For the same type of user group, the model parameter combination is determined according to the risk difficulty level, and the multi-layer user risk profile structure of this type of user group is converted into samples. The security risk warning model of this type of user group is trained through the combination of samples and model parameters, thereby training the security risk warning model corresponding to each type of user group.

Images