A risk identification method and device
By automatically entering bank transaction packet data into pre-trained risk identification model, the bank's manual analysis of transaction packet data is solved, and efficient transaction risk identification and cost savings are achieved.
Patent Information
- Application Number
- CN202411896385.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-20
- Publication Date
- 2025-04-04
AI Technical Summary
In the prior art, banks analyze transaction packet data manually, resulting in inefficient processing efficiency and high labor costs, and the inability to efficiently identify transaction risks.
By obtaining bank transaction packet data, determine the type of transaction risk that needs to be identified, and input the data into a pre-trained risk identification model (such as a deep learning model) to automatically identify transaction risks.
It improves the efficiency of risk identification in banks for transaction packet data, reduces manual participation and corresponding costs, and saves a lot of human resources.
Smart Images
Figure CN119762073A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the financial field, and in particular to a risk identification method and device. Background Art
[0002] With the development of banking business, more and more people choose to go to banks to handle business. As the business volume continues to increase, banks need to process a large number of transaction messages every day. These messages may include user transaction information, account change information, etc. Analyzing transaction messages can ensure the stable operation of the banking system, improve business efficiency, and predict possible risks, thereby avoiding them.
[0003] At present, transaction message data is mainly analyzed manually to identify risks. Due to the large amount of transaction message data generated by banks, this manual method is inefficient when processing a large number of transaction messages, and has high labor costs, which requires a lot of human resources to be wasted.
[0004] Therefore, how to improve the efficiency of risk identification using transaction message data, and how to reduce certain labor costs and save a lot of human resources without manual participation in the entire process, is a technical problem that technicians in this field need to solve urgently. Summary of the invention
[0005] The present application provides a risk identification method to improve the accuracy of the model for judging user default and reduce bank property losses. The present application also provides a risk identification device.
[0006] In a first aspect, the present application provides a risk identification method, comprising:
[0007] Obtain the bank's transaction message data;
[0008] Determine the transaction risk type that needs to be identified, and determine the corresponding pre-trained risk identification model according to the transaction risk type, wherein the risk identification model is obtained by training through historical transaction message data;
[0009] The transaction message data is input into the risk identification model to obtain a risk identification result, and the risk identification result is used to determine whether there is a transaction risk in the banking business.
[0010] Optionally, the acquiring of the transaction message data of the bank includes:
[0011] Use the Logstash tool or the Filebeat tool to obtain the bank's transaction message data from various data sources.
[0012] Optionally, inputting the transaction message data into the risk identification model includes:
[0013] Using Elasticsearch to process the transaction message data, the data processing includes data cleaning, data indexing and data preprocessing;
[0014] The transaction message data after data processing is input into the risk identification model.
[0015] Optionally, the method further includes:
[0016] The risk identification result is visualized in a corresponding type according to the transaction risk type.
[0017] Optionally, the method further includes:
[0018] When the risk identification result meets the preset risk triggering condition, an alarm message is sent to the target person, and the alarm message carries the risk type.
[0019] For example, when it is determined that the risk identification result meets the preset risk trigger conditions (such as the transaction volume exceeds the transaction volume threshold, suspected fraud occurs, and the error rate exceeds the error rate threshold, etc.), the alarm mechanism is triggered immediately. Then the alarm information can be sent to the target person, for example, the alarm notification can be sent to the terminal device bound to the target person (relevant person) through various methods such as email, SMS, and Slack. The alarm information can carry information such as risk type, abnormal details, and handling suggestions.
[0020] In a second aspect, the present application further provides a risk identification device, the device comprising:
[0021] An acquisition unit, used to acquire transaction message data of a bank;
[0022] A determination unit, used to determine a transaction risk type to be identified, and determine a corresponding pre-trained risk identification model according to the transaction risk type, wherein the risk identification model is obtained by training with historical transaction message data;
[0023] The obtaining unit is used to input the transaction message data into the risk identification model to obtain a risk identification result, and the risk identification result is used to determine whether there is a transaction risk in the banking business.
[0024] Optionally, the acquisition unit is specifically used to:
[0025] Use the Logstash tool or the Filebeat tool to obtain the bank's transaction message data from various data sources.
[0026] Optionally, the obtaining unit is specifically used to:
[0027] Using Elasticsearch to process the transaction message data, the data processing includes data cleaning, data indexing and data preprocessing;
[0028] The transaction message data after data processing is input into the risk identification model.
[0029] Optionally, the device further comprises:
[0030] A display unit is used to perform a corresponding type of visual display of the risk identification result according to the transaction risk type.
[0031] Optionally, the method further includes:
[0032] The sending unit is used to send an alarm message to a target person when the risk identification result meets a preset risk trigger condition, wherein the alarm message carries the risk type.
[0033] In a third aspect, an embodiment of the present application provides a device, comprising a memory and a processor, wherein the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes the method described in the first aspect above.
[0034] In a fourth aspect, an embodiment of the present application provides a computer storage medium, in which a code is stored. When the code is executed, a device executing the code implements the method described in the first aspect above.
[0035] Compared with the prior art, this application has the following beneficial effects:
[0036] This application obtains the transaction message data of the bank, determines the transaction risk type that needs to be identified, and determines the corresponding pre-trained risk identification model according to the transaction risk type, wherein the risk identification model is obtained by training the historical transaction message data, and the transaction message data is input into the risk identification model to obtain the risk identification result, wherein the risk identification result is used to determine whether there is a transaction risk in the banking business. In this application, the transaction message data can be input into the corresponding pre-trained deep learning model, so that the deep learning model can be used for risk identification, thereby improving the efficiency of risk identification using transaction message data, and the whole process does not require human participation, which can reduce certain labor costs and save a lot of human resources. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0038] Figure 1 A flow chart of a risk identification method provided in an embodiment of the present application;
[0039] Figure 2 A schematic diagram of the structure of a specific implementation of the risk identification device provided in this application. DETAILED DESCRIPTION
[0040] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0041] It should be noted that the risk identification method and device provided in this application are used in the application scenario of risk identification in the financial field. Other fields are any fields other than the financial field, for example, the field of artificial intelligence. The above is only an example and does not limit the application field of the method and device provided in this application.
[0042] With the development of banking business, more and more people choose to go to banks to handle business. As the business volume continues to increase, banks need to process a large number of transaction messages every day. These messages may include user transaction information, account change information, etc. Analyzing transaction messages can ensure the stable operation of the banking system, improve business efficiency, and predict possible risks, thereby avoiding them.
[0043] At present, transaction message data is mainly analyzed manually to identify risks. Due to the large amount of transaction message data generated by banks, this manual method is inefficient when processing a large number of transaction messages, and has high labor costs, which requires a lot of human resources to be wasted.
[0044] In view of this, the inventor has proposed the technical solution of this application after research. This application obtains the transaction message data of the bank, determines the transaction risk type that needs to be identified, and determines the corresponding pre-trained risk identification model according to the transaction risk type, wherein the risk identification model is obtained through training of historical transaction message data, and the transaction message data is input into the risk identification model to obtain the risk identification result, wherein the risk identification result is used to determine whether there is a transaction risk in the banking business. In this application, the transaction message data can be input into the corresponding pre-trained deep learning model, so that the deep learning model can be used for risk identification, thereby improving the efficiency of risk identification using transaction message data, and the whole process does not require human participation, which can reduce certain labor costs and save a lot of human resources.
[0045] The method provided in the embodiment of the present application can be executed by software on a computing device, such as a mobile phone, a tablet computer, a computer, or the like.
[0046] In order to make the technical personnel in this field better understand the present application, the present application is further described in detail below in combination with the drawings and specific implementation methods. The method provided in the present application embodiment is described below by taking the first device as an example.
[0047] Figure 1 A flow chart of a risk identification method provided in an embodiment of the present application. Figure 1 As shown, the method includes:
[0048] S101: Obtaining transaction message data from the bank.
[0049] The first device obtains transaction message data of the bank.
[0050] Exemplarily, the first device can use the Logstash tool or the Filebeat tool to obtain the bank's transaction message data from various data sources (such as log files, databases, and network requests, etc.). The transaction message data may include account information, transaction type, transaction amount, and transaction time, etc.
[0051] Among them, Logstash is a powerful log collection, processing and forwarding tool that can capture data from various data sources (such as log files, databases, and network requests) in real time. Filebeat is a lightweight log collector designed for log files that can send file changes to Logstash in real time. Since the banking system contains multiple subsystems, the combination of these two tools can identify and obtain transaction message data from all subsystems that generate messages within the banking system, including but not limited to the trading system, risk control system, customer management system, etc. This can improve the monitoring coverage of transaction message data.
[0052] In some possible implementations, the embodiments of the present application may also convert the acquired transaction message data into a standardized format according to a pre-designed unified message data format specification, including field naming, data type, timestamp format, etc. That is, the collected original message data is converted into a standardized format to ensure the consistency and accuracy of subsequent processing.
[0053] S102: Determine the risk type that needs to be identified, and determine the corresponding pre-trained risk identification model according to the risk type.
[0054] The first device can determine the risk type that needs to be identified, and determine the corresponding pre-trained risk identification model according to the risk type. Among them, the risk type can be, for example, fraud detection, abnormal transaction volume prediction, error rate prediction, and risk rating, and the risk identification model is obtained by training with historical transaction message data. That is, these risk identification models are trained using historical transaction message data as a training set. The model parameters and structure are continuously optimized to improve the accuracy and generalization ability of the model.
[0055] Exemplarily, the first device can determine the risk type that needs to be identified based on user operation information. For example, if it is determined that the risk type that needs to be identified is transaction volume abnormality prediction, the first device can determine the corresponding pre-trained transaction volume abnormality prediction model. For another example, if it is determined that the risk type that needs to be identified is fraud detection, the first device can determine the corresponding pre-trained fraud detection model.
[0056] S103: Input the transaction message data into the risk identification model to obtain a risk identification result.
[0057] The first device may input the transaction message data into a risk identification model to obtain a risk identification result, wherein the risk identification result is used to determine whether there is a transaction risk in the banking business.
[0058] In some possible implementations, before inputting the transaction message data into the risk identification model, the present application may also use the Elasticsearch tool to process the transaction message data, and the data processing may include data cleaning, data indexing, and data preprocessing, etc. Among them, data cleaning may be, for example, using the deduplication and filtering functions provided by Elasticsearch to remove duplicate data, invalid data, and abnormal data in the transaction message data.
[0059] For example, data retrieval can be to determine which fields are key fields based on the characteristics of the message data, and these fields will be used for indexing. For example, the key fields are determined to be timestamp, transaction type, data source, transaction amount, and transaction ID, etc. For each key field, an index is designed based on its data type and query requirements, for example:
[0060] Timestamp: Use the date type, set a reasonable timestamp format, and support time range queries. Transaction type: Use the keyword type to support exact matching and aggregation. Data source: You can use the text type for full-text search, and use the keyword type to support exact matching. Transaction amount: Use the floating point type to support range queries. Transaction ID: Use the keyword type to support exact search.
[0061] Create an index template in Elasticsearch, define the data type of the field and the default index settings, and then establish a multi-dimensional index full-text search. For example, for the data source field, you can use the full-text index capability of Elasticsearch for retrieval. For the timestamp and transaction amount fields, you can use the numeric index for range query. For the transaction type and transaction ID fields, you can use the keyword type for exact matching.
[0062] Data preprocessing can be, for example, word segmentation of text fields in transaction message data to support subsequent text analysis functions, and normalization of numerical fields in transaction message data to eliminate the impact of different dimensions on data analysis.
[0063] The first device may input the transaction message data after data processing into the risk identification model to obtain a risk identification result.
[0064] For example, if the transaction risk type to be identified is different, the corresponding risk identification model is different, and the risk identification result is different. For example, when the transaction risk type to be identified is fraud detection, the risk identification result can be yes or no or fraud probability, when the transaction risk type to be identified is transaction volume abnormality prediction, the risk identification result can be transaction volume, and when the transaction risk type to be identified is error rate prediction, the risk identification result can be error rate.
[0065] This application obtains the transaction message data of the bank, determines the transaction risk type that needs to be identified, and determines the corresponding pre-trained risk identification model according to the transaction risk type, wherein the risk identification model is obtained by training the historical transaction message data, and the transaction message data is input into the risk identification model to obtain the risk identification result, wherein the risk identification result is used to determine whether there is a transaction risk in the banking business. In this application, the transaction message data can be input into the corresponding pre-trained deep learning model, so that the deep learning model can be used for risk identification, thereby improving the efficiency of risk identification using transaction message data, and the whole process does not require human participation, which can reduce certain labor costs and save a lot of human resources.
[0066] In some possible implementations, the embodiments of the present application may also perform a corresponding type of visual display of the risk identification results according to the transaction risk type.
[0067] Exemplarily, the first device can use Kibana as a data visualization tool. The first device can design a variety of chart types (such as line charts showing transaction volume trends, bar charts comparing performance indicators of different business lines, pie charts analyzing error type distribution, and heat maps showing regional risks, etc.). In an embodiment of the present application, the first device can also build multiple dashboards in Kibana, each dashboard focusing on risk identification results corresponding to different transaction risk types. Multiple visualization components (such as charts, filters, links, etc.) can be integrated together to form a comprehensive monitoring view.
[0068] In some possible implementations, the embodiments of the present application may also send an alarm message to a target person when it is determined that the risk identification result meets a preset risk trigger condition, wherein the alarm message carries the risk type.
[0069] For example, reasonable alarm thresholds (such as abnormal transaction volume thresholds, error rate upper limits, etc.) can be set according to actual needs.
[0070] When it is determined that the risk identification result meets the preset risk trigger conditions (such as the transaction volume exceeds the transaction volume threshold, suspected fraud occurs, and the error rate exceeds the error rate threshold, etc.), the alarm mechanism is triggered immediately. The first device can send an alarm message to the target person, for example, an alarm notification can be sent to the terminal device bound to the target person (relevant person) through various methods such as email, SMS, and Slack. The alarm message can carry information such as risk type, abnormal details, and handling suggestions.
[0071] The above are some specific implementations of the risk identification method provided in the embodiments of the present application. Based on this, the present application also provides a corresponding device. The device provided in the embodiments of the present application will be introduced from the perspective of functional modularization. The device and the risk identification method described above can be referenced to each other.
[0072] Figure 2 The structure diagram of the risk identification device provided by the embodiment of the present invention is referred to as the specific implementation mode 2. Figure 2 The device may include:
[0073] The acquisition unit 210 is used to acquire the transaction message data of the bank;
[0074] A determination unit 220 is used to determine a transaction risk type that needs to be identified, and determine a corresponding pre-trained risk identification model according to the transaction risk type, wherein the risk identification model is obtained by training with historical transaction message data;
[0075] The obtaining unit 230 is used to input the transaction message data into the risk identification model to obtain a risk identification result, and the risk identification result is used to determine whether there is a transaction risk in the banking business.
[0076] Optionally, the acquisition unit is specifically used to:
[0077] Use the Logstash tool or the Filebeat tool to obtain the bank's transaction message data from various data sources.
[0078] Optionally, the obtaining unit is specifically used to:
[0079] Using Elasticsearch to process the transaction message data, the data processing includes data cleaning, data indexing and data preprocessing;
[0080] The transaction message data after data processing is input into the risk identification model.
[0081] Optionally, the device further comprises:
[0082] A display unit is used to perform a corresponding type of visual display of the risk identification result according to the transaction risk type.
[0083] Optionally, the method further includes:
[0084] The sending unit is used to send an alarm message to a target person when the risk identification result meets a preset risk trigger condition, wherein the alarm message carries the risk type.
[0085] The acquisition unit in the device of the present application can be used to acquire the transaction message data of the bank, the determination unit can be used to determine the type of transaction risk that needs to be identified, and determine the corresponding pre-trained risk identification model according to the transaction risk type, wherein the risk identification model is obtained by training with historical transaction message data, and the acquisition unit can be used to input the transaction message data into the risk identification model to obtain the risk identification result, wherein the risk identification result is used to determine whether there is a transaction risk in the banking business. In the present application, the transaction message data can be input into the corresponding pre-trained deep learning model, so that the deep learning model can be used for risk identification, thereby improving the efficiency of risk identification using transaction message data, and the whole process does not require human participation, which can reduce certain labor costs and save a lot of human resources.
[0086] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.
[0087] The device includes a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes the method described in any embodiment of the present application.
[0088] The computer storage medium stores codes, and when the codes are executed, a device executing the codes implements the method described in any embodiment of the present application.
[0089] The "first" and "second" in the names such as "first" and "second" (if any) mentioned in the embodiments of the present application are only used as name identifiers and do not represent the first or second in order.
[0090] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.
[0091] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.
[0092] The above description is merely an exemplary embodiment of the present application and is not intended to limit the protection scope of the present application.
Claims
1. A risk identification method, characterized in that: include: Obtain the bank's transaction message data; Determine the transaction risk type that needs to be identified, and determine the corresponding pre-trained risk identification model according to the transaction risk type, wherein the risk identification model is obtained by training through historical transaction message data; The transaction message data is input into the risk identification model to obtain a risk identification result, and the risk identification result is used to determine whether there is a transaction risk in the banking business.
2. The method according to claim 1, characterized in that The obtaining of the transaction message data of the bank includes: Use the Logstash tool or the Filebeat tool to obtain the bank's transaction message data from various data sources.
3. The method according to claim 2, characterized in that The step of inputting the transaction message data into the risk identification model comprises: Using Elasticsearch to process the transaction message data, the data processing includes data cleaning, data indexing and data preprocessing; The transaction message data after data processing is input into the risk identification model.
4. The method according to claim 1, characterized in that The method further comprises: The risk identification result is visualized in a corresponding type according to the transaction risk type.
5. The method according to claim 1, characterized in that The method further comprises: When the risk identification result meets the preset risk triggering condition, an alarm message is sent to the target person, and the alarm message carries the risk type.
6. A risk identification device, characterized in that: include: An acquisition unit, used to acquire transaction message data of a bank; A determination unit, used to determine a transaction risk type to be identified, and determine a corresponding pre-trained risk identification model according to the transaction risk type, wherein the risk identification model is obtained by training with historical transaction message data; The obtaining unit is used to input the transaction message data into the risk identification model to obtain a risk identification result, and the risk identification result is used to determine whether there is a transaction risk in the banking business.
7. The device according to claim 6, characterized in that The acquisition unit is specifically used to: Use the Logstash tool or the Filebeat tool to obtain the bank's transaction message data from various data sources.
8. The device according to claim 7, characterized in that The obtaining unit is specifically used for: Using Elasticsearch to process the transaction message data, the data processing includes data cleaning, data indexing and data preprocessing; The transaction message data after data processing is input into the risk identification model.
9. The device according to claim 7, characterized in that The device also includes: A display unit is used to perform a corresponding type of visual display of the risk identification result according to the transaction risk type.
10. The device according to claim 9, characterized in that The method further comprises: The sending unit is used to send an alarm message to a target person when the risk identification result meets a preset risk trigger condition, wherein the alarm message carries the risk type.