Method and device for detecting risk, storage medium and program product

Abstract

The invention relates to a method, an apparatus, a non-transitory computer readable storage medium and a computer program product for detecting risk. One aspect of the invention provides a method for detecting risks, and the method comprises the steps: generating a first risk detection model corresponding to each second financial institution in a plurality of second financial institutions based on a preset risk detection model of a first financial institution, generating a second risk detection model corresponding to each second financial institution based on the first risk detection model; generating a third risk detection model corresponding to each second financial institution at least based on the target detection configuration of each second financial institution; and detecting a risk event of each second financial institution by using the second risk detection model and the third risk detection model of each second financial institution, risk elements are determined based on the detected risk events for each second financial institution to determine risk events for one or more third financial institutions based on the risk elements.

Description

Technical Field

[0001] The present application relates to the field of computers, and more particularly to a method for detecting risks, an apparatus for detecting risks, a non-transitory computer-readable storage medium, and a computer program product. Background Art

[0002] At present, in the financial payment industry, historical transaction data is generally analyzed mainly by using the preset risk control system set up in various financial institutions to monitor abnormal businesses such as gambling and fraud, code arbitrage, marketing arbitrage, etc., and to issue risk warnings or risk disposal for the monitored abnormal businesses. However, the preset risk control system is generally pre-built by developers based on the set risk control rules, which requires a large amount of development work and is difficult to adapt to the frequent changes in risk control rules.

[0003] In addition, the preset risk control systems set up in various financial institutions usually only provide risk warnings or risk disposal for abnormal businesses monitored. It is difficult to analyze and correlate the abnormal businesses monitored by various financial institutions, resulting in difficulty in effectively identifying potential risk factors in the monitored abnormal businesses, thereby affecting the effectiveness of risk prevention and control. Summary of the invention

[0004] In order to solve or at least alleviate one or more of the above problems, the following technical solutions are provided.

[0005] According to a first aspect of the present application, a method for detecting risks is provided, the method comprising the following steps: generating a first risk detection model corresponding to each of a plurality of second financial institutions based on a preset risk detection model of a first financial institution, generating a second risk detection model corresponding to each second financial institution based on the first risk detection model; generating a third risk detection model corresponding to each second financial institution based at least on a target detection configuration of each second financial institution; and detecting risk events of each second financial institution using the second risk detection model and the third risk detection model of each second financial institution, determining risk factors based on the detected risk events of each second financial institution to determine risk events of one or more third financial institutions based on the risk factors.

[0006] According to the method for detecting risks described in one embodiment of the present application, the preset risk detection model of the first financial institution is pre-configured based on one or more of the following model elements: a risk statistic, which is used to indicate the object of risk statistics; a risk label, which is used to indicate the information of the risk object; a risk score, which is used to indicate the risk level of each business object in a risk scenario; and a risk parameter, which is used to indicate one or more of the business products corresponding to the risk transaction time period, risk transaction amount segment and transaction flow.

[0007] According to the method for detecting risks described in one embodiment of the present application or any of the above embodiments, generating a first risk detection model corresponding to each of a plurality of second financial institutions based on a preset risk detection model of a first financial institution includes: obtaining full transaction flows from the first financial institution; determining the transaction flows corresponding to each of the second financial institutions based on the full transaction flows; and combining the preset risk detection model with the transaction flows of each of the second financial institutions to generate a first risk detection model for each of the second financial institutions.

[0008] According to the method for detecting risks described in one embodiment of the present application or any of the above embodiments, generating a second risk detection model corresponding to each second financial institution based on the first risk detection model includes: determining the risk tolerance corresponding to each second financial institution; determining risk control data associated with one or more model elements in a preset risk detection model corresponding to the first risk detection model of each second financial institution based on the risk tolerance; and generating a second risk detection model corresponding to each second financial institution based on the risk control data.

[0009] According to the method for detecting risks described in one embodiment of the present application or any of the above embodiments, the target detection configuration of each second financial institution includes a combination of one or more of the following: risk scenarios, detection objects, transaction flows corresponding to the detection objects, risk event detection configurations, and detection logic.

[0010] According to the method for detecting risks described in one embodiment of the present application or any of the above embodiments, the detection logic includes one or more operation items, each operation item includes the model element or risk control data associated with the model element.

[0011] According to the method for detecting risks described in one embodiment of the present application or any of the above embodiments, the method also includes: determining the common risk characteristics of each second financial institution; sending the common risk characteristics of one second financial institution among the multiple second financial institutions to one or more other second financial institutions among the multiple second financial institutions, so that the one or more other second financial institutions update their respective second risk detection models and third risk detection models using the received common risk characteristics; and detecting risk events of the one or more other second financial institutions using the updated second risk detection models and third risk detection models.

[0012] According to the method for detecting risks described in one embodiment of the present application or any of the above embodiments, the method further includes: sending a third risk detection model of a second financial institution among the multiple second financial institutions to another one or more second financial institutions among the multiple second financial institutions, so that the other one or more second financial institutions use the received third risk detection model to detect their respective risk events.

[0013] According to the method for detecting risks described in one embodiment of the present application or any of the above embodiments, determining the risk factors based on the detected risk events of each second financial institution includes: selecting a candidate set of associated risk events from the detected risk events of each second financial institution using a dense subtensor detection algorithm; removing associated risk events belonging to the same second financial institution from the candidate set of associated risk events to obtain a set of associated risk events; and determining the risk factors based on the set of associated risk events.

[0014] According to the method for detecting risks described in one embodiment of the present application or any of the above embodiments, the risk events include a combination of one or more of the following: gambling-related events, fraud-related events, cash-out events, and arbitrage events, and the risk factors include a combination of one or more of the following: transaction device identification, transaction account identification, and transaction user identification.

[0015] According to the method for detecting risks described in one embodiment of the present application or any of the above embodiments, the method further includes: determining risk factors based on the detected risk events of the other one or more second financial institutions; determining risk events of one or more third financial institutions based on the risk factors.

[0016] According to the method for detecting risks described in one embodiment of the present application or any of the above embodiments, determining risk events of one or more third financial institutions based on the risk factors includes: identifying transaction flows associated with the risk factors in the full transaction flows; determining risk events of the one or more third financial institutions based on the transaction flows associated with the risk factors.

[0017] According to a second aspect of the present application, a device for detecting risks is provided, the device comprising: a memory; a processor coupled to the memory; and a computer program stored on the memory, which, when executed on the processor, causes the steps of the method for detecting risks described in the first aspect of the present application to be executed.

[0018] According to a third aspect of the present application, a non-transitory computer-readable storage medium is provided, characterized in that the non-transitory computer-readable storage medium includes instructions, and the instructions, when run, execute the steps of the method for detecting risks described in the first aspect of the present application.

[0019] According to a fourth aspect of the present application, a computer program product is provided, wherein the computer program product comprises instructions, and when the instructions are executed by a processor, the steps of the method for detecting risks according to the first aspect of the present application are implemented.

[0020] According to one or more embodiments of the present application, the scheme for detecting risks can generate a second risk detection model and a third risk detection model applicable to each second financial institution based on a preset risk detection model and a target detection configuration, thereby constructing a comprehensive and easily adaptable risk detection system to detect risk events of each second financial institution, improving the adaptability and accuracy of risk detection and reducing the manpower and material resources consumed in model development. According to one or more embodiments of the present application, the scheme for detecting risks can determine risk events of one or more third financial institutions based on the risk factors determined by the risk events of each second financial institution, detect risk events of third financial institutions by effectively utilizing the risk factors in the risk events detected by the second financial institutions, and realize the correlation detection of risk events between different financial institutions, thereby realizing the timely detection and reliable early warning of potential risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above and / or other aspects and advantages of the present application will become clearer and easier to understand through the following description of various aspects in conjunction with the accompanying drawings, in which the same or similar units are represented by the same reference numerals. In the accompanying drawings:

[0022] Figure 1 A flow chart of a method for detecting risks according to one or more embodiments of the present application is shown.

[0023] Figure 2 A schematic diagram of an implementation process for detecting risks according to an embodiment of the present application is shown.

[0024] Figure 3 A schematic diagram of an example detection logic is shown.

[0025] Figure 4 A flow chart of a method for detecting risk events of a financial institution according to an embodiment of the present application is shown.

[0026] Figure 5 An example multi-dimensional uniform hypergraph is shown.

[0027] Figure 6A schematic block diagram of an apparatus for detecting risks according to one or more embodiments of the present application is shown. DETAILED DESCRIPTION

[0028] The following describes in detail example embodiments of the present application, and examples of these embodiments are illustrated in the accompanying drawings. It should be noted that the following description is for explanation and illustration and is therefore not to be construed as limiting the present application. Without departing from the principles of the present application, those skilled in the art may make electrical, mechanical, logical and structural changes to these embodiments as needed without departing from the scope of the present application. In addition, those skilled in the art may appreciate that, for any specific application scenario or actual need, one or more features of the different embodiments described below may be combined.

[0029] Terms such as "comprising" and "including" indicate that in addition to the units and steps directly and clearly stated in the specification, the technical solution of the present application does not exclude the situation of having other units and steps that are not directly or clearly stated. Terms such as "first" and "second" do not indicate the order of units in terms of time, space, size, etc., but are only used to distinguish between units.

[0030] In the context of this application, risk events of financial institutions refer to illegal activities such as gambling-related events, fraud-related events, cash-out events, arbitrage events, etc. that threaten the stability and security of the financial market.

[0031] Hereinafter, various exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings.

[0032] Figure 1 A flow chart of a method for detecting risks according to one or more embodiments of the present application is shown.

[0033] like Figure 1 As shown in, in step S101, a first risk detection model corresponding to each of a plurality of second financial institutions is generated based on a preset risk detection model of the first financial institution, and a second risk detection model corresponding to each second financial institution is generated based on the first risk detection model.

[0034] Optionally, in step S101, the preset risk detection model of the first financial institution can be pre-configured based on one or more of the following model elements: risk statistics, which are used to indicate the object of risk statistics; risk labels, which are used to indicate the information of risk objects; risk scores, which are used to indicate the risk level of each business object under the risk scenario; and risk parameters, which are used to indicate one or more of the business products corresponding to the risk transaction period, risk transaction amount segment and transaction flow. Exemplarily, the risk statistics can be used to indicate that the object of risk statistics is the number of large transactions (e.g., more than 1 million) of the merchant in the past 7 days, the proportion of the merchant's night transactions yesterday, etc. Exemplarily, the information of the risk object indicated by the risk label can include the blacklist of the risk object, the transaction account information of the risk object, the transaction device information of the risk object, etc. Exemplarily, the risk score can be used to score the risk level of various business objects (e.g., merchants, payment institutions, etc.) in different risk scenarios (e.g., fraud-related scenarios, gambling-related scenarios, cash-out scenarios, etc.), and the risk score can be determined based on a neural network algorithm.

[0035] In one embodiment, the first financial institution can be implemented as a financial institution headquarters, and the second financial institution can be implemented as a financial branch. The financial institution headquarters can pre-configure a preset risk detection model based on one or more model elements and send the preset risk detection model to the financial branch.

[0036] Optionally, in step S101, the full transaction flow can be obtained from the first financial institution, the transaction flow corresponding to each second financial institution can be determined based on the full transaction flow, and the preset risk detection model can be combined with the transaction flow of each second financial institution to generate a first risk detection model for each second financial institution. In one embodiment, the full transaction flow can be obtained from the headquarters of the financial institution, and the transaction flow corresponding to each second financial institution can be determined based on the regional data (e.g., the transaction acceptance area, the area where the financial institution is located, the area where the transaction users are often located, etc.) or business assessment data (e.g., the business assessment data of the second financial institution) in the full transaction flow. For example, the preset risk detection model can be imported into the analysis engine, the calculation data required for the preset risk detection model can be analyzed, and then the transaction flow of each second financial institution can be combined to generate the first risk detection model for each second financial institution.

[0037] Optionally, in step S101, the risk tolerance corresponding to each second financial institution may be determined, and risk control data associated with one or more model elements in a preset risk detection model corresponding to the first risk detection model of each second financial institution may be determined based on the risk tolerance, and a second risk detection model corresponding to each second financial institution may be generated based on the risk control data. Exemplarily, the risk tolerance may be understood as the tolerance of each second financial institution to risk events, which may vary depending on the types of business provided by each second financial institution. Exemplarily, the risk control data may be understood as the basis for determining whether a financial activity is a risk event, which may be associated with one or more model elements in a preset risk detection model. For example, when the model elements in the preset risk detection model include risk statistics and risk scores, the risk control data may be implemented as a risk statistic threshold and a risk score threshold. By determining the risk control data based on the tolerance of each second financial institution to risk events, and generating the second risk detection model corresponding to each second financial institution based on the risk control data, it is possible to ensure that the second risk detection model corresponding to each second financial institution is adapted to each second financial institution, thereby improving the accuracy of risk detection.

[0038] In step S103, a third risk detection model corresponding to each second financial institution is generated based at least on the target detection configuration of each second financial institution.

[0039] Optionally, in step S103, the target detection configuration may include a combination of one or more of the following: risk scenario, detection object, transaction flow corresponding to the detection object, risk event detection configuration, and detection logic. Optionally, the detection logic may include one or more operation items, each of which includes a model element or risk control data associated with the model element. Figure 3 An example detection logic is further described.

[0040] In step S105, the second risk detection model and the third risk detection model of each second financial institution are used to detect risk events of each second financial institution, and risk factors are determined based on the detected risk events of each second financial institution to determine risk events of one or more third financial institutions based on the risk factors.

[0041] In one embodiment, the third risk detection model corresponding to each second financial institution can be sent to other second financial institutions, so that each second financial institution can detect risk events based on its own second risk detection model, third risk detection model and the third risk detection model received from other second financial institutions. In one embodiment, the public risk characteristics of each second financial institution can be determined, and the public risk characteristics of each second financial institution can be sent to other second financial institutions, so that each second financial institution can update its own second risk detection model and third risk detection model using the public risk characteristics received from other second financial institutions, and detect risk events using the updated second risk detection model and third risk detection model. Exemplarily, the public risk characteristics may include a blacklist of risk objects, a risk transaction time period, a risk transaction amount segment, etc. In one embodiment, the second financial institution can be implemented as a financial branch, and the third financial institution can be implemented as other financial branches or financial institution headquarters different from the second financial institution.

[0042] It should be noted that the risk events detected by each second financial institution can be detected by one or more of the following detection models: the second risk detection model and the third risk detection model of each second financial institution itself, the third risk detection model received from other second financial institutions, and the second risk detection model and the third risk detection model of the second financial institution itself updated by using the public risk features received from other second financial institutions. By sharing the public risk features and the third risk detection model of each second financial institution with other second financial institutions, a comprehensive risk detection system can be built to detect the risk events of each second financial institution, thereby improving the efficiency, accuracy and comprehensiveness of risk detection.

[0043] Optionally, in step S105, a candidate set of associated risk events can be selected from the risk events of each second financial institution detected using a dense subtensor detection algorithm, associated risk events belonging to the same second financial institution can be removed from the candidate set of associated risk events to obtain an associated risk event set, and risk factors can be determined based on the obtained associated risk event set. Optionally, the risk factors can include a transaction device identifier, a transaction account identifier (e.g., a bank card number), a transaction user identifier (e.g., a mobile phone number, a business license number), etc.

[0044] Optionally, in step S105, transaction flows associated with risk factors can be identified in the full transaction flow, risk events of one or more third financial institutions can be determined based on the transaction flows associated with risk factors, and early warning information about the determined risk events can be sent to one or more third financial institutions. Exemplarily, based on the determined risk factors, the transaction flows associated with risk factors can be monitored in real time in the latest generated full transaction flow, and based on the regional data in the transaction flow (e.g., the transaction acceptance region, the region where the financial institution is located, the region where the transaction user often stays, etc.) or business assessment data (e.g., the business assessment data of the second financial institution), it can be determined that the transaction flows associated with the risk factors occurred in one or more third financial institutions.

[0045] In one embodiment, the dense subtensor detection algorithm can be implemented as a D-Cube algorithm. Taking merchants as detection objects, risk events detected by each second financial institution within a certain period of time (for example, within the past 7 days) can be collected, and a uniform hypergraph containing the dimensions of "merchant number, bank card number, device ID, IP address, GPS location, transaction date, transaction period, transaction amount segment, and number of transactions" can be constructed based on the detected risk events, for example, it can be constructed as a K-dimensional cube. Exemplarily, before constructing a uniform hypergraph, the IP address and GPS location can be preprocessed, for example, unified to the county and city level; the transaction period can be preprocessed, for example, it can be divided into four time periods of "morning, afternoon, evening, and early morning" by hour; the transaction amount segment can be preprocessed, for example, divided into "less than 1,000 yuan, 1,000 yuan to 10,000 yuan, and more than 10,000 yuan". In the constructed K-dimensional cube, dense blocks can be selected as candidate sets of associated risk events.

[0046] According to one or more embodiments of the present application, the method for detecting risks can generate a second risk detection model and a third risk detection model applicable to each second financial institution based on a preset risk detection model and a target detection configuration, thereby constructing a comprehensive and easily adaptive risk detection system to detect risk events of each second financial institution, improving the adaptability and accuracy of risk detection and reducing the manpower and material resources consumed in model development. According to one or more embodiments of the present application, the method for detecting risks can determine risk events of one or more third financial institutions based on the risk factors determined by the risk events of each second financial institution, detect risk events of third financial institutions by effectively utilizing the risk factors in the risk events detected by the second financial institutions, and realize the correlation detection of risk events between different financial institutions, thereby realizing the timely detection and reliable early warning of potential risks.

[0047] The following will be combined Figure 2-6 The specific implementation for detecting risks according to one or more embodiments of the present application is further described.

[0048] Figure 2 FIG. 1 is a schematic diagram of an implementation process for detecting risk according to an embodiment of the present application. As an example, Figure 2 Three second financial institutions are shown to describe the implementation process for detecting risks, wherein the operations corresponding to steps S2, S3 and S4 in the three dashed boxes are the same, and the following description is made by taking steps S2, S3 and S4 in the first dashed box as an example. In one embodiment, the first financial institution can be implemented as a financial institution headquarters, the second financial institution can be implemented as a financial branch, and the third financial institution can be implemented as other financial branches different from the second financial institution.

[0049] like Figure 2 As shown in , in step S1 , the first financial institution sends a preset risk detection model to each second financial institution.

[0050] In step S2, the second financial institution combines the received preset risk detection model with its own transaction flow to generate a first risk detection model, determines risk control data associated with one or more model elements in the preset risk detection model corresponding to the first risk detection model based on its own risk tolerance, and generates its own second risk detection model based on the risk control data.

[0051] In step S3, the second financial institution generates its own third risk detection model based at least on its own target detection configuration. Optionally, the target detection configuration may include a combination of one or more of the following: risk scenario, detection object, transaction flow corresponding to the detection object, risk event detection configuration, and detection logic.

[0052] In step S4, the second financial institution detects risk events using its own second risk detection model and third risk detection model, determines risk factors based on the detected risk events, and determines risk events of one or more third financial institutions based on the risk factors. Optionally, the transaction flow associated with the risk factor can be monitored in real time in the latest generated full transaction flow, and based on the regional data in the transaction flow (for example, the transaction acceptance area, the area where the financial institution is located, the area where the transaction user is often located, etc.) or business assessment data (for example, the business assessment data of the second financial institution), it is determined that the transaction flow associated with the risk factor occurs in one or more third financial institutions, thereby determining the risk events of one or more third financial institutions.

[0053] In step S5, early warning information about the determined risk event is sent to one or more third financial institutions.

[0054] In step S6, the common risk features are shared among the second financial institutions, so that each second financial institution updates its own second risk detection model and third risk detection model using the received common risk features, and detects risk events using the updated second risk detection model and third risk detection model.

[0055] In step S7, the third risk detection model is shared among the second financial institutions, so that each second financial institution can detect risk events using the third risk detection model received from other second financial institutions.

[0056] In step S8, the detected risk events are shared among the second financial institutions, so that each second financial institution can determine risk factors based on its own detected risk events and risk events detected by other second financial institutions.

[0057] It should be noted that if Figure 2 As shown in, for the second risk detection model and the third risk detection model indicated by the arrows below each second financial institution, the second risk detection model may include its own second risk detection model generated based on the received preset risk detection model (received in step S1), and an updated second risk detection model obtained by updating its own second risk detection model using the received public risk features (received in step S6); the third risk detection model may include its own third risk detection model generated based on the target detection configuration (generated in step S3), the received third risk detection model from other second financial institutions (received in step S7), and an updated third risk detection model obtained by updating its own third risk detection model using the received public risk features (received in step S6).

[0058] Figure 3 A schematic diagram of an example detection logic is shown.

[0059] like Figure 3 As shown in , the detection logic 300 includes rule item A, rule item B, rule item C and logical operators (e.g., "and", "or", "not", etc.), wherein rule item A, rule item B, rule item C each include an operand expression and a relationship symbol (e.g., "greater than", "less than", "equal to", "belongs to", etc.) set therebetween, and each operand expression includes one or more operand sub-items, such as Figure 3 Each operand expression of rule item A, rule item B, and rule item C shown in includes operand sub-item 1, operand sub-item 2, and operand sub-item 3.

[0060] In one embodiment, operand sub-item 1, operand sub-item 2 and operand sub-item 3 on the left side of the relation symbol can be determined based on one or more model elements, and operand sub-item 1, operand sub-item 2 and operand sub-item 3 on the right side of the relation symbol can be determined based on risk control data.

[0061] As an example, rule item A can be implemented to include "the total amount of the merchant's transactions yesterday ≥ 1 million" (where "the total amount of the merchant's transactions yesterday" is operand sub-item 1 on the left side of the relation symbol, "≥" is the relation symbol, and "1 million" is operand sub-item 1 on the right side of the relation symbol), "the nighttime proportion of the merchant's transactions yesterday ≥ 50%" (where "the nighttime proportion of the merchant's transactions yesterday" is operand sub-item 2 on the left side of the relation symbol, "≥" is the relation symbol, and "50%" is operand sub-item 2 on the right side of the relation symbol), and "the card number of the current transaction belongs to the set of gambling-related card numbers" (where "the card number of the current transaction" is operand sub-item 3 on the left side of the relation symbol, "belongs to" is the relation symbol, and "the set of gambling-related card numbers" is operand sub-item 3 on the right side of the relation symbol). As an example, the logical operator can be set to "or", that is, if one or more of rule items A, rule item B, and rule item C in the detection logic 300 are met, it can be determined that a risk event has been detected.

[0062] It should be noted that Figure 3 The detection logic is shown only as an example, and the detection logic may be modified without departing from the spirit and scope of the present application, such as changing the number of rule items and operand sub-items and the settings of logical operators therein.

[0063] Figure 4 A flow chart of a method for detecting risk events of a financial institution according to an embodiment of the present application is shown. Figure 4 The method shown in can be used to determine risk events for one or more third financial institutions based on the detected risk events for the second financial institution.

[0064] like Figure 4 As shown in , in step S401, a candidate set of associated risk events is selected from the detected risk events of each second financial institution using a dense subtensor detection algorithm.

[0065] In one embodiment, the dense subtensor detection algorithm can be implemented as a D-Cube algorithm. Taking merchants as detection objects, risk events detected by each second financial institution within a certain period of time (for example, within the past 7 days) can be collected, and a uniform hypergraph containing the dimensions of "merchant number, bank card number, device ID, IP address, GPS location, transaction date, transaction period, transaction amount segment, number of transactions" can be constructed based on the detected risk events, for example, as a K-dimensional cube. In the constructed K-dimensional cube, dense blocks can be selected as candidate sets of associated risk events. Exemplarily, a block density measurement method can be used to determine dense blocks in a K-dimensional cube.

[0066] In step S403, the associated risk events belonging to the same second financial institution are removed from the candidate set of associated risk events to obtain an associated risk event set.

[0067] In step S405, risk factors are determined based on the associated risk event set. Optionally, the risk factors may include transaction device identification, transaction account identification, transaction user identification, etc. It should be noted that the risk subjects in the associated risk event set may have cross-regional and cross-business characteristics (for example, the risk subjects belong to the same group, the risk subjects use the same transaction equipment, and the risk subjects are involved in the same type of risk events). The various risk factors determined based on the associated risk event set can be used for subsequent real-time correlation screening in the full transaction flow, to achieve correlation detection of risk events between different financial institutions, thereby achieving timely detection and reliable early warning of potential risks.

[0068] In step S407, risk events of one or more third financial institutions are determined based on the risk factors, and early warning information about the determined risk events is sent to the one or more third financial institutions.

[0069] Optionally, in step S407, transaction flows associated with risk factors can be identified in the latest generated full transaction flows, and risk events of one or more third financial institutions can be determined based on the transaction flows associated with the risk factors, and early warning information about the determined risk events can be sent to one or more third financial institutions. Figure 5 An example multi-dimensional uniform hypergraph is shown.

[0070] like Figure 5 As shown in FIG. , the multi-dimensional uniform hypergraph 500 can be implemented as a cube including three dimensions (ie, Figure 5 The entire cube shown in the figure), wherein the three dimensions are respectively the "device ID" dimension, the "transaction date" dimension and the "bank card number" dimension, each small cube therein can represent the risk event detected for each second financial institution, and the value in each small cube can represent the number of transactions corresponding to the risk event.

[0071] For example, through the D-Cube algorithm, a block density measurement method can be used to determine that the small cubes in the gray part are dense blocks, and the dense blocks can be selected as candidate sets of associated risk events.

[0072] It should be noted that Figure 5 The multi-dimensional uniform hypergraph 500 is shown only as an example. Without departing from the spirit and scope of the present application, a multi-dimensional uniform hypergraph can be constructed based on part or all of the "merchant number, bank card number, device ID, IP address, GPS location, transaction date, transaction time period, transaction amount range, number of transactions" contained in the detected risk events as dimensions, and dense blocks can be selected as candidate sets of associated risk events through the D-Cube algorithm.

[0073] Figure 6 A schematic block diagram of an apparatus for detecting risks according to one or more embodiments of the present application is shown.

[0074] like Figure 6 As shown in FIG. 6 , the apparatus 600 for detecting risk includes a memory 610, a processor 620, and a computer program 630 stored in the memory 610 and executable on the processor 620. The processor 620 executes the computer program 630 to implement a method for detecting risk according to one aspect of the present application.

[0075] In addition, the present application may also be implemented as a non-transitory computer-readable storage medium, in which a program for causing a computer to execute the method for detecting risks according to one aspect of the present application is stored.

[0076] Here, as non-temporary computer-readable storage media, various forms of non-temporary computer-readable storage media can be used, such as disks (e.g., magnetic disks, optical disks, etc.), cards (e.g., memory cards, optical cards, etc.), semiconductor memories (e.g., ROMs, non-volatile memories, etc.), and tapes (e.g., magnetic tapes, cassettes, etc.).

[0077] In the applicable situation, hardware, software or a combination of hardware and software can be used to realize the various embodiments provided by the application. Moreover, in the applicable situation, without departing from the scope of the application, the various hardware components and / or software components set forth herein can be combined into a composite component comprising software, hardware and / or both. In the applicable situation, without departing from the scope of the application, the various hardware components and / or software components set forth herein can be divided into subcomponents comprising software, hardware or both. In addition, in the applicable situation, it is contemplated that the software component can be implemented as a hardware component, and vice versa.

[0078] Software according to the present application (such as program code and / or data) may be stored on one or more non-transitory computer-readable storage media. It is also contemplated that the software identified herein may be implemented using one or more general or special-purpose computers and / or computer systems, networked and / or otherwise. Where applicable, the order of the various steps described herein may be changed, combined into composite steps, and / or divided into sub-steps to provide the features described herein.

[0079] The embodiments and examples set forth herein are provided to best illustrate embodiments according to the present application and its specific applications, and thereby enable those skilled in the art to implement and use the present application. However, those skilled in the art will appreciate that the above description and examples are provided only for ease of illustration and example. The description set forth is not intended to cover all aspects of the present application or to limit the present application to the precise form disclosed.

Claims

1. A method for detecting risk, characterized in that: The method comprises the following steps: Generate a first risk detection model corresponding to each of the plurality of second financial institutions based on a preset risk detection model of the first financial institution, and generate a second risk detection model corresponding to each second financial institution based on the first risk detection model; generating a third risk detection model corresponding to each second financial institution based at least on the target detection configuration of each second financial institution; as well as The second risk detection model and the third risk detection model of each second financial institution are used to detect risk events of each second financial institution, and risk factors are determined based on the detected risk events of each second financial institution to determine risk events of one or more third financial institutions based on the risk factors.

2. The method according to claim 1, wherein the pre-set risk detection model of the first financial institution is pre-configured based on one or more of the following model elements: Risk statistics, which are used to indicate the objects of risk statistics; Risk label, which is used to indicate information of risk object; Risk scores, which are used to indicate the risk level of each business object in a risk scenario; as well as Risk parameters are used to indicate one or more of the business products corresponding to the risky transaction time period, risky transaction amount segment and transaction flow.

3. The method according to claim 1, wherein generating a first risk detection model corresponding to each of the plurality of second financial institutions based on a preset risk detection model of the first financial institution comprises: Obtaining full transaction flow from the first financial institution; Determining the transaction flow corresponding to each second financial institution based on the full transaction flow; as well as The preset risk detection model is combined with the transaction flow of each second financial institution to generate a first risk detection model of each second financial institution.

4. The method according to claim 2, wherein generating a second risk detection model corresponding to each second financial institution based on the first risk detection model comprises: Determine the risk tolerance corresponding to each second financial institution; determining risk control data associated with one or more model elements in a preset risk detection model corresponding to the first risk detection model of each second financial institution based on the risk tolerance; as well as A second risk detection model corresponding to each second financial institution is generated based on the risk control data.

5. The method according to claim 4, wherein the target detection configuration of each second financial institution includes a combination of one or more of the following: risk scenarios, detection objects, transaction flows corresponding to the detection objects, risk event detection configuration, and detection logic. 6 . The method according to claim 5 , wherein the detection logic comprises one or more operation items, each operation item comprising the model element or risk control data associated with the model element.

7. The method according to claim 1, wherein the method further comprises: Determine the common risk characteristics of each second financial institution; sending the public risk feature of one of the plurality of second financial institutions to one or more other second financial institutions among the plurality of second financial institutions, so that the one or more other second financial institutions update their respective second risk detection models and third risk detection models using the received public risk feature; as well as The updated second risk detection model and the third risk detection model are used to detect risk events of the one or more other second financial institutions.

8. The method according to claim 1, wherein the method further comprises: The third risk detection model of one of the plurality of second financial institutions is sent to another one or more second financial institutions among the plurality of second financial institutions, so that the another one or more second financial institutions use the received third risk detection model to detect respective risk events.

9. The method according to claim 1, wherein determining the risk factor based on the detected risk events of each second financial institution comprises: Selecting a candidate set of associated risk events from the detected risk events of each second financial institution using a dense subtensor detection algorithm; Removing associated risk events belonging to the same second financial institution from the candidate set of associated risk events to obtain an associated risk event set; as well as The risk factor is determined based on the set of associated risk events.

10. The method according to claim 1, wherein the risk event includes a combination of one or more of the following: gambling-related events, fraud-related events, cash-out events, and arbitrage events; and the risk factor includes a combination of one or more of the following: transaction device identification, transaction account identification, and transaction user identification.

11. The method according to claim 7 or 8, wherein the method further comprises: determining a risk factor based on the detected risk events of the one or more other second financial institutions; Risk events of one or more third financial institutions are determined based on the risk factors.

12. The method according to claim 1 or 11, wherein determining risk events of one or more third financial institutions based on the risk factors comprises: Identify the transaction flow associated with the risk factor in the entire transaction flow; The risk events of the one or more third financial institutions are determined based on the transaction flows associated with the risk factors.

13. A device for detecting risk, characterized in that: The device is arranged on the merchant terminal device to verify the legitimacy of the user terminal device, and the device comprises: Memory; a processor coupled to the memory; and A computer program stored on the memory, which, when executed on the processor, causes the following operations: Generate a first risk detection model corresponding to each of the plurality of second financial institutions based on a preset risk detection model of the first financial institution, and generate a second risk detection model corresponding to each second financial institution based on the first risk detection model; generating a third risk detection model corresponding to each second financial institution based at least on the target detection configuration of each second financial institution; and The second risk detection model and the third risk detection model of each second financial institution are used to detect risk events of each second financial institution, and risk factors are determined based on the detected risk events of each second financial institution to determine risk events of one or more third financial institutions based on the risk factors.

14. The apparatus according to claim 13, wherein the preset risk detection model of the first financial institution is pre-configured based on one or more of the following model elements: Risk statistics, which are used to indicate the objects of risk statistics; Risk label, which is used to indicate information of risk object; Risk scores, which are used to indicate the risk level of each business object in a risk scenario; as well as Risk parameters are used to indicate one or more of the business products corresponding to the risky transaction time period, risky transaction amount segment and transaction flow.

15. The apparatus according to claim 13, wherein when the computer program is executed on the processor, generating a first risk detection model corresponding to each of the plurality of second financial institutions based on a preset risk detection model of the first financial institution comprises: Obtaining full transaction flow from the first financial institution; Determining the transaction flow corresponding to each second financial institution based on the full transaction flow; as well as The preset risk detection model is combined with the transaction flow of each second financial institution to generate a first risk detection model of each second financial institution.

16. The apparatus according to claim 14, wherein when the computer program is executed on the processor, generating a second risk detection model corresponding to each second financial institution based on the first risk detection model comprises: Determine the risk tolerance corresponding to each second financial institution; determining risk control data associated with one or more model elements in a preset risk detection model corresponding to the first risk detection model of each second financial institution based on the risk tolerance; as well as A second risk detection model corresponding to each second financial institution is generated based on the risk control data.

17. The device according to claim 16, wherein the target detection configuration of each second financial institution includes a combination of one or more of the following: risk scenarios, detection objects, transaction flows corresponding to the detection objects, risk event detection configuration, and detection logic.

18. The apparatus according to claim 17, wherein the detection logic comprises one or more operation items, each operation item comprising the model element or risk control data associated with the model element.

19. The apparatus of claim 13, wherein the computer program when executed on the processor further causes: Determine the common risk characteristics of each second financial institution; sending the public risk feature of one of the plurality of second financial institutions to one or more other second financial institutions among the plurality of second financial institutions, so that the one or more other second financial institutions update their respective second risk detection models and third risk detection models using the received public risk feature; and The updated second risk detection model and the third risk detection model are used to detect risk events of the one or more other second financial institutions.

20. The apparatus of claim 13, wherein the computer program when executed on the processor further causes: The third risk detection model of one of the plurality of second financial institutions is sent to another one or more second financial institutions among the plurality of second financial institutions, so that the another one or more second financial institutions use the received third risk detection model to detect respective risk events.

21. The apparatus of claim 13, wherein the computer program when executed on the processor causes determining a risk factor based on the detected risk events of each second financial institution to include: Selecting a candidate set of associated risk events from the detected risk events of each second financial institution using a dense subtensor detection algorithm; Removing associated risk events belonging to the same second financial institution from the candidate set of associated risk events to obtain an associated risk event set; as well as The risk factor is determined based on the set of associated risk events.

22. The device according to claim 13, wherein the risk events include a combination of one or more of the following: gambling-related events, fraud-related events, cash-out events, and arbitrage events, and the risk factors include a combination of one or more of the following: transaction device identification, transaction account identification, and transaction user identification.

23. The apparatus of claim 19 or 20, wherein the computer program when executed on the processor further causes: determining a risk factor based on the detected risk events of the one or more other second financial institutions; Risk events of one or more third financial institutions are determined based on the risk factors.

24. The apparatus according to claim 13 or 23, wherein the computer program when executed on the processor causes the determination of risk events for one or more third financial institutions based on the risk factors to include: Identify the transaction flow associated with the risk factor in the entire transaction flow; The risk events of the one or more third financial institutions are determined based on the transaction flows associated with the risk factors.

25. A non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium includes instructions that, when executed, perform the method for detecting risk according to any one of claims 1-12.

26. A computer program product, characterized in that The computer program product comprises instructions, which, when executed by a processor, implement the method for detecting risks according to any one of claims 1-12.

Images