Risk transaction event detection method, device, equipment, medium and program product

Abstract

The embodiment of the invention provides a risk transaction event detection method and device, equipment, a medium and a program product, and is applied to the field of big data. The method comprises the following steps: acquiring original transaction data of a user, and preprocessing the original transaction data of the user to obtain target transaction information corresponding to the original transaction data of the user; constructing a user transaction information graph according to the target transaction information; for the user transaction information atlas, determining a risk user network corresponding to the user transaction information atlas through a target network analysis model; and according to the risk user network and the target graph network model, determining a risk transaction event corresponding to the user transaction information graph. Therefore, automatic detection and identification of the risk transaction event can be realized, complex manual operation is not needed, the identification efficiency is improved, and the accuracy of risk transaction event identification can be improved by identifying and judging the risk transaction event based on the risk user network.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular to a risky transaction event detection method, device, equipment, medium and program product. Background Art

[0002] With the continuous development of computer and Internet technology, the business volume and business types of banks and other financial institutions have expanded rapidly. For example, the business volume of foreign exchange and other businesses has gradually increased. However, with the growth of business volume, the difficulty of identifying and detecting risky transactions has increased accordingly.

[0003] In related technologies, in order to detect risky transaction events in foreign exchange and other businesses, staff usually manually set relevant detection thresholds and feature models, and determine risky transaction events based on the detection thresholds and feature models. This method of risky transaction event detection has a relatively complex manual operation process, low efficiency, and relies on manual experience, resulting in low accuracy in risky transaction event detection. Summary of the invention

[0004] The embodiments of the present application provide a risky transaction event detection method, device, equipment, medium and program product, which can realize automatic detection and identification of risky transaction events, and improve the efficiency and accuracy of risky transaction event identification.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting risky transaction events, comprising:

[0006] Acquire original transaction data of the user, and pre-process the original transaction data of the user to obtain target transaction information corresponding to the original transaction data of the user;

[0007] Constructing a user transaction information map based on the target transaction information;

[0008] For the user transaction information graph, determining the risk user network corresponding to the user transaction information graph through a target network analysis model;

[0009] According to the risky user network and the target graph network model, the risky transaction events corresponding to the user transaction information graph are determined.

[0010] In a possible implementation manner, preprocessing the original transaction data of the user to obtain target transaction information corresponding to the original transaction data of the user includes:

[0011] The original transaction data of the user is cleaned and standardized to obtain the target transaction information; the target transaction information includes a user identifier, an account identifier and transaction information.

[0012] In a possible implementation, constructing a user transaction information graph according to the target transaction information includes:

[0013] Determine graph data according to the target transaction information; the graph data includes node data and connection line data;

[0014] The user transaction information graph is constructed based on the graph data.

[0015] In a possible implementation, determining the risky user network corresponding to the user transaction information graph by using a target network analysis model for the user transaction information graph includes:

[0016] For the user transaction information graph, according to preset risky transaction identification conditions, target graph data with risky transaction behaviors is determined;

[0017] Determine the central user identifier corresponding to the target graph data through the node mining sub-model in the target network analysis model;

[0018] The risk user network corresponding to the target graph data is determined according to the social network sub-model in the target network analysis model and the central user identifier.

[0019] In a possible implementation, determining the risky transaction event corresponding to the user transaction information graph according to the risky user network and the target graph network model includes:

[0020] Performing path analysis on the risk user network through the target graph network model to determine multiple key paths corresponding to the risk user network;

[0021] Determine the priority information corresponding to each critical path;

[0022] The risk transaction events corresponding to the respective critical paths are determined according to the priority information.

[0023] In a possible implementation, the method further includes:

[0024] Extracting risky transaction information corresponding to the risky transaction event;

[0025] According to the risk transaction event and the risk transaction information, a risk transaction analysis report corresponding to the risk transaction event is generated through a target dialogue model.

[0026] In a second aspect, an embodiment of the present application provides a risk transaction event detection device, including:

[0027] An acquisition module is used to acquire original transaction data of a user and pre-process the original transaction data of the user to obtain target transaction information corresponding to the original transaction data of the user;

[0028] A construction module, used to construct a user transaction information map according to the target transaction information;

[0029] A first determination module is used to determine the risk user network corresponding to the user transaction information graph through a target network analysis model for the user transaction information graph;

[0030] The second determination module is used to determine the risky transaction events corresponding to the user transaction information graph according to the risky user network and the target graph network model.

[0031] In a possible implementation manner, the acquisition module is specifically configured to:

[0032] The original transaction data of the user is cleaned and standardized to obtain the target transaction information; the target transaction information includes a user identifier, an account identifier and transaction information.

[0033] In a possible implementation manner, the building block is specifically used to:

[0034] Determine graph data according to the target transaction information; the graph data includes node data and connection line data;

[0035] The user transaction information graph is constructed based on the graph data.

[0036] In a possible implementation manner, the first determining module is specifically configured to:

[0037] For the user transaction information graph, according to preset risky transaction identification conditions, target graph data with risky transaction behaviors is determined;

[0038] Determine the central user identifier corresponding to the target graph data through the node mining sub-model in the target network analysis model;

[0039] The risk user network corresponding to the target graph data is determined according to the social network sub-model in the target network analysis model and the central user identifier.

[0040] In a possible implementation manner, the second determining module is specifically configured to:

[0041] Performing path analysis on the risk user network through the target graph network model to determine multiple key paths corresponding to the risk user network;

[0042] Determine the priority information corresponding to each critical path;

[0043] The risk transaction events corresponding to the respective critical paths are determined according to the priority information.

[0044] In a possible implementation manner, the device is further used for:

[0045] Extracting risky transaction information corresponding to the risky transaction event;

[0046] According to the risk transaction event and the risk transaction information, a risk transaction analysis report corresponding to the risk transaction event is generated through a target dialogue model.

[0047] In a third aspect, an embodiment of the present application provides a risk transaction event detection device, including: a memory, a processor;

[0048] The memory stores computer-executable instructions;

[0049] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the risk transaction event detection method as described in any one of the first aspects above.

[0050] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer execution instructions, and when the computer execution instructions are executed by a processor, the method for detecting risky transaction events as described in any one of the first aspects above is used.

[0051] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the risk transaction event detection method as described in any one of the first aspects above.

[0052] The risk transaction event detection method, device, equipment, medium and program product provided in the embodiment of the present application obtain the original transaction data of the user, and pre-process the original transaction data of the user to obtain the target transaction information corresponding to the original transaction data of the user; construct the user transaction information map according to the target transaction information; for the user transaction information map, determine the risk user network corresponding to the user transaction information map through the target network analysis model; determine the risk transaction event corresponding to the user transaction information map according to the risk user network and the target graph network model. In the present application, the electronic device pre-processes the original transaction data of the user to obtain the target transaction information, constructs the user transaction information map based on the target transaction information, and then determines the risk user network corresponding to the user transaction information map through the target network analysis model, and then determines the risk transaction event corresponding to the user transaction information map through the target graph network model. In this way, the electronic device can realize the automatic detection and identification of risk transaction events by constructing the user transaction information map and determining the risk transaction event through model analysis, without the need for manual complex operations, thereby improving the identification efficiency, and at the same time, the identification and judgment of risk transaction events based on the risk user network can improve the accuracy of risk transaction event identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0054] Figure 1 A flowchart of a risky transaction event detection method provided in this application;

[0055] Figure 2 A flowchart of another risky transaction event detection method provided in this application;

[0056] Figure 3 A logical diagram of risky transaction event detection provided by this application;

[0057] Figure 4 A practical application diagram of risk transaction event detection provided by this application;

[0058] Figure 5 A schematic diagram of the structure of a risky transaction event detection device provided in this application;

[0059] Figure 6 A schematic diagram of the structure of a risky transaction event detection device provided in this application.

[0060] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0061] In order to enable those skilled in the art to better understand the technical solution of the present application, the present application is further described in detail below in conjunction with the drawings and embodiments. It should be understood that the specific embodiments and drawings described herein are only used to explain the present application, and are not intended to limit the present application.

[0062] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0063] In addition, this application involves conducting big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.), and using artificial intelligence technology to make automated decisions, and making technical solutions that have a significant impact on personal rights and interests based on the results of automated decisions. The application provides users with corresponding operation entrances for them to choose to agree or reject the results of automated decisions; if the user chooses to reject, the expert decision-making process will be entered.

[0064] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0065] It should be noted that the risk transaction event detection method, device, equipment, medium and program product of the present application can be used in the field of big data technology, and can also be used in any field outside the field of big data technology. The present application does not limit the specific application field of the risk transaction event detection method, device, equipment, medium and program product.

[0066] With the continuous development of Internet technology, the business volume and business types of banks and other financial institutions have expanded rapidly. For example, the business volume of foreign exchange business has gradually increased. Taking foreign exchange business as an example, when banks provide foreign exchange business to customers, they need to implement differentiated measures to handle foreign exchange business according to the foreign exchange risk level of customers, and timely monitor and deal with foreign exchange risk transactions (such as abnormal transactions, fraudulent transactions, etc.). Foreign exchange business development needs to ensure that the entire process is controllable before, during and after the event. In the post-monitoring process, foreign exchange risk monitoring requires banks and other financial institutions to set monitoring models and indicator thresholds according to their own risk preferences, so as to achieve system early warning. In the process of setting thresholds, it is necessary to prevent a large number of invalid warnings from occurring, and to avoid situations where risks cannot be identified. Specifically, the business after the system warning can be manually identified by setting three manual posts of "handling, review, and approval", confirming the transaction risk type and completing the foreign exchange risk transaction report. In the process of manually identifying risky transactions, financial institutions need to ensure the security, comprehensiveness and convenience of information query, and the identification operation must be traceable and traceable.

[0067] In the related art, for the identification of risky transactions in foreign exchange and other businesses, financial institutions usually manually build various sub-models based on preset factor rules, manually set the characteristic parameters and detection thresholds of the sub-models, and detect risky transaction events based on the manually configured sub-models. This method of detecting risky transaction events involves a large amount of manual operations, and the manual operation process is relatively complicated. With the increasing growth of transaction data, the number of risky transactions based on manually set rules and thresholds is huge. Staff (or operators, operation and maintenance personnel, etc.) need to manually check and report one by one, and the process is complicated and inefficient. In addition, the risky transaction detection method in the related art relies too much on manual experience, and it is impossible to efficiently and accurately identify risky transactions in scenarios with large transaction volumes. The probability of misidentification or missed identification is high. In addition, since some risky transactions (such as the act of legalizing illegal income) usually involve multi-person group transactions, and the manually set rules and thresholds are usually for a single account, the accuracy and comprehensiveness of risky transaction identification are not high.

[0068] With the rapid development of technologies such as artificial intelligence and big data, artificial intelligence technology (AI) has been widely used in many fields. For the financial industry, there is a large amount of transaction data. In business scenarios such as foreign exchange, artificial intelligence technology can be used to realize automatic detection and identification of risky transaction events. On this basis, in order to solve the above-mentioned problems existing in the relevant technology, the embodiment of the present application provides a risky transaction event detection method, device, equipment, medium and program product. The electronic device obtains the original transaction data of the user, and pre-processes the original transaction data of the user to obtain the target transaction information. Based on the target transaction information, the user transaction information map is constructed, and then the risk user network corresponding to the user transaction information map is determined through the target network analysis model, and then the risky transaction event corresponding to the user transaction information map is determined through the target graph network model. In this way, the electronic device can realize automatic detection and identification of risky transaction events by constructing the user transaction information map and determining the risky transaction event through model analysis, without the need for manual complex operations, thereby improving the recognition efficiency. At the same time, the recognition and judgment of risky transaction events based on the risky user network can improve the accuracy of risky transaction event recognition.

[0069] The scheme shown in the present application is described in detail below through specific embodiments. It should be noted that the following embodiments can exist independently or in combination with each other, and the same or similar contents will not be described repeatedly in different embodiments.

[0070] Figure 1 A flowchart of a risky transaction event detection method provided in this application. Figure 1 , the risk transaction event detection method may include:

[0071] S101. Acquire original transaction data of a user, and pre-process the original transaction data of the user to obtain target transaction information corresponding to the original transaction data of the user.

[0072] The execution subject of the embodiment of the present application may be an electronic device, such as a mobile phone, a computer or a wearable device, or a risk transaction event detection device set in the electronic device. The risk transaction event detection device may be implemented by software or by a combination of software and hardware. For ease of understanding, the following description is made by taking the execution subject as an electronic device as an example.

[0073] In the embodiment of the present application, the original transaction data of the user may refer to the original data of the user's transaction, and the user may be called a customer, which refers to a specific user of a financial transaction, such as a user who conducts foreign exchange transactions in a foreign exchange business scenario. The original transaction data of the user includes various relevant data of multiple user transactions, which is not limited in the embodiment of the present application. The target transaction information may refer to the key feature information of the user's transaction after data preprocessing, which may specifically include a user identifier, an account identifier, and transaction information, etc., wherein the user identifier may refer to the user's unique code, etc., the account identifier may refer to the user's account number, etc., and the transaction information may include information such as transaction time, transaction amount, number of transactions, and transaction type. Of course, the target transaction information may also include other information, which may be specifically set based on actual needs, which is not limited in the embodiment of the present application.

[0074] In this step, the middle office system can collect the original transaction data of the user, and push the original transaction data of the user to the electronic device through the data push interface. The middle office system may include a data warehouse (Hive), a data lake, and a business operating system, etc., which may specifically include a user data table, an account data table, and a transaction data table, etc. The electronic device obtains the original transaction data of the user pushed by the middle office system, and can pre-process the original transaction data of the user to obtain the target transaction information. Specifically, the original transaction data of the user can be cleaned and standardized, etc. Of course, other pre-processing methods can also be used, such as missing value processing, data dimensionality reduction, feature extraction, etc., which are not limited in this embodiment of the present application. The electronic device obtains the target transaction information by pre-processing the original transaction data of the user, which can reduce the amount of data, reduce the dimension of the graph information constructed subsequently, and reduce the amount of calculation for subsequent model analysis.

[0075] S102. Construct a user transaction information map based on the target transaction information.

[0076] In an embodiment of the present application, the user transaction information graph may refer to a knowledge graph corresponding to the user transaction information, and the user transaction information graph may be composed of various graph data, such as node data and connection line data, wherein the node data may refer to entity node data corresponding to the user transaction, such as user identification, customer identification, and transaction information, etc.; the connection line data may refer to the association relationship data between different entities, such as the association relationship between users and users, the association relationship between users and accounts, etc.

[0077] In this step, after determining the target transaction information, the electronic device can determine the corresponding node data and connection line data based on the target transaction information, use the node data as the nodes in the knowledge graph, and use the connection line data as the edges in the knowledge graph. By connecting the nodes through the edges, a user transaction information graph corresponding to the target transaction information can be generated, and the user transaction information graph can be subsequently analyzed and detected.

[0078] S103. For the user transaction information graph, determine the risk user network corresponding to the user transaction information graph through the target network analysis model.

[0079] In an embodiment of the present application, the target network analysis model may refer to a pre-trained user relationship network analysis model, the input of the target network analysis model may refer to the graph data of risky transactions in the user transaction information map, and the output may be the risky user network corresponding to the user transaction information map. The target network analysis model may include node mining algorithms and social network analysis algorithms, etc., wherein the node mining algorithm can be used to determine the central user of risky transactions, and the social network analysis algorithm can identify the central user social relationship network. Of course, other algorithms may also be included in the target network analysis model, and the embodiment of the present application does not limit the specific algorithm type of the target network analysis model. The risky user network may refer to a customer relationship network with risky transaction behaviors, such as a user relationship (i.e., gang) network with risky transaction behaviors in a foreign exchange business scenario.

[0080] In this step, after constructing the user transaction information graph, the electronic device can apply the risk transaction identification strategy in the user transaction information graph. Specifically, the preset risk transaction identification conditions can be applied to each edge in the user transaction information graph to realize the identification of risky transaction behaviors. In this way, only the graph data corresponding to the risky transaction behaviors can be identified and analyzed later, which can reduce the amount of calculation and improve the detection efficiency of risky transaction events. After that, the electronic device can analyze and process the graph data corresponding to the risky transaction behaviors through the target network analysis model to determine the risky user network corresponding to the user transaction information graph.

[0081] Of course, the electronic device may not perform the identification of risky transaction behaviors, but directly identify and process the entire user transaction information map through the target network analysis model to obtain the risky user network corresponding to the user transaction information map, and then further detect whether each risky user network has risky transaction events. The embodiments of the present application are not limited to this.

[0082] S104: Determine the risky transaction events corresponding to the user transaction information graph according to the risky user network and the target graph network model.

[0083] In the embodiments of the present application, the target graph network model may refer to a pre-trained graph neural network algorithm model, which can be used to detect and identify risky trading events. The target graph network model may specifically refer to a graph sampling and aggregation model (Graph Sample and Aggregated, GraphSAGE), a graph convolutional neural network model (GraphConvolutional Networks, GCN), a gated graph neural network model (Gated Graph Neural Networks, GGNN), etc. Of course, it may also be other types of models, which are not limited in the embodiments of the present application. Risky trading events may refer to various risk events involving risky trading behaviors.

[0084] In this step, after determining the risky user network in the user transaction information graph, the electronic device can analyze and process the graph data corresponding to the risky user network through the target graph network model, identify at least one type of risky transaction event, and subsequently output the corresponding risk warning information or generate the corresponding risky transaction analysis report, etc., to achieve timely reminders to the staff. For example, in business scenarios such as foreign exchange, the electronic device can report the risky transaction event to the relevant financial business system to achieve the purpose of monitoring foreign exchange risk transactions.

[0085] The risk transaction event detection method provided by the embodiment of the present application obtains the original transaction data of the user, and pre-processes the original transaction data of the user to obtain the target transaction information corresponding to the original transaction data of the user; constructs a user transaction information map according to the target transaction information; determines the risk user network corresponding to the user transaction information map through the target network analysis model for the user transaction information map; determines the risk transaction event corresponding to the user transaction information map according to the risk user network and the target graph network model. In the present application, the electronic device pre-processes the original transaction data of the user to obtain the target transaction information, constructs the user transaction information map based on the target transaction information, and then determines the risk user network corresponding to the user transaction information map through the target network analysis model, and then determines the risk transaction event corresponding to the user transaction information map through the target graph network model. In this way, the electronic device can realize the automatic detection and identification of risk transaction events by constructing the user transaction information map and determining the risk transaction event through model analysis, without the need for manual complex operations, thereby improving the identification efficiency, and at the same time, the identification and judgment of risk transaction events based on the risk user network can improve the accuracy of risk transaction event identification.

[0086] Based on the above embodiments, Figure 2 A flowchart of another risky transaction event detection method provided for this application. Figure 2 , the risk transaction event detection method may include:

[0087] S201. Obtain original transaction data of the user, perform data cleaning and standardization on the original transaction data of the user, and obtain target transaction information; the target transaction information includes user identification, account identification and transaction information.

[0088] In the embodiments of the present application, data cleaning may refer to deleting invalid data, duplicate data or erroneous data in the original transaction data of the user. Standardization processing may refer to format conversion, data standardization and other processing of the data in the original transaction data of the user, wherein format conversion may refer to unifying data of different sources and formats into a target format; data standardization may refer to converting non-numeric data such as text and date into numeric data.

[0089] In this step, after obtaining the original transaction data of the user, the electronic device can pre-process the original transaction data of the user, specifically, it can perform data cleaning and standardization processing to obtain target transaction information, which may include user identification, account identification and transaction information, etc. In this way, the electronic device can reduce the amount of data and calculation by performing data cleaning and standardization processing on the original data, and improve the efficiency of subsequent graph generation and risk transaction event detection.

[0090] S202. Determine graph data according to target transaction information; the graph data includes node data and connection line data; and construct a user transaction information graph according to the graph data.

[0091] In the embodiment of the present application, graph data may refer to data required for constructing a knowledge graph. The graph data may include node data and connection line data, wherein the node data may refer to transaction entity data such as user identification, account identification, and transaction information, and the connection line data may refer to the association relationship data between different transaction entities.

[0092] In this step, after determining the target transaction information, the electronic device determines the node data according to the user identifier, account identifier and transaction information in the target transaction information, and can also determine the connection line data according to the association relationship between different target transaction information, such as the association relationship between users, the association relationship between accounts and the association relationship between transaction information. The electronic device can store the node data and the connection line data as graph data in the graph database to facilitate subsequent model analysis and calculation. Afterwards, the electronic device can use the determined node data and connection line data as each node in the knowledge graph, and the connection line data as each edge in the knowledge graph, connect each node through the edge, and generate a user transaction information graph corresponding to the target transaction information. After generating the user transaction information graph, the electronic device can render and display the user transaction information graph in the front-end page to achieve a visual display of the knowledge graph.

[0093] In the embodiment of the present application, the electronic device determines the node data and the connection line data as the graph data according to the target transaction information, and constructs the user transaction information graph according to the graph data. In this way, the graph construction of the transaction information can be realized, and the accuracy and comprehensiveness of the subsequent model analysis can be improved.

[0094] S203: for the user transaction information graph, according to preset risky transaction identification conditions, determine the target graph data with risky transaction behaviors.

[0095] In the embodiment of the present application, the preset risk transaction identification condition may refer to a pre-set risk transaction identification strategy or identification rule. The preset risk transaction identification condition may refer to a risk identification judgment condition set by financial institution staff based on actual business needs and risk characteristics, and may specifically refer to a transaction amount threshold condition, a transaction frequency condition, a transaction geographic location condition, etc. The target graph data may refer to graph data that may contain risky transaction behaviors.

[0096] Specifically, after constructing the user transaction information graph, the electronic device can apply the preset risk transaction identification conditions to each edge (i.e., connecting line) in the user transaction information graph to form a path link, and then can determine whether the node data and connecting line data in the user transaction information graph meet the preset risk transaction identification conditions based on the preset risk transaction identification conditions. The electronic device can determine the graph data corresponding to the risk transaction behavior that meets the preset risk transaction identification conditions as the target graph data.

[0097] S204, determining the central user identifier corresponding to the target graph data through the node mining sub-model in the target network analysis model; determining the risk user network corresponding to the target graph data according to the social network sub-model and the central user identifier in the target network analysis model.

[0098] In an embodiment of the present application, the node mining sub-model may refer to a node mining algorithm model in a target network analysis model, which is used to mine the central user identifier of the target graph data. The central user identifier may refer to a target graph data center character identifier. The social network sub-model may refer to a social network algorithm model in a target network analysis model, wherein the social network algorithm may refer to a greedy algorithm (Louvain) based on modular maximization or a label propagation algorithm (LPA), etc. Of course, the specific types of node mining algorithms and social network algorithms can be flexibly selected based on actual needs, and the embodiments of the present application do not limit this.

[0099] Specifically, after determining that the target graph data has risky transaction behaviors, the electronic device can determine the central user identifier of the central person in the target graph data according to the node mining sub-model. Then, the electronic device can determine the risky user network corresponding to the target graph data having risky transaction behaviors according to the social network sub-model and the central user identifier. Then, the electronic device can display the risky user network in the front-end page to realize the visual display of the risky user network.

[0100] In an embodiment of the present application, the electronic device determines the risky user network corresponding to the target graph data where risky transaction behaviors exist through the node mining sub-model and the social network sub-model in the target network analysis model, thereby enabling accurate identification of risky transactions by multi-person groups and improving the comprehensiveness and accuracy of risky transaction identification.

[0101] S205. Perform path analysis on the risk user network through the target graph network model to determine multiple key paths corresponding to the risk user network.

[0102] S206, determining the priority information corresponding to each critical path; and determining the risk transaction event corresponding to each critical path according to the priority information.

[0103] In the embodiment of the present application, the critical path may refer to the main path in the risk user network. The priority information may refer to the priority sorting information corresponding to different critical paths, which can be used to characterize the importance of the critical path in the risk user network when risk propagation or risk event formation occurs.

[0104] Specifically, after determining the risky user network, the electronic device can perform path analysis on the risky user network and identify the key path corresponding to the risky user network. The nodes included in the key path are the key nodes. Afterwards, the electronic device can determine the priority information of the key path according to the target weight, path length, and connectivity of the key path; then, based on the priority information and the target graph network model, analyze each key path, determine the risky transaction events corresponding to each associated path, and realize the detection and identification of different types of risky transaction events.

[0105] In addition, after determining a risky transaction event, the electronic device can determine the graph data corresponding to the risky transaction event in the user transaction information map, and obtain the risky transaction link to facilitate subsequent prompts and reports; at the same time, the electronic device can store the central user identifier corresponding to the risky transaction event as a risky user for subsequent targeted risk detection; the electronic device can also display the risky transaction events associated with a single risky user based on the dimension of the risky user, which is convenient for staff to view.

[0106] In an embodiment of the present application, after determining the risky user network, the electronic device performs path analysis and priority sorting through the target graph network model to determine the risky transaction events corresponding to each key path. It is able to automatically identify and detect different types of risky transaction events without the need for manual judgment by staff, thereby improving the efficiency and accuracy of risky transaction detection.

[0107] S207, extracting risk transaction information corresponding to the risk transaction event; generating a risk transaction analysis report corresponding to the risk transaction event through a target dialogue model according to the risk transaction event and the risk transaction information.

[0108] In the embodiment of the present application, risk transaction information may refer to target transaction information in the risk transaction link corresponding to the risk transaction event. The target dialogue model may refer to a pre-trained AI dialogue model, which may be implemented based on algorithms such as natural language processing (NLP) and may generate corresponding personalized analysis reports for different types of risk transaction events.

[0109] In this step, after determining the risky transaction event, the electronic device can obtain the specific risky transaction information corresponding to the risky transaction event by means of data extraction, and then can automatically generate the corresponding risky transaction analysis report based on the risky transaction information through the target dialogue model. In this way, the electronic device can realize the automatic generation of the risky transaction analysis report, which can further simplify the operation of the staff and reduce the workload of the staff.

[0110] It should be noted that the electronic device can also respond to the interactive operation of the staff, and generate the final risk transaction analysis report according to the report generation rules determined by the interactive operation through the target dialogue model according to the report generation rules and risk transaction information. This can further meet the actual needs of the staff in different aspects such as event types and focus factors, and simplify the user's operation. The electronic device can also automatically save the risk transaction analysis report to local storage, which is convenient for the staff to perform subsequent viewing and other operations.

[0111] For example, Figure 3 A logical diagram of risky transaction event detection provided by this application. Figure 3 As shown, the electronic device obtains the original transaction data of the user, and pre-processes the original transaction data of the user to obtain the target transaction information; then, a user transaction information map is constructed according to the target transaction information; then, the central user identifier is determined through the node mining sub-model in the target network analysis model, and the risk user network is determined by the social network sub-model in the target network analysis model. After that, the electronic device can determine the risk transaction event based on the target graph network model and the risk user network. Finally, the electronic device automatically generates a risk transaction analysis report corresponding to the risk transaction event based on the target dialogue model. In this way, the electronic device determines the risk transaction event by performing model analysis on the user transaction information map, which can assist the staff in risk control and decision-making, without the need for the staff to manually judge one by one, simplifying the staff's operation, and also improving the accuracy of risk transaction identification.

[0112] Based on the above embodiments, Figure 4 This is a practical application diagram of a risk transaction event detection provided by this application. Figure 4 As shown, the electronic device obtains the original transaction data of the user pushed by the middle office system, and pre-processes the original transaction data to obtain the target transaction information. Then the electronic device determines the graph data corresponding to the target transaction information, and constructs the user transaction information map based on the graph data. The electronic device determines the risk transaction event based on the target network analysis model and the target graph network model for the user transaction information map. After that, the electronic device can generate a risk transaction analysis report based on the risk transaction information corresponding to the risk transaction event through the target dialogue model.

[0113] Of course, while automatically determining risky transaction events, the electronic device can also receive risky transaction events manually reported by staff, merge the automatically determined risky transaction events and the manually reported risky transaction events to obtain target risky transaction events, and finally generate a corresponding risky transaction analysis report based on the report generation rules selected by the staff and the target risky transaction events.

[0114] In the manual review and reporting process for risky transaction events, in the preliminary review stage, the staff can conduct a preliminary review of the automatically generated risky transaction events, and use the preliminary review page to review whether the risky transaction events need to be reported. In the review stage, the staff can review the events that have passed the preliminary review. If the review passes, the risky transaction event will enter the review page for processing. If the review fails, the risky transaction event processing flow will return to the preliminary review page. In the review stage, the staff will change the risky transaction event from the review pass status to the review status through review. When the risky transaction event status is approved and meets the event information number limit, a message is generated, and the electronic device can report the message.

[0115] In the relevant technologies, the current risk transaction event generation process involves a large number of manual operations, the frequency of factor rules and parameter settings is high, the risk event generation process is cumbersome, and the manual query tasks of the three processes of "handling, review, and approval" are heavy, which makes the current risk event reporting process have too many pre-operations.

[0116] In the embodiment of the present application, the electronic device automatically identifies risky transaction behaviors and determines risky user networks based on user transaction information graph construction and model analysis methods, generates risky transaction events and risky transaction analysis reports, which can reduce the workload of staff, improve the efficiency and accuracy of risky transaction event identification, and solve the problems of complex manual operation processes, low accuracy in risky transaction identification, and difficulty in identifying gang behavior.

[0117] Figure 5 This is a schematic diagram of the structure of a risk transaction event detection device provided by this application. Figure 5 , the risk transaction event detection device 50 may include:

[0118] The acquisition module 51 is used to acquire the original transaction data of the user and pre-process the original transaction data of the user to obtain the target transaction information corresponding to the original transaction data of the user;

[0119] A construction module 52, used to construct a user transaction information map according to target transaction information;

[0120] A first determination module 53 is used to determine the risk user network corresponding to the user transaction information graph through a target network analysis model based on the user transaction information graph;

[0121] The second determination module 54 is used to determine the risky transaction events corresponding to the user transaction information graph according to the risky user network and the target graph network model.

[0122] In a possible implementation, the acquisition module 51 is specifically configured to:

[0123] The user's original transaction data is cleaned and standardized to obtain target transaction information; the target transaction information includes user identification, account identification and transaction information.

[0124] In a possible implementation, the construction module 52 is specifically configured to:

[0125] Determine graph data according to target transaction information; graph data includes node data and connection line data;

[0126] Build a user transaction information graph based on graph data.

[0127] In a possible implementation manner, the first determining module 53 is specifically configured to:

[0128] Based on the user transaction information graph, according to the preset risky transaction identification conditions, the target graph data with risky transaction behaviors is determined;

[0129] Determine the central user ID corresponding to the target graph data through the node mining sub-model in the target network analysis model;

[0130] According to the social network sub-model in the target network analysis model and the central user identifier, the risk user network corresponding to the target graph data is determined.

[0131] In a possible implementation manner, the second determining module 54 is specifically configured to:

[0132] Through the target graph network model, the path analysis of the risk user network is carried out to determine multiple key paths corresponding to the risk user network;

[0133] Determine the priority information corresponding to each critical path;

[0134] Based on the priority information, determine the risk transaction events corresponding to each critical path.

[0135] In a possible implementation manner, the device 50 is further used for:

[0136] Extract risky transaction information corresponding to risky transaction events;

[0137] Based on risk transaction events and risk transaction information, a risk transaction analysis report corresponding to the risk transaction event is generated through the target dialogue model.

[0138] The risk transaction event detection device 50 provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar and will not be repeated here.

[0139] Figure 6 This is a schematic diagram of the structure of a risk transaction event detection device provided by this application. Figure 6 The risk transaction event detection device 60 may include: a memory 61 and a processor 62. Exemplarily, the memory 61 and the processor 62 are interconnected via a bus 63.

[0140] The memory 61 is used to store program instructions;

[0141] The processor 62 is used to execute the program instructions stored in the memory to implement the risk transaction event detection method shown in the above embodiment.

[0142] Figure 6 The risky transaction event detection device 60 shown can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0143] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the above-mentioned risk transaction event detection method.

[0144] The embodiment of the present application may also provide a computer program product, including a computer program, which, when executed by a processor, can implement the above-mentioned risky transaction event detection method.

[0145] It should be noted that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0146] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct RAM bus random access memory (DR RAM). It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) is integrated in the processor. It should be noted that the memory described herein is intended to include but is not limited to these and any other suitable types of memory.

[0147] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0148] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0149] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0150] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0151] Regarding the various modules / units contained in the various devices and products described in the above embodiments, they may be software modules / units, or hardware modules / units, or they may be partially software modules / units and partially hardware modules / units. Each device and product may be applied to or integrated in a chip, a chip module or a terminal device. Exemplarily, for each device and product applied to or integrated in a chip, each module / chip contained therein may be implemented in the form of hardware such as circuits, or at least some modules / units may be implemented in the form of software programs, which run on a processor integrated inside the chip, and the remaining modules / units may be implemented in the form of hardware such as circuits.

[0152] In the present application, the term "include" and its variations may refer to non-restrictive inclusion; the term "or" and its variations may refer to "and / or". The terms "first", "second", etc. in the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. In the present application, "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previously associated objects are in an "or" relationship.

[0153] The above are only some embodiments of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting risky transaction events, characterized in that: include: Acquire original transaction data of the user, and pre-process the original transaction data of the user to obtain target transaction information corresponding to the original transaction data of the user; Constructing a user transaction information map based on the target transaction information; For the user transaction information graph, determining the risk user network corresponding to the user transaction information graph through a target network analysis model; According to the risky user network and the target graph network model, the risky transaction events corresponding to the user transaction information graph are determined.

2. The method according to claim 1, characterized in that: The preprocessing of the original transaction data of the user to obtain target transaction information corresponding to the original transaction data of the user includes: The original transaction data of the user is cleaned and standardized to obtain the target transaction information; the target transaction information includes a user identifier, an account identifier and transaction information.

3. The method according to claim 1, characterized in that The step of constructing a user transaction information graph according to the target transaction information includes: Determine graph data according to the target transaction information; the graph data includes node data and connection line data; The user transaction information graph is constructed based on the graph data.

4. The method according to claim 3, characterized in that The determining, for the user transaction information graph, a risky user network corresponding to the user transaction information graph through a target network analysis model includes: For the user transaction information graph, according to preset risky transaction identification conditions, target graph data with risky transaction behaviors is determined; Determine the central user identifier corresponding to the target graph data through the node mining sub-model in the target network analysis model; The risk user network corresponding to the target graph data is determined according to the social network sub-model in the target network analysis model and the central user identifier.

5. The method according to claim 1, characterized in that Determining the risky transaction events corresponding to the user transaction information graph according to the risky user network and the target graph network model includes: Performing path analysis on the risk user network through the target graph network model to determine multiple key paths corresponding to the risk user network; Determine the priority information corresponding to each critical path; The risk transaction events corresponding to the respective critical paths are determined according to the priority information.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Extracting risky transaction information corresponding to the risky transaction event; According to the risk transaction event and the risk transaction information, a risk transaction analysis report corresponding to the risk transaction event is generated through a target dialogue model.

7. A risky transaction event detection device, characterized in that: include: An acquisition module is used to acquire original transaction data of a user, and pre-process the original transaction data of the user to obtain target transaction information corresponding to the original transaction data of the user; A construction module, used to construct a user transaction information map according to the target transaction information; A first determination module is used to determine the risk user network corresponding to the user transaction information graph through a target network analysis model according to the user transaction information graph; The second determination module is used to determine the risky transaction events corresponding to the user transaction information graph according to the risky user network and the target graph network model.

8. A risk transaction event detection device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor executes the risk transaction event detection method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the risk transaction event detection method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, which, when executed by a processor, implements the risk transaction event detection method according to any one of claims 1 to 6.

Images