Abnormal fund transfer identification method and device based on decision tree model

Abstract

The invention discloses an abnormal fund transfer identification method and device based on a decision-making tree model, and relates to the technical field of big data or other related technical fields, and the method comprises the steps: inputting real-time transaction data corresponding to a target transaction into a preset target decision-making tree model, carrying out the evaluation of the transaction data through the target decision-making tree model, and obtaining an abnormal fund transfer identification result; and outputting an evaluation result of the target transaction, the target decision tree model being a decision tree model obtained by performing model training by using a decision tree algorithm based on historical customer information data and historical transaction data corresponding to historical financial transactions identified to have abnormal fund transfer, and when the evaluation result indicates that the target transaction relates to the abnormal fund transfer, outputting transaction alarm information. According to the method and the device, the technical problem that the security of financial transactions is affected due to hysteresis of management and control of a fund monitoring system on an abnormal fund transfer behavior in related technologies is solved.

Description

Technical Field

[0001] The present invention relates to the field of big data technology or other related fields, and in particular to a method and device for identifying abnormal fund transfer based on a decision tree model. Background Art

[0002] With the continuous development of the global financial market and the expansion of the scale of financial transactions, the concealment and complexity of abnormal fund transfer transactions, illegal financing activities and other activities have also been increasing, posing severe challenges to the compliance management of financial institutions. In order to effectively identify and prevent such illegal activities, financial institutions generally use fund monitoring systems, which are usually based on rules or statistical models to analyze historical transaction data to discover suspicious transaction patterns and behaviors.

[0003] Existing funds monitoring systems are able to identify potential illegal transactions to a certain extent, but they mainly rely on offline processing, that is, analyzing data from the previous day or earlier, triggering suspicious indicator models by establishing certain rules, and then tracking abnormal fund transfer behaviors. This leads to a lag in the control of abnormal fund transfer behaviors. In addition, rule-based systems find it difficult to cope with the rapid changes in abnormal fund transfer patterns.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiment of the present invention provides a method and device for identifying abnormal fund transfers based on a decision tree model, so as to at least solve the technical problem in the related art that the fund monitoring system has a lag in the control of abnormal fund transfer behavior, thereby affecting the security of financial transactions.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for identifying abnormal fund transfers based on a decision tree model is provided, comprising: inputting real-time transaction data corresponding to a target transaction into a preset target decision tree model, evaluating the transaction data by the target decision tree model, and outputting an evaluation result of the target transaction, wherein the target decision tree model is a decision tree model obtained by training the model using a decision tree algorithm based on historical customer information data and historical transaction data corresponding to historical financial transactions that have been identified as having abnormal fund transfers; when the evaluation result indicates that the target transaction involves abnormal fund transfers, outputting transaction alarm information.

[0007] Optionally, the target decision tree model is trained in the following manner: obtaining historical customer information data and historical transaction data corresponding to historical financial transactions identified as abnormal fund transfers; preprocessing the historical customer information data and the historical transaction data; extracting historical transaction behaviors and abnormal fund transfer identifiers from the preprocessed historical transaction data; determining a feature matrix based on the preprocessed historical customer basic information and historical transaction behaviors, taking the abnormal fund transfer transaction identifier as the target vector, and using a decision tree algorithm to perform model training to obtain the target decision tree model.

[0008] Optionally, the step of obtaining historical customer information data and historical transaction data corresponding to historical financial transactions identified as abnormal fund transfers includes: obtaining registration information, financial identity information, and identity maintenance information of customers who have been identified as abnormal fund transfer transactions in the financial transaction platform to obtain historical customer information data; obtaining daily, weekly, and monthly data of transactions that have been identified as abnormal fund transfer transactions in the financial transaction platform to obtain the historical transaction data.

[0009] Optionally, the step of preprocessing the historical customer information data and the historical transaction data includes: performing a cleaning operation on the historical customer information data and the historical transaction data, wherein the cleaning operation includes: supplementing missing data, converting data with negative transaction amounts to positive amounts, unifying dictionary values, and eliminating data that is still empty after supplementation of customer key elements.

[0010] Optionally, the step of determining a feature matrix based on the preprocessed historical customer basic information and historical transaction behavior includes: performing feature extraction on the preprocessed historical customer information data and the historical transaction data to obtain a first feature sub-matrix, wherein the features of the historical transaction data include at least: transaction amount, source region, source account, target account, and whether it has been marked as an abnormal fund transfer transaction; performing feature extraction on the historical transaction behavior to obtain a second feature sub-matrix, wherein the features of the historical transaction behavior include at least: daily transaction frequency, weekly transaction frequency, monthly transaction frequency; determining the feature matrix based on the first feature sub-matrix and the second feature sub-matrix.

[0011] Optionally, the abnormal fund transfer identification method based on the decision tree model also includes: acquiring the latest customer information, transaction data and transaction behavior to obtain an updated transaction data set; and iteratively adjusting the model parameters and model depth of the target decision tree model based on the updated transaction data set.

[0012] Optionally, when the evaluation result indicates that the target transaction involves abnormal fund transfer, the step of outputting transaction warning information includes: intercepting or delaying the target transaction; after receiving the verification transaction information sent by the target client associated with the target transaction, verifying the legitimacy of the verification transaction information; when the legitimacy verification passes, releasing the interception process or delaying the transaction process; when the legitimacy verification fails, outputting a transaction termination instruction, and feeding back the transaction warning information to the target decision tree model, and updating the model parameters and model depth of the target decision tree model.

[0013] According to another aspect of an embodiment of the present invention, there is also provided an abnormal funds transfer identification device based on a decision tree model, comprising: a transaction evaluation unit, used to input real-time transaction data corresponding to a target transaction into a preset target decision tree model, and the target decision tree model evaluates the transaction data and outputs an evaluation result of the target transaction, wherein the target decision tree model is based on historical customer information data and historical transaction data corresponding to historical financial transactions that have been identified as having abnormal funds transfers, and a decision tree model is obtained by model training using a decision tree algorithm; an alarm output unit, used to output transaction alarm information when the evaluation result indicates that the target transaction involves abnormal funds transfer.

[0014] Optionally, when training the target decision tree model, the abnormal funds transfer identification device based on the decision tree model includes: a transaction data acquisition unit, used to acquire historical customer information data and historical transaction data corresponding to historical financial transactions identified as abnormal funds transfers; a data preprocessing unit, used to preprocess the historical customer information data and the historical transaction data; an identification extraction unit, used to extract the historical transaction behavior and the abnormal funds transfer identification of the preprocessed historical transaction data; a model training unit, used to determine the feature matrix based on the preprocessed historical customer basic information and historical transaction behavior, use the abnormal funds transfer transaction identification as the target vector, and use the decision tree algorithm to perform model training to obtain the target decision tree model.

[0015] Optionally, the transaction data acquisition unit includes: an information acquisition module, used to obtain the registration information, financial identity information, and identity maintenance information of customers who have been identified as abnormal funds transfer transactions in the financial transaction platform, and obtain historical customer information data; a transaction data acquisition module, used to obtain daily data, weekly data, and monthly data of customers who have been identified as abnormal funds transfer transactions in the financial transaction platform, and obtain the historical transaction data.

[0016] Optionally, the data preprocessing unit includes: a cleaning module, used to perform cleaning operations on the historical customer information data and the historical transaction data, wherein the cleaning operations include: supplementing missing data, converting data with negative transaction amounts to positive amounts, unifying dictionary values, and eliminating data that is still empty after supplementation of customer key elements.

[0017] Optionally, the model training unit includes: a first feature extraction module, used to perform feature extraction on the preprocessed historical customer information data and the historical transaction data to obtain a first feature sub-matrix, wherein the features of the historical transaction data include at least: transaction amount, source region, source account, target account, and an indication of whether the transaction has been marked as an abnormal fund transfer transaction; a second feature extraction module, used to perform feature extraction on the historical transaction behavior to obtain a second feature sub-matrix, wherein the features of the historical transaction behavior include at least: daily transaction frequency, weekly transaction frequency, monthly transaction frequency; a feature matrix determination module, used to determine the feature matrix based on the first feature sub-matrix and the second feature sub-matrix.

[0018] Optionally, the abnormal funds transfer identification device based on the decision tree model also includes: a transaction data acquisition unit, used to acquire the latest customer information, transaction data and transaction behavior to obtain an updated transaction data set; and a model adjustment unit, used to iteratively adjust the model parameters and model depth of the target decision tree model based on the updated transaction data set.

[0019] Optionally, the alarm output unit includes: an interception module, which is used to intercept or delay the target transaction; a verification module, which is used to verify the legitimacy of the verification transaction information after receiving the verification transaction information sent by the target client associated with the target transaction; a release module, which is used to release the interception or delay the transaction if the legitimacy verification passes; a transaction termination module, which is used to output a transaction termination instruction if the legitimacy verification fails, and feed back the transaction alarm information to the target decision tree model to update the model parameters and model depth of the target decision tree model.

[0020] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned abnormal funds transfer identification methods based on the decision tree model.

[0021] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned abnormal funds transfer identification methods based on a decision tree model.

[0022] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including a computer program, which, when executed by a processor, implements the steps of any one of the above-mentioned methods for identifying abnormal fund transfers based on a decision tree model.

[0023] In the present disclosure, real-time transaction data corresponding to a target transaction is input into a preset target decision tree model, which evaluates the transaction data and outputs an evaluation result of the target transaction, wherein the target decision tree model is based on historical customer information data and historical transaction data corresponding to historical financial transactions that have been identified as abnormal fund transfers, and a decision tree algorithm is used to perform model training to obtain a target decision tree model, and when the evaluation result indicates that the target transaction involves abnormal fund transfers, a transaction alarm message is output.

[0024] Based on the above-mentioned public content, a decision tree model can be used to evaluate each financial transaction in real time and give evaluation results, immediately issue early warnings for suspicious transactions, greatly reduce the lag of early warnings, enhance the real-time response capabilities of financial institutions to illegal capital flows, and improve resource utilization efficiency, thereby solving the technical problem in related technologies that the capital monitoring system has a lag in the control of abnormal capital transfer behaviors, affecting the security of financial transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing an abnormal funds transfer identification method based on a decision tree model is shown;

[0027] Figure 2 is a flow chart of an optional abnormal funds transfer identification method based on a decision tree model according to an embodiment of the present invention;

[0028] Figure 3 It is an optional method for implementing transaction warning processing based on a suspicious warning model according to an embodiment of the present invention;

[0029] Figure 4is a schematic diagram of an optional abnormal funds transfer identification device based on a decision tree model according to an embodiment of the present invention;

[0030] Figure 5 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] To facilitate those skilled in the art to understand the present invention, some terms or nouns involved in the embodiments of the present invention are explained below:

[0034] The decision tree algorithm, a method of approximating the value of a discrete function, processes the data, generates readable rules and decision trees using an inductive algorithm, and then uses the decision tree to analyze the data. In the present invention, real-time transaction data is input into an early warning model based on a decision tree algorithm and evaluated according to the predefined rules in the decision tree. If the evaluation result indicates that the transaction may have the risk of illegal fund transactions, the model will immediately output an early warning signal, triggering a real-time early warning mechanism.

[0035] It should be noted that the abnormal fund transfer identification method and device based on the decision tree model in the present disclosure can be used in the field of big data technology. When real-time evaluation of abnormal fund transfer transactions is achieved based on the decision tree algorithm, it can also be used in any field other than the field of big data technology. When real-time evaluation of abnormal fund transfer transactions is achieved based on the decision tree algorithm, the present disclosure does not limit the application field of the abnormal fund transfer identification method and device based on the decision tree model.

[0036] It should be noted that the information (including but not limited to customer information stored by financial institutions, user device information, user personal information, etc.) and data (including but not limited to: transaction data, transaction behavior data, account data, stored data, displayed data, etc.) collected by this disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or institution.

[0037] It should be noted that in the present disclosure, when collecting and analyzing customer information, corresponding operation entrances are provided for users to choose to agree or reject the automated decision results; if the user chooses to reject, the expert decision-making process is entered.

[0038] The following embodiments of the present invention can be applied to various systems / applications / devices for identifying abnormal fund transfers based on decision tree models. The present invention can be applied to real-time transaction monitoring scenarios of financial institutions such as banks, securities, and insurance, and can analyze the characteristics of each transaction in real time, including but not limited to transaction amount, transaction frequency, transaction time, transaction location, account information of both parties to the transaction, etc. Through the rapid calculation of the decision tree model, the abnormal fund transfer risk assessment of the transaction is immediately given, so that potential abnormal fund flows can be identified at the same time as the transaction occurs, and instant warning can be achieved.

[0039] At the same time, the present invention can also be applied to cross-border payment and clearing services. The present invention can effectively identify high-risk cross-border transactions, especially those involving areas with high incidence of abnormal fund transfers. By quickly analyzing real-time transaction data, the system can immediately determine whether the transaction requires further manual review or direct interception, providing guarantees for the compliance and security of cross-border business. In addition, in a big data environment, the amount of transaction data processed by financial institutions every day is huge. The real-time early warning method provided by the present invention can quickly screen out suspicious transactions in massive data, avoiding the inefficiency of traditional methods that require batch processing of all transactions. The high efficiency of the decision tree algorithm enables it to process large-scale data sets while maintaining a high early warning speed and accuracy.

[0040] The present invention is described in detail below in conjunction with various embodiments.

[0041] Embodiment 1

[0042] According to an embodiment of the present invention, an embodiment of a method for identifying abnormal fund transfers based on a decision tree model is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0043] The abnormal funds transfer identification method embodiment based on the decision tree model provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing an abnormal funds transfer identification method based on a decision tree model is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more ( Figure 1 The computer system includes a processor 102 (the processor 102 may include but is not limited to a microcontroller unit (MCU) or a field programmable gate array (FPGA)), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, the computer system may include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS), a network interface, a power supply and / or a camera. A person skilled in the art can understand that Figure 1The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0044] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0045] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal funds transfer identification method based on the decision tree model in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the abnormal funds transfer identification method based on the decision tree model is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0046] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0047] The display may be, for example, a touch screen liquid crystal display (LCD), which enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0048] Under the above operating environment, this application provides Figure 2 The abnormal fund transfer identification method based on the decision tree model is shown. Figure 2 is a flow chart of an optional abnormal funds transfer identification method based on a decision tree model according to an embodiment of the present invention, such as Figure 2 As shown, the method comprises the following steps:

[0049] Step S201, input the real-time transaction data corresponding to the target transaction into a preset target decision tree model, and the target decision tree model evaluates the transaction data and outputs the evaluation result of the target transaction, wherein the target decision tree model is based on the historical customer information data and historical transaction data corresponding to the historical financial transactions that have been identified as having abnormal funds transfers, and the decision tree model is obtained by model training using a decision tree algorithm.

[0050] When a financial transaction occurs, the system will immediately capture the real-time data of the target transaction from the transaction flow, including but not limited to the transaction amount, transaction time, account information of both parties, transaction location, etc., and then extract the key features in the real-time transaction data and perform necessary data conversion to match the input format of the target decision tree model. For example, if the model requires numerical input, non-numerical features (such as transaction location) will be converted into numerical features through one-hot encoding or other encoding methods.

[0051] The preprocessed real-time transaction data is input into the preset target decision tree model, which is trained on historical customer information data and historical transaction data. The historical data contains transaction samples that have been identified as abnormal fund transfers. These samples are used to construct branches of the decision tree. Each branch represents a transaction pattern or the relationship between customer behavior and the risk of abnormal fund transfer. The target decision tree model will evaluate the input real-time transaction data and calculate the possibility that the target transaction involves abnormal fund transfer according to the rules learned in the model. The evaluation process may involve step-by-step judgment of features until the leaf node of the decision tree. The category given by the node is the evaluation result. The model will output the evaluation result of the target transaction, which is usually given in the form of probability, indicating the possibility that the transaction involves abnormal fund transfer. If the probability exceeds the preset threshold, such as 80%, it is considered that the evaluation result indicates that the transaction may involve abnormal fund transfer.

[0052] Optionally, the target decision tree model is trained in the following manner: obtaining historical customer information data and historical transaction data corresponding to historical financial transactions identified as abnormal fund transfers; preprocessing the historical customer information data and historical transaction data; extracting historical transaction behaviors and abnormal fund transfer identifiers from the preprocessed historical transaction data; determining a feature matrix based on the preprocessed historical customer basic information and historical transaction behaviors, taking the abnormal fund transfer transaction identifier as the target vector, and using a decision tree algorithm to perform model training to obtain a target decision tree model.

[0053] Among them, the step of obtaining historical customer information data and historical transaction data corresponding to historical financial transactions that have been identified as having abnormal fund transfers includes: obtaining the registration information, financial identity information, and identity maintenance information of customers who have been identified as having abnormal fund transfer transactions in the financial transaction platform to obtain historical customer information data; obtaining daily, weekly, and monthly data of transactions that have been identified as abnormal fund transfer transactions in the financial transaction platform to obtain historical transaction data.

[0054] Customer information identified as being involved in abnormal fund transfer transactions is extracted from the database of the financial institution, including but not limited to the customer's basic information (such as name, ID type, ID number), contact information (telephone, address), and occupational information; financial identity information, which usually refers to information related to the customer's bank account, such as account type, opening bank, account number, etc.; and customer identity maintenance information, which is information updated by the customer during the use of the service, such as address changes, occupation changes, etc.

[0055] In addition to customer information, it is also necessary to collect historical transaction data that has been confirmed as abnormal fund transfers, covering transaction amount, time, location, account information of both parties to the transaction, transaction frequency, etc. Historical transaction data not only includes the details of a single transaction, but also covers the customer's transaction behavior in a specific time period, such as daily cut (daily settlement), weekly cut (weekly settlement) and monthly cut (monthly settlement) data, which provide a time series perspective on customer transaction patterns. The collection of historical transaction data should include key elements such as transaction amount, transaction time, transaction location, account information of both parties to the transaction, and other details related to the transaction that may affect the risk of illegal fund transactions. For example, whether the transaction is conducted outside business hours, whether the transaction occurs frequently in a specific area, whether the transaction amount frequently appears in certain specific values, etc.

[0056] Optionally, the step of preprocessing the historical customer information data and the historical transaction data includes: performing a cleaning operation on the historical customer information data and the historical transaction data, wherein the cleaning operation includes: supplementing missing data, converting data with negative transaction amounts to positive amounts, unifying dictionary values, and eliminating data that is still empty after supplementation of customer key elements.

[0057] In the historical customer information and transaction data collected, some records may contain missing values, such as the customer's phone number, transaction amount, etc. These missing values ​​need to be supplemented in the preprocessing stage. For customer information, you can try to supplement it through other channels (such as public databases, information provided by customers later, etc.); for numerical missing data such as transaction amounts, you can adopt methods such as average filling, median filling, or prediction filling based on other features. In transaction data, negative transaction amounts sometimes appear, which may be due to refunds, account errors, or other system problems. However, when training the model, it is important to maintain the consistency of transaction data, so all negative transaction amounts need to be converted to positive numbers, and the corresponding debit and credit signs need to be adjusted to ensure the logic of the data and the correctness of the model training.

[0058] In customer information and transaction data, there may be different codes or classifications to represent the same information (for example, different codes represent the same region). In order for the model to accurately understand and process this information, it is necessary to unify the dictionary values, that is, to ensure that all categorical variables use consistent codes or labels. Therefore, features related to abnormal fund transfers are extracted from the preprocessed data, and categorical features are encoded, such as using one-hot encoding to process non-numeric features such as region and account type, to ensure that the model can correctly process and analyze.

[0059] Key elements of customer identification such as name, ID type, ID number, etc. are the points that must be paid attention to in data cleaning. If the key elements of some customer records are still missing after supplementation (such as the ID number cannot be obtained), these records may not be used to effectively train the model, so they need to be removed in the preprocessing stage to avoid interference with model training or causing erroneous prediction results.

[0060] Optionally, the step of determining a feature matrix based on preprocessed historical customer basic information and historical transaction behavior includes: performing feature extraction on the preprocessed historical customer information data and historical transaction data to obtain a first feature sub-matrix, wherein the features of the historical transaction data include at least: transaction amount, source region, source account, target account, and whether it has been marked as an abnormal fund transfer transaction; performing feature extraction on the historical transaction behavior to obtain a second feature sub-matrix, wherein the features of the historical transaction behavior include at least: daily transaction frequency, weekly transaction frequency, monthly transaction frequency; and determining a feature matrix based on the first feature sub-matrix and the second feature sub-matrix.

[0061] Among them, the first feature submatrix mainly contains the features directly related to the historical customer basic information and historical transaction data. Here, the features that need to be extracted may include: Transaction amount: The total amount of the transaction is an important indicator for assessing the risk of abnormal fund transfer. Large transactions, abnormal amounts, and significant deviations from the customer's historical transaction pattern may indicate abnormal fund transfer activities. Source region: The geographical location where the transaction occurs, especially the source of cross-border transactions, can help identify high-risk areas or abnormal fund transfer channels. Source account and target account: Account information, including account ID, account type, etc., can reveal the correlation between accounts, especially if an account is frequently involved in suspicious transactions, or is related to a known abnormal fund transfer account, which should be used as an important feature. Whether to mark as abnormal fund transfer: used to indicate whether a transaction has been confirmed as an abnormal fund transfer. This label is used as the target of model training to help the decision tree learn the rules for distinguishing normal transactions from illegal transactions.

[0062] The second feature submatrix focuses on the behavioral patterns of historical transactions, including daily, weekly, and monthly transaction frequencies. The feature extraction of transaction frequencies helps to discover abnormal transaction patterns, such as: Daily transaction frequency: the number of transactions in a day, which can help identify frequent and potentially unusual trading behaviors. Weekly transaction frequency: the number of transactions in a week, which is used to evaluate customers' trading activities over a longer period of time and identify whether there are specific, periodic abnormal fund transfer behaviors. Monthly transaction frequency: the number of transactions in a month, a broader observation of customer trading patterns, helps to discover long-term, hidden abnormal fund transfer activities.

[0063] Based on the first feature sub-matrix (basic customer information + specific transaction features) and the second feature sub-matrix (historical transaction behavior features), the final feature matrix is ​​determined. The construction of the feature matrix requires integrating the data of the two sub-matrices to ensure that the characteristics of each transaction are complete and correctly mapped to the corresponding customer information.

[0064] It should be noted that during feature processing, non-numeric features (e.g., source region, account type) are converted to one-hot encoding so that the model can process them. Feature conversion also includes possible standardization or normalization of continuous features (e.g., transaction amount) to ensure that all features are on the same scale and avoid a single feature having too much influence on the model decision.

[0065] When constructing the feature matrix, it is necessary to check again whether there are any missing eigenvalues ​​and adopt appropriate strategies to fill or process them. Not all extracted features have a positive impact on model training. Some features may contain redundant information or be irrelevant to abnormal fund transfers. The feature selection step can help the model remove unnecessary features, reduce the risk of overfitting, and improve prediction performance.

[0066] Using the preprocessed feature matrix as input and the target vector as output, the decision tree algorithm is applied to train the model. The decision tree algorithm can select the best features and split points by calculating the entropy or Gini impurity of the features, and gradually build a decision tree that can distinguish abnormal fund transfers from normal transactions. The training process may include parameter tuning, such as the depth of the tree, the minimum number of samples for node splitting, etc., to ensure the accuracy and generalization ability of the model. After the model training is completed, the model is evaluated using independent test set data to check the model's accuracy, precision, recall and other indicators. Based on the evaluation results, it may be necessary to return to the preprocessing step or the model training step to adjust the feature selection, data cleaning strategy or decision tree parameters to further optimize the model performance.

[0067] The trained target decision tree model is then applied to real-time transaction data. By evaluating the characteristics of each real-time transaction, a prediction of whether the transaction may involve abnormal fund transfer is immediately output. New cases identified as abnormal fund transfers are regularly collected, historical data sets are updated, and the model is retrained to adapt to the changing financial transaction patterns and ensure the long-term effectiveness of the model.

[0068] Step S202: When the evaluation result indicates that the target transaction involves abnormal fund transfer, output transaction warning information.

[0069] This embodiment can automatically generate warning information, which may include detailed information of the target transaction, such as transaction ID, account information of both parties, transaction time, transaction amount, etc., as well as the risk level of abnormal fund transfer shown in the evaluation results and the specific characteristics or rules that trigger the warning. The warning information will be automatically sent to the fund transfer compliance department of the financial institution or the department responsible for real-time monitoring, combined with additional customer information, transaction background or other relevant evidence to confirm whether the transaction does involve abnormal fund transfer.

[0070] Optionally, the abnormal fund transfer identification method based on the decision tree model also includes: acquiring the latest customer information, transaction data and transaction behavior to obtain an updated transaction data set; iteratively adjusting the model parameters and model depth of the target decision tree model based on the updated transaction data set.

[0071] The system obtains the latest customer information, transaction data and transaction behavior from the financial transaction platform regularly or in real time to form an updated transaction data set. This includes the customer's latest registration information, financial identity information, identity maintenance information, as well as recent transaction records and transaction frequency data. The newly acquired transaction data is preprocessed, including data cleaning, missing value filling, feature encoding, etc., to ensure that the data quality and format are consistent with the historical data set used for model training. Then, feature extraction is performed on the updated customer information and transaction data to obtain a feature matrix similar to the historical data set. Based on the updated transaction data set, the target decision tree model is iteratively trained, and model parameters (such as the maximum depth of the tree, the minimum number of samples for node splitting, etc.) and model depth are adjusted to optimize the accuracy and adaptability of the model. Model iteration may involve parameter tuning using methods such as cross-validation and grid search to ensure that the model can not only accurately predict known abnormal fund transfers, but also effectively identify emerging abnormal fund transfer patterns.

[0072] Optionally, when the evaluation result indicates that the target transaction involves abnormal fund transfer, the step of outputting transaction alarm information includes: intercepting or delaying the target transaction; after receiving the verification transaction information sent by the target client associated with the target transaction, verifying the legitimacy of the verification transaction information; if the legitimacy verification passes, releasing the interception process or delaying the transaction processing; if the legitimacy verification fails, outputting a transaction termination instruction, and feeding back the transaction alarm information to the target decision tree model, and updating the model parameters and model depth of the target decision tree model.

[0073] When the decision tree model evaluation results indicate that a target transaction involves an abnormal fund transfer, the system automatically intercepts or delays the target transaction to prevent potential illegal fund flows and allow time for subsequent legitimacy verification. The system sends a verification request to the target client associated with the target transaction, requesting additional transaction information or supporting documents to verify the legitimacy of the transaction. This may include the purpose of the transaction, source of funds, identity proof of the account owner, etc.

[0074] After receiving the verification transaction information from the target client, the legality verification is carried out, which may be carried out through manual review, re-model evaluation or other compliance inspection processes. If the legality verification passes, the system will release the interception or delay processing of the target transaction and allow the transaction to proceed normally. If the verification fails, the system will output a transaction termination instruction to prevent the transaction from being completed. Transaction data that fails the legality verification will be fed back to the decision tree model for updating model parameters and adjusting model depth. This helps the model learn the latest abnormal fund transfer behavior characteristics and improve the accuracy of future warnings.

[0075] Through the above steps, the real-time transaction data corresponding to the target transaction can be input into the preset target decision tree model, and the target decision tree model evaluates the transaction data and outputs the evaluation result of the target transaction, wherein the target decision tree model is based on the historical customer information data and historical transaction data corresponding to the historical financial transactions that have been identified as abnormal fund transfers, and the decision tree algorithm is used to train the model to obtain the target decision tree model, and when the evaluation result indicates that the target transaction involves abnormal fund transfer, the transaction warning information is output. In this embodiment, the decision tree model can be used to evaluate each financial transaction in real time and give the evaluation result, and immediately warn of suspicious transactions, which greatly reduces the lag of the warning, enhances the real-time response capability of financial institutions to illegal fund flows, and improves resource utilization efficiency, thereby solving the technical problem that the fund monitoring system in the related technology has a lag in the control of abnormal fund transfer behavior, which affects the security of financial transactions.

[0076] Another optional specific implementation is described in detail below.

[0077] Figure 3 is an optional method for implementing transaction warning processing based on a suspicious warning model according to an embodiment of the present invention, such as Figure 3 As shown, including:

[0078] First, using the suspicious customers and their transaction information, a warning model is trained to predict real-time transactions, which is run by the server and includes:

[0079] like Figure 3 As shown, it is necessary to first obtain suspicious data, including: obtaining customer information data that has been identified as suspicious, to obtain data source 1; obtaining transaction information data of customers that have been identified as suspicious, to obtain data source 2; based on data source 1 and data source 2, using a decision tree algorithm, training to obtain an early warning model; and using the early warning model to identify early warnings for real-time transactions;

[0080] Data source 1 includes but is not limited to banks, securities and other trading platforms that require the submission of abnormal fund transfer identification information. Customers need to obtain the latest basic information of customers when registering or maintaining information. Data source 2 includes but is not limited to banks, securities and other trading platforms that require the submission of abnormal fund transfer identification information. The latest transaction data of customers (transaction amount, transaction time, transaction location, account flow, etc.) is obtained daily.

[0081] Combined with the first aspect, customer information includes: three elements of the customer, name, evidence type, ID number, customer phone number, address, occupation and other main information.

[0082] In combination with the first aspect, customer transaction data includes: transaction log table and account table.

[0083] In combination with the first aspect, the early warning model information obtained by training the decision tree algorithm includes: a suspicious early warning model table.

[0084] The present invention uses a decision tree algorithm to train a customer suspicious early warning model based on basic customer information and customer transaction behaviors that have been identified as suspicious, which is used for real-time transaction management and control.

[0085] like Figure 3 As shown, after collecting customer data, data preprocessing can be performed to confirm the feature matrix and target vector (marking whether it is an abnormal fund transfer transaction (such as setting 1 for an abnormal fund transfer transaction and 0 for not an abnormal fund transfer transaction)).

[0086] Among them, customer data can include basic customer information, customer basic transactions and other related data. The original data is cleaned, denoised and feature extracted to obtain a feature matrix suitable for model input. Data preprocessing methods include: data cleaning and denoising, such as supplementing basic customer information, converting negative transaction amounts to positive amounts and converting loan signs to loan, as well as unifying dictionary values, and finally eliminating data that is still empty after the three elements of the customer are supplemented, resulting in the inability to monitor people, involving processing missing values, outliers, data conversion, feature combination and other operations.

[0087] Then use the decision tree algorithm to train the data.

[0088] #Suppose there is some transaction data, including features such as amount and source region, for example:

[0089] data={

[0090] 'amount':[10000,500000,2000000,150000,300000];

[0091] 'country':['USA','China','Russia','USA','Brazil'];

[0092] 'source_account':['A123','B456','C789','A123','D012'];

[0093] 'destination_account':['X999','Y888','X999','B456','E777'];

[0094] 'is_money_laundering':[0,1,1,0,0]#Mark which transactions are abnormal fund transfer transactions};

[0095] df = pd.DataFrame(data);

[0096] #Create feature matrix X and target vector y;

[0097] X=df[['amount','country','source_account','destination_account']];

[0098] y=df['is_money_laundering'];

[0099] #Encode categorical features;

[0100] X_encoded=pd.get_dummies(X);

[0101] #Train decision tree model;

[0102] clf=tree.DecisionTreeClassifier();

[0103] clf = clf.fit(X_encoded,y).

[0104] Next, we will use the trained decision tree model to explain how the model evaluates financial transaction data.

[0105] Use the model to make predictions, for example, new input transaction data includes:

[0106] new_transaction = [[250000,'China','F555','G666']] #New transaction data;

[0107] new_transaction_encoded=pd.get_dummies(pd.DataFrame(new_transaction,columns=X.columns));

[0108] prediction=clf.predict(new_transaction_encoded);

[0109] print(prediction)#Output: [1] indicates that this transaction is classified as an abnormal fund transfer transaction.

[0110] Among them, X in the feature matrix includes the transaction amount, transaction region, source account and target account, and the target vector Y is whether it is an abnormal fund transfer transaction (1 is an abnormal fund transfer transaction, 0 is not an abnormal fund transfer transaction).

[0111] It should be noted that the training data used in this embodiment can start with a week of suspicious transactions, and set a relatively small tree depth at the beginning, and then expand to a month, a quarter, and a year of transaction volume. In repeated training, the model is verified using historical real data to obtain a suitable model depth.

[0112] The implementation mode of the present invention is based on the monitoring results of the current anti-abnormal fund transfer monitoring system. Through the decision tree algorithm, combined with the customer information and transaction data of the customers who have been identified as suspicious customers, a usable early warning model is trained for early warning of real-time transaction data. The customer's basic information and characteristic data in the transaction information are transmitted to the real-time prediction platform. The platform returns the early warning value and intercepts the data identified as "yes", which can greatly improve the early warning time for abnormal fund transfer behavior.

[0113] The following is a detailed description in conjunction with another embodiment.

[0114] Embodiment 2

[0115] An abnormal fund transfer identification device based on a decision tree model provided in this embodiment includes multiple implementation units, each implementation unit corresponds to each implementation step in the above-mentioned embodiment 1. Its specific implementation methods and beneficial effects can refer to the above-mentioned method embodiments and will not be repeated here.

[0116] Figure 4 is a schematic diagram of an optional abnormal funds transfer identification device based on a decision tree model according to an embodiment of the present invention, such as Figure 4 As shown, the abnormal fund transfer identification device based on the decision tree model may include: a transaction evaluation unit 41 and an alarm output unit 42.

[0117] Among them, the transaction evaluation unit 41 is used to input the real-time transaction data corresponding to the target transaction into a preset target decision tree model, and the target decision tree model evaluates the transaction data and outputs the evaluation result of the target transaction, wherein the target decision tree model is based on the historical customer information data and historical transaction data corresponding to the historical financial transactions that have been identified as abnormal fund transfers, and the decision tree model is obtained by model training using a decision tree algorithm.

[0118] The alarm output unit 42 is used to output transaction alarm information when the evaluation result indicates that the target transaction involves abnormal fund transfer.

[0119] The above-mentioned abnormal fund transfer identification device based on the decision tree model can input the real-time transaction data corresponding to the target transaction into the preset target decision tree model through the transaction evaluation unit 41, and the target decision tree model evaluates the transaction data and outputs the evaluation result of the target transaction, wherein the target decision tree model is based on the historical customer information data and historical transaction data corresponding to the historical financial transactions that have been identified as abnormal fund transfers, and the model is trained using the decision tree algorithm to obtain the target decision tree model, and the alarm output unit 42 outputs the transaction alarm information when the evaluation result indicates that the target transaction involves abnormal fund transfer. In this embodiment, the decision tree model can be used to evaluate each financial transaction in real time and give the evaluation result, and immediately warn of suspicious transactions, which greatly reduces the lag of the warning, enhances the real-time response capability of financial institutions to illegal fund flows, and improves the efficiency of resource utilization, thereby solving the technical problem that the fund monitoring system in the related technology has a lag in the control of abnormal fund transfer behavior, which affects the security of financial transactions.

[0120] Optionally, when training a target decision tree model, the abnormal funds transfer identification device based on a decision tree model includes: a transaction data acquisition unit, used to acquire historical customer information data and historical transaction data corresponding to historical financial transactions that have been identified as abnormal funds transfers; a data preprocessing unit, used to preprocess the historical customer information data and historical transaction data; an identification extraction unit, used to extract historical transaction behaviors and abnormal funds transfer identifications from the preprocessed historical transaction data; and a model training unit, used to determine a feature matrix based on the preprocessed historical customer basic information and historical transaction behaviors, use the abnormal funds transfer transaction identification as the target vector, and use a decision tree algorithm to perform model training to obtain a target decision tree model.

[0121] Optionally, the transaction data acquisition unit includes: an information acquisition module, used to obtain the registration information, financial identity information, and identity maintenance information of customers who have been identified as abnormal funds transfer transactions in the financial transaction platform, and obtain historical customer information data; a transaction data acquisition module, used to obtain daily data, weekly data, and monthly data of customers who have been identified as abnormal funds transfer transactions in the financial transaction platform, and obtain historical transaction data.

[0122] Optionally, the data preprocessing unit includes: a cleaning module for performing cleaning operations on historical customer information data and historical transaction data, wherein the cleaning operations include: supplementing missing data, converting data with negative transaction amounts to positive amounts, unifying dictionary values, and eliminating data that is still empty after supplementation of customer key elements.

[0123] Optionally, the model training unit includes: a first feature extraction module, used to extract features from preprocessed historical customer information data and historical transaction data to obtain a first feature sub-matrix, wherein the features of the historical transaction data include at least: transaction amount, source region, source account, target account, and an indication of whether the transaction has been marked as an abnormal fund transfer transaction; a second feature extraction module, used to extract features from historical transaction behaviors to obtain a second feature sub-matrix, wherein the features of historical transaction behaviors include at least: daily transaction frequency, weekly transaction frequency, monthly transaction frequency; a feature matrix determination module, used to determine the feature matrix based on the first feature sub-matrix and the second feature sub-matrix.

[0124] Optionally, the abnormal funds transfer identification device based on the decision tree model also includes: a transaction data acquisition unit, used to acquire the latest customer information, transaction data and transaction behavior to obtain an updated transaction data set; and a model adjustment unit, used to iteratively adjust the model parameters and model depth of the target decision tree model based on the updated transaction data set.

[0125] Optionally, the alarm output unit includes: an interception module, which is used to intercept or delay the target transaction; a verification module, which is used to verify the legitimacy of the verification transaction information after receiving the verification transaction information sent by the target client associated with the target transaction; a release module, which is used to release the interception or delay the transaction if the legitimacy verification passes; a transaction termination module, which is used to output a transaction termination instruction if the legitimacy verification fails, and feed back the transaction alarm information to the target decision tree model to update the model parameters and model depth of the target decision tree model.

[0126] The abnormal funds transfer identification device based on the decision tree model may also include a processor and a memory. The transaction evaluation unit 41, the alarm output unit 42, etc. are stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions.

[0127] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the detection and early warning of abnormal fund transfer behavior can be realized based on the decision tree algorithm by adjusting the kernel parameters.

[0128] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0129] Embodiment 3

[0130] An embodiment of the present application may provide an electronic device, Figure 5 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (only one is shown) processor 502, memory 504, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0131] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the abnormal funds transfer identification method and device based on the decision tree model in the embodiment of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned abnormal funds transfer identification method based on the decision tree model. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0132] The processor can call the information and application programs stored in the memory through the transmission device to perform the following steps: input the real-time transaction data corresponding to the target transaction into a preset target decision tree model, and the target decision tree model evaluates the transaction data and outputs the evaluation result of the target transaction, wherein the target decision tree model is based on the historical customer information data and historical transaction data corresponding to the historical financial transactions that have been identified as abnormal funds transfers, and the model is trained using a decision tree algorithm to obtain the target decision tree model; when the evaluation result indicates that the target transaction involves abnormal funds transfer, the transaction alarm information is output.

[0133] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: when training the target decision tree model: obtain historical customer information data and historical transaction data corresponding to historical financial transactions that have been identified as abnormal fund transfers; preprocess the historical customer information data and historical transaction data; extract the historical transaction behavior and abnormal fund transfer identification of the preprocessed historical transaction data; determine the feature matrix based on the preprocessed historical customer basic information and historical transaction behavior, use the abnormal fund transfer transaction identification as the target vector, and use the decision tree algorithm to train the model to obtain the target decision tree model.

[0134] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: obtain the registration information, financial identity information, and identity maintenance information of customers who have been identified as abnormal fund transfer transactions in the financial transaction platform to obtain historical customer information data; obtain the daily, weekly, and monthly data of customers who have been identified as abnormal fund transfer transactions in the financial transaction platform to obtain historical transaction data.

[0135] The processor can also call the information and applications stored in the memory through the transmission device to execute the following steps: clean the historical customer information data and historical transaction data, wherein the cleaning operations include: supplementing missing data, converting data with negative transaction amounts to positive amounts, unifying dictionary values, and eliminating data that is still empty after supplementing customer key elements.

[0136] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: extract features from the preprocessed historical customer information data and historical transaction data to obtain a first feature sub-matrix, wherein the features of the historical transaction data include at least: transaction amount, source region, source account, target account, and whether it has been marked as an abnormal fund transfer transaction; extract features from the historical transaction behavior to obtain a second feature sub-matrix, wherein the features of the historical transaction behavior include at least: daily transaction frequency, weekly transaction frequency, and monthly transaction frequency; determine the feature matrix based on the first feature sub-matrix and the second feature sub-matrix.

[0137] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: obtain the latest customer information, transaction data and transaction behavior to obtain an updated transaction data set; iteratively adjust the model parameters and model depth of the target decision tree model based on the updated transaction data set.

[0138] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: intercept or delay the target transaction; after receiving the verification transaction information sent by the target client associated with the target transaction, verify the legitimacy of the verification transaction information; if the legitimacy verification passes, release the interception process or delay the transaction processing; if the legitimacy verification fails, output a transaction termination instruction, and feed back the transaction alarm information to the target decision tree model, and update the model parameters and model depth of the target decision tree model.

[0139] It can be understood by those skilled in the art that Figure 5 The structure shown is for illustration only, and the electronic device may also be a smart phone, a tablet computer, a PDA, a mobile Internet device (MID), a PAD or other terminal device. Figure 5 The structure of the electronic device is not limited. Figure 5 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 5 Different configurations shown.

[0140] A person skilled in the art can understand that all or part of the steps in the various abnormal fund transfer identification methods based on the decision tree model in the above-mentioned embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium can include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0141] Embodiment 4

[0142] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the abnormal fund transfer identification method based on the decision tree model provided in the first embodiment.

[0143] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the abnormal funds transfer identification methods based on the decision tree model in the above-mentioned embodiment 1.

[0144] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0145] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the abnormal funds transfer identification method based on the decision tree model described in each embodiment of the present application.

[0146] The present application also provides a computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the abnormal funds transfer identification method based on the decision tree model described in each embodiment of the present application are implemented.

[0147] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0148] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0149] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0150] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0151] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0152] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0153] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for identifying abnormal fund transfer based on a decision tree model, characterized in that: include: Inputting the real-time transaction data corresponding to the target transaction into a preset target decision tree model, the target decision tree model evaluates the transaction data, and outputs an evaluation result of the target transaction, wherein the target decision tree model is a decision tree model obtained by training the model using a decision tree algorithm based on the historical customer information data and historical transaction data corresponding to the historical financial transactions identified as having abnormal fund transfers; When the evaluation result indicates that the target transaction involves abnormal fund transfer, transaction warning information is output.

2. The identification method according to claim 1, characterized in that: The target decision tree model is trained in the following way: Obtain historical customer information data and historical transaction data corresponding to historical financial transactions that have been identified as having abnormal fund transfers; Preprocessing the historical customer information data and the historical transaction data; Extracting historical transaction behaviors and abnormal fund transfer identifiers from the pre-processed historical transaction data; A feature matrix is ​​determined based on the preprocessed historical customer basic information and historical transaction behavior, and the abnormal fund transfer transaction identifier is used as the target vector. A decision tree algorithm is used for model training to obtain the target decision tree model.

3. The identification method according to claim 2, characterized in that: The steps of obtaining historical customer information data and historical transaction data corresponding to historical financial transactions identified as abnormal fund transfers include: Obtain the registration information, financial identity information, and identity maintenance information of customers who have been identified as having abnormal fund transfer transactions on the financial trading platform, and obtain historical customer information data; The daily, weekly and monthly data of the transactions identified as abnormal fund transfers in the financial transaction platform are obtained to obtain the historical transaction data.

4. The identification method according to claim 2, characterized in that: The step of preprocessing the historical customer information data and the historical transaction data includes: The historical customer information data and the historical transaction data are cleansed, wherein the cleaning operation includes: supplementing missing data, converting data with negative transaction amounts to positive data, unifying dictionary values, and eliminating data that is still empty after supplementation of customer key elements.

5. The identification method according to claim 4, characterized in that: The step of determining a feature matrix based on the pre-processed historical customer basic information and historical transaction behavior includes: Performing feature extraction on the preprocessed historical customer information data and the historical transaction data to obtain a first feature sub-matrix, wherein the features of the historical transaction data at least include: transaction amount, source region, source account, target account, and an indicator of whether the transaction has been marked as an abnormal fund transfer transaction; Extracting features of the historical transaction behaviors to obtain a second feature submatrix, wherein the features of the historical transaction behaviors at least include: daily transaction frequency, weekly transaction frequency, and monthly transaction frequency; The characteristic matrix is ​​determined based on the first characteristic sub-matrix and the second characteristic sub-matrix.

6. The identification method according to claim 2, characterized in that: Also includes: Obtain the latest customer information, transaction data and transaction behavior, and obtain updated transaction data sets; The model parameters and model depth of the target decision tree model are iteratively adjusted based on the updated transaction data set.

7. The identification method according to claim 1, characterized in that: When the evaluation result indicates that the target transaction involves abnormal fund transfer, the step of outputting transaction warning information comprises: Intercepting or delaying the target transaction; After receiving the verification transaction information sent by the target client associated with the target transaction, verifying the legitimacy of the verification transaction information; If the legitimacy verification is passed, the blocking process will be lifted or the transaction processing will be delayed; In the case where the legality verification fails, a transaction termination instruction is output, and the transaction warning information is fed back to the target decision tree model to update the model parameters and model depth of the target decision tree model.

8. An abnormal funds transfer identification device based on a decision tree model, characterized in that: include: A transaction evaluation unit, used for inputting real-time transaction data corresponding to a target transaction into a preset target decision tree model, and having the target decision tree model evaluate the transaction data, and outputting an evaluation result of the target transaction, wherein the target decision tree model is a decision tree model obtained by model training using a decision tree algorithm based on historical customer information data and historical transaction data corresponding to historical financial transactions that have been identified as having abnormal fund transfers; The alarm output unit is used to output transaction alarm information when the evaluation result indicates that the target transaction involves abnormal fund transfer.

9. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the abnormal funds transfer identification method based on the decision tree model as described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the abnormal funds transfer identification method based on a decision tree model described in any one of claims 1 to 7 are implemented.

Images