Transaction early warning method and device, electronic equipment, medium and computer program product

Abstract

The invention provides a transaction early warning method and device, electronic equipment, a medium and a computer program product, and can be applied to the technical field of artificial intelligence. The method comprises the steps that authorization of a user to transaction information of a transaction account is acquired, and the transaction information comprises time sequence transaction data and risk attribute data; after authorization of the user on the transaction information is obtained, inputting the time sequence transaction data into a pre-constructed first risk prediction model to obtain a first risk prediction result; inputting the risk attribute data and the first risk prediction result into a pre-constructed second risk prediction model to obtain a second risk prediction result; and when the second prediction result is a high-risk transaction, sending out early warning prompt information. According to the invention, identification prevention and control measures of the high-risk transaction scene can be intelligently and accurately realized, the problems of repositioning and tracing after the risk occurs are avoided, and the remedy cost is reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence technology, and more specifically, to a transaction early warning method, device, electronic device, medium and computer program product. Background Art

[0002] With the continuous development of network applications, people are pursuing a life state of interconnectedness. The development of banking network systems is changing with each passing day, and the banking system is gradually developing in a smarter, faster and more efficient direction. At the same time, as a pillar industry of society, the importance of security is beyond doubt. In the field of financial risk control, by real-time monitoring and prediction of abnormal situations in financial data, potential risks can be discovered and handled in a timely manner to avoid the expansion of financial risks. These abnormal situations may include abnormal fluctuations in stock prices, sudden changes in trading volume, etc., which may indicate market instability or potential risks. The existing environment does not have clear identification and prevention measures for high-risk transaction scenarios. Once a problem occurs, the cost of relocating and tracing the cause of the problem is huge. Therefore, how to intelligently and accurately realize transaction warning has become a technical problem that technicians in this field need to solve urgently. Summary of the invention

[0003] In view of this, the present disclosure provides a transaction warning method, device, electronic device, computer-readable storage medium and computer program product for intelligently and accurately implementing transaction warning.

[0004] One aspect of the present disclosure provides a transaction early warning method, comprising: obtaining a user's authorization for transaction information of a transaction account, wherein the transaction information includes time-series transaction data and risk attribute data; after obtaining the user's authorization for the transaction information, inputting the time-series transaction data into a pre-built first risk prediction model to obtain a first risk prediction result; inputting the risk attribute data and the first risk prediction result into a pre-built second risk prediction model to obtain a second risk prediction result; and issuing an early warning prompt message when the second prediction result is a high-risk transaction.

[0005] According to the transaction early warning method of the embodiment of the present disclosure, by obtaining the transaction information of the transaction account authorized by the user, the transaction information includes time-series transaction data and risk attribute data; inputting the time-series transaction data into the pre-constructed first risk prediction model to obtain the first risk prediction result; inputting the risk attribute data and the first risk prediction result into the pre-constructed second risk prediction model to obtain the second risk prediction result; when the second prediction result is a high-risk transaction, issuing an early warning prompt information. The present disclosure can collect and analyze transaction information in real time, monitor the transaction information in real time, and promptly discover potential abnormal transactions, effectively improving the timeliness of risk prevention and control. Through the advanced time series analysis method (first risk prediction model), the time series characteristics of transaction behavior can be deeply excavated, and the transaction behavior that deviates from the routine can be accurately identified, reducing the possibility of false positives and false negatives. The second risk prediction model can comprehensively consider multiple risk factors (risk attribute data), quantitatively evaluate and predict transaction risks, and improve the comprehensiveness and accuracy of risk assessment. The present disclosure also has an early warning function. Once a high-risk transaction is predicted, it will immediately trigger an early warning feedback, so that the bank can take measures at the first time to avoid or reduce possible economic losses. Based on this, the present disclosure can intelligently and accurately implement identification and prevention measures for high-risk transaction scenarios, avoid re-positioning and tracing problems after risks occur, and reduce remediation costs.

[0006] In some embodiments, the time-series transaction data includes timestamp, transaction amount, transaction type and transaction status; and / or the risk attribute data includes historical transaction abnormality frequency, historical abnormal transaction amount for each transaction, historical abnormal transaction duration for each transaction, account credit rating, and historical default situations.

[0007] In some embodiments, the first risk prediction model is a model trained based on a long short-term memory network model, and / or the second risk prediction model is a model trained based on a random forest model.

[0008] In some embodiments, the step of pre-constructing a first risk prediction model includes: obtaining first training samples of m users, wherein each of the first training samples includes time-series transaction data of a trading account and a first risk marking result, and m is an integer greater than or equal to 1; inputting the m first training samples into a long short-term memory network model, training model parameters of the long short-term memory network model, and obtaining first model parameters; applying the first model parameters of the long short-term memory network model to obtain a first risk prediction model.

[0009] In some embodiments, after the step of inputting the m first training samples into the long short-term memory network model, training the model parameters of the long short-term memory network model, and obtaining the first model parameters, the step of pre-constructing the first risk prediction model also includes: obtaining n first verification samples, wherein each of the first verification samples includes the time series transaction data of a trading account and a first risk marking result, and n is an integer greater than or equal to 1; inputting the n first verification samples into the long short-term memory network model to which the first model parameters are applied to verify the first model parameters; if the verification passes, applying the first model parameters of the long short-term memory network model to obtain a first risk prediction model.

[0010] In some embodiments, the step of pre-constructing a second risk prediction model includes: using the risk attribute data of the trading accounts, the first risk marking results, and the second risk marking results obtained and corresponding to the m first training samples as m second training samples; inputting the m second training samples into a random forest model, training the model parameters of the random forest model, and obtaining second model parameters; and applying the second model parameters of the random forest model to obtain a second risk prediction model.

[0011] In some embodiments, after the step of inputting the m second training samples into the random forest model, training the model parameters of the random forest model, and obtaining the second model parameters, the step of pre-constructing the second risk prediction model also includes: using the risk attribute data, the first risk marking results, and the second risk marking results of the transaction accounts corresponding one by one to the n first verification samples as n second verification samples; inputting the n second verification samples into the random forest model to which the second model parameters are applied to verify the second model parameters; if the verification passes, applying the second model parameters of the random forest model to obtain a second risk prediction model.

[0012] Another aspect of the present disclosure provides a transaction warning device, including: an acquisition module, the acquisition module is used to execute the acquisition of user authorization for transaction information of a transaction account, wherein the transaction information includes time-series transaction data and risk attribute data; a first prediction module, the first prediction module is used to execute, after obtaining the user's authorization for the transaction information, input the time-series transaction data into a pre-built first risk prediction model to obtain a first risk prediction result; a second prediction module, the second prediction module is used to execute the input of the risk attribute data and the first risk prediction result into a pre-built second risk prediction model to obtain a second risk prediction result; and a warning module, the warning module is used to execute when the second prediction result is a high-risk transaction, issue a warning prompt message.

[0013] Another aspect of the present disclosure provides an electronic device, comprising one or more processors and one or more memories, wherein the memories are used to store executable instructions, and when the executable instructions are executed by the processors, the above-mentioned method is implemented.

[0014] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0015] Another aspect of the present disclosure provides a computer program product, comprising a computer program, wherein the computer program comprises computer executable instructions, and the instructions are used to implement the method as described above when executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0017] Figure 1 An exemplary system architecture to which the method and apparatus according to an embodiment of the present disclosure can be applied is schematically shown;

[0018] Figure 2 A flowchart of a transaction early warning method according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 3 A flowchart of pre-building a first risk prediction model according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 4 A flowchart of pre-building a second risk prediction model according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 5 A block diagram of a transaction early warning device according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 6 A block diagram of an electronic device according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0024] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0025] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0026] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0027] When using expressions such as "at least one of A, B or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, features defined as "first" and "second" may explicitly or implicitly include one or more of the said features.

[0028] With the continuous development of network applications, people are pursuing a life state of interconnectedness. The development of banking network systems is changing with each passing day, and the banking system is gradually developing in a smarter, faster and more efficient direction. At the same time, as a pillar industry of society, the importance of security is beyond doubt. In the field of financial risk control, by real-time monitoring and prediction of abnormal situations in financial data, potential risks can be discovered and handled in a timely manner to avoid the expansion of financial risks. These abnormal situations may include abnormal fluctuations in stock prices, sudden changes in trading volume, etc., which may indicate market instability or potential risks. The existing environment does not have clear identification and prevention measures for high-risk transaction scenarios. Once a problem occurs, the cost of relocating and tracing the cause of the problem is huge. Therefore, how to intelligently and accurately realize transaction warning has become a technical problem that technicians in this field need to solve urgently.

[0029] The embodiments of the present disclosure provide a transaction early warning method, device, electronic device, computer-readable storage medium and computer program product. The transaction early warning method includes: obtaining the user's authorization for the transaction information of the transaction account, wherein the transaction information includes time-series transaction data and risk attribute data; after obtaining the user's authorization for the transaction information, inputting the time-series transaction data into a pre-built first risk prediction model to obtain a first risk prediction result; inputting the risk attribute data and the first risk prediction result into a pre-built second risk prediction model to obtain a second risk prediction result; when the second prediction result is a high-risk transaction, issuing a warning prompt message.

[0030] It should be noted that the transaction warning method, device, electronic device, computer-readable storage medium and computer program product disclosed in the present invention can be used in the field of artificial intelligence technology, and can also be used in any field outside the field of artificial intelligence technology, such as the financial field. The field of the present invention is not limited here.

[0031] Figure 1 The exemplary system architecture 100 to which the transaction early warning method, apparatus, electronic device, computer-readable storage medium and computer program product according to the embodiments of the present disclosure can be applied is schematically shown. It should be noted that: Figure 1 What is shown is merely an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0032] like Figure 1As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0033] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0034] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0035] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0036] It should be noted that the transaction early warning method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the transaction early warning device provided in the embodiment of the present disclosure can generally be set in the server 105. The transaction early warning method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the transaction early warning device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0037] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0038] The following will be based on Figure 1 The scene described by Figure 2~Figure 4 The transaction early warning method of the embodiment of the present disclosure is described in detail.

[0039] Figure 2 The flowchart of the transaction early warning method according to the embodiment of the present disclosure is schematically shown.

[0040] like Figure 2 As shown, the transaction early warning method of this embodiment includes operations S210 to S240.

[0041] In operation S210, the user's authorization for the transaction information of the transaction account is obtained, wherein the transaction information includes time-series transaction data and risk attribute data.

[0042] In an embodiment of the present disclosure, before obtaining the transaction information of the user, the user's consent or authorization may be obtained. For example, before operation S210, a request for obtaining the user's transaction information may be issued to the user. When the user agrees or authorizes that the user information may be obtained, the operation S210 is performed.

[0043] In the embodiments of the present disclosure, a corresponding operation entry may be provided for the user to choose to agree or reject the automated decision result. That is, before the transaction information is processed, an instruction of the user to agree or reject the processing input through the corresponding operation entry may be obtained. If the user agrees to process, the transaction information is processed, that is, operations S220 to S240 are executed. If the user refuses to process, the expert decision process is entered.

[0044] In operation S220, after obtaining the user's authorization for the transaction information, the time series transaction data is input into a pre-built first risk prediction model to obtain a first risk prediction result.

[0045] It can be understood that time-series transaction data is continuous transaction data with timestamps. The data is arranged in the order of the time when the transactions occurred to form an ordered sequence. This order makes it possible to clearly observe the changes and development trends of transactions on the timeline.

[0046] In some examples, the time series transaction data may include, but is not limited to, timestamp, transaction amount, transaction type, and transaction status. Using the model parameters of the first risk model, analyzing the time series transaction data with the above data characteristics can mine the first risk prediction result of the transaction account. In some examples, the first risk prediction result may be risky or risk-free.

[0047] In some examples, the first risk prediction model may be a model trained based on a long short-term memory network model, wherein the long short-term memory network model may facilitate prediction of the first risk prediction result based on time-series transaction data.

[0048] As some feasible ways, such as Figure 3 As shown, the step of pre-building the first risk prediction model includes operations S310 to S330.

[0049] In operation S310, first training samples of m users are obtained, wherein each first training sample includes time-series transaction data of a transaction account and a first risk marking result, and m is an integer greater than or equal to 1.

[0050] In operation S320, m first training samples are input into the long short-term memory network model, and model parameters of the long short-term memory network model are trained to obtain first model parameters.

[0051] In operation S330, the first model parameters of the long short-term memory network model are applied to obtain a first risk prediction model.

[0052] Since each first training sample includes the time-series transaction data of a trading account and the first risk marking result, the long short-term memory network model trained by the first training samples of m users can realize the function of predicting the first risk prediction result. The first risk marking result here can be manually labeled or machine labeled. Here, the larger the value of m, the higher the accuracy of the first model parameters, but considering the computing resources and the efficiency of model training, m can be taken as appropriate, and the specific value of m can be selected as appropriate according to the actual situation. Through operations S310~S330, the step of pre-building the first risk prediction model can be easily realized.

[0053] As some embodiments of the present disclosure, after the step of inputting m first training samples into the long short-term memory network model, training the model parameters of the long short-term memory network model, and obtaining the first model parameters in operation S320, the step of pre-constructing the first risk prediction model also includes operation S001 and operation S002.

[0054] In operation S001, n first verification samples are obtained, wherein each first verification sample includes time-series transaction data and a first risk marking result of a transaction account, and n is an integer greater than or equal to 1.

[0055] In operation S002, n first verification samples are input into a long short-term memory network model to which first model parameters are applied to verify the first model parameters.

[0056] In operation S330, if the verification is passed, the first model parameters of the long short-term memory network model are applied to obtain a first risk prediction model.

[0057] It can be understood that by inputting the first verification sample with the first risk marking result into the trained first risk prediction model, a predicted value can be obtained. The first risk marking result is the actual value. The loss value between the predicted value and the actual value is calculated using the loss function. If the loss value meets the set threshold, the verification is considered to be passed. The first model parameters are applied to the long short-term memory network model to obtain the first risk prediction model. If the loss value does not meet the set threshold, the verification is considered to have failed. Repeat operations S310, S320, S001 and S002 until the verification is passed.

[0058] Operations S001 and S002 can be used to verify the first model parameters, so that the prediction results of the first risk prediction model are more accurate.

[0059] In operation S230, the risk attribute data and the first risk prediction result are input into a pre-built second risk prediction model to obtain a second risk prediction result.

[0060] In some examples, risk attribute data may include, but are not limited to, the frequency of historical transaction anomalies, the amount of each historical abnormal transaction, the duration of each historical abnormal transaction, the account credit rating, and historical defaults. By using the model parameters of the second risk model, analyzing the risk attribute data with the above data characteristics and the first risk prediction results, the second risk prediction results of the transaction account can be further mined on the basis of the first risk results. In some examples, the second risk prediction results can be low risk or high risk. Using the results obtained by the first risk prediction model as the input value of the second risk prediction model can further improve the accuracy of the prediction of the second risk prediction model.

[0061] In some examples, the second risk prediction model is a model trained based on a random forest model, wherein the random forest model can facilitate prediction of the second risk prediction result based on the risk attribute data and the first risk prediction result.

[0062] As some feasible ways, such as Figure 4 As shown, the step of pre-building the second risk prediction model includes operations S410 to S430.

[0063] In operation S410, the acquired risk attribute data of the transaction accounts corresponding to the m first training samples, the first risk marking results, and the second risk marking results are used as m second training samples.

[0064] In operation S420, m second training samples are input into the random forest model, and model parameters of the random forest model are trained to obtain second model parameters.

[0065] In operation S430, the second model parameters of the random forest model are applied to obtain a second risk prediction model.

[0066] The m second training samples include risk attribute data of trading accounts corresponding to the m first training samples, the first risk marking results and the second risk marking results, so that the random forest model trained by the second training samples of m users can realize the function of predicting the second risk prediction results. The second risk marking results here can be manually labeled or machine labeled. Here, the larger the value of m, the higher the accuracy of the second model parameters, but considering the computing resources and the efficiency of model training, m can be taken as appropriate, and the specific value of m can be selected as appropriate according to the actual situation. Through operations S410~S430, it is convenient to implement the step of pre-building the second risk prediction model.

[0067] As some embodiments of the present disclosure, after the step of inputting m second training samples into the random forest model, training the model parameters of the random forest model, and obtaining the second model parameters in operation S420, the step of pre-constructing the second risk prediction model also includes operation S003 and operation S004.

[0068] In operation S003, the acquired risk attribute data of the transaction accounts corresponding to the n first verification samples, the first risk marking results and the second risk marking results are used as n second verification samples.

[0069] In operation S004, n second validation samples are input into a random forest model to which second model parameters are applied to validate the second model parameters.

[0070] In operation S430, if the verification is passed, the second model parameters of the random forest model are applied to obtain a second risk prediction model.

[0071] It can be understood that by inputting the second verification sample with the second risk marking result into the trained second risk prediction model, a predicted value can be obtained. The second risk marking result is the actual value. The loss value between the predicted value and the actual value is calculated using the loss function. If the loss value meets the set threshold, the verification is considered to be passed. The second model parameters are applied to the random forest model to obtain the second risk prediction model. If the loss value does not meet the set threshold, the verification is considered to have failed. Repeat operations S410, S420, S003 and S004 until the verification is passed.

[0072] Operations S003 and S004 can be used to verify the second model parameters, making the prediction results of the second risk prediction model more accurate.

[0073] In operation S240, when the second prediction result is a high-risk transaction, a warning prompt message is issued.

[0074] In the present disclosure, the protection scope for the specific characteristics of time-series transaction data and risk attribute data is: time-series transaction data may include but is not limited to timestamp, transaction amount, transaction type and transaction status; and / or risk attribute data includes historical transaction abnormality frequency, historical abnormal transaction amount, historical abnormal transaction duration, account credit rating, and historical default situation.

[0075] In the present disclosure, the protection scope for the specific features of the first risk prediction model and the second risk prediction model is: the first risk prediction model is a model trained based on the long short-term memory network model; and / or the second risk prediction model is a model trained based on the random forest model.

[0076] According to the transaction early warning method of the embodiment of the present disclosure, by obtaining the transaction information of the transaction account authorized by the user, the transaction information includes time-series transaction data and risk attribute data; inputting the time-series transaction data into the pre-constructed first risk prediction model to obtain the first risk prediction result; inputting the risk attribute data and the first risk prediction result into the pre-constructed second risk prediction model to obtain the second risk prediction result; when the second prediction result is a high-risk transaction, issuing an early warning prompt information. The present disclosure can collect and analyze transaction information in real time, monitor the transaction information in real time, and promptly discover potential abnormal transactions, effectively improving the timeliness of risk prevention and control. Through the advanced time series analysis method (first risk prediction model), the time series characteristics of transaction behavior can be deeply excavated, and the transaction behavior that deviates from the routine can be accurately identified, reducing the possibility of false positives and false negatives. The second risk prediction model can comprehensively consider multiple risk factors (risk attribute data), quantitatively evaluate and predict transaction risks, and improve the comprehensiveness and accuracy of risk assessment. The present disclosure also has an early warning function. Once a high-risk transaction is predicted, it will immediately trigger an early warning feedback, so that the bank can take measures at the first time to avoid or reduce possible economic losses. Based on this, the present disclosure can intelligently and accurately implement identification and prevention measures for high-risk transaction scenarios, avoid re-positioning and tracing problems after risks occur, and reduce remediation costs.

[0077] Based on the above transaction early warning method, the present disclosure also provides a transaction early warning device. Figure 5 The transaction early warning device is described in detail.

[0078] Figure 5The structural block diagram of the transaction early warning device according to the embodiment of the present disclosure is schematically shown.

[0079] The transaction early warning device 10 comprises an acquisition module 1 , a first prediction module 2 , a second prediction module 3 and an early warning module 4 .

[0080] The acquisition module 1 is used to execute the authorization to obtain the transaction information of the transaction account of the user, wherein the transaction information includes time-series transaction data and risk attribute data.

[0081] The first prediction module 2 is used to input the time series transaction data into a pre-built first risk prediction model after obtaining the user's authorization for the transaction information, to obtain a first risk prediction result.

[0082] The second prediction module 3 is used to input the risk attribute data and the first risk prediction result into a pre-built second risk prediction model to obtain a second risk prediction result.

[0083] The early warning module 4 is used to issue an early warning message when the second prediction result is a high-risk transaction.

[0084] According to some embodiments of the present disclosure, the transaction warning device also includes a first construction module, which is used to pre-construct a first risk prediction model. The first construction module includes a first acquisition unit, a first training unit and a first determination unit.

[0085] The first acquisition unit is used to acquire first training samples of m users, wherein each first training sample includes time-series transaction data and a first risk marking result of a transaction account, and m is an integer greater than or equal to 1.

[0086] The first training unit is used to input m first training samples into the long short-term memory network model, train the model parameters of the long short-term memory network model, and obtain first model parameters.

[0087] The first determination unit is used to apply the first model parameters of the long short-term memory network model to obtain a first risk prediction model.

[0088] According to some embodiments of the present disclosure, the first building module further includes a second acquiring unit and a first verifying unit.

[0089] The second acquisition unit is used to acquire n first verification samples, wherein each first verification sample includes time-series transaction data and a first risk marking result of a transaction account, and n is an integer greater than or equal to 1.

[0090] The first verification unit is used to input n first verification samples into a long short-term memory network model that applies first model parameters to verify the first model parameters.

[0091] If the verification is successful, the first model parameters of the long short-term memory network model are applied to obtain the first risk prediction model.

[0092] According to some embodiments of the present disclosure, the transaction warning device also includes a second construction module, which is used to pre-construct a second risk prediction model. The second construction module includes a third acquisition unit, a second training unit and a third determination unit.

[0093] The third acquisition unit is used to use the acquired risk attribute data of the transaction accounts corresponding to the m first training samples, the first risk marking results and the second risk marking results as m second training samples.

[0094] The second training unit is used to input m second training samples into the random forest model, train the model parameters of the random forest model, and obtain second model parameters.

[0095] The third determination unit is used to apply the second model parameters of the random forest model to obtain a second risk prediction model.

[0096] According to some embodiments of the present disclosure, the first building module further includes a fourth acquisition unit and a second verification unit.

[0097] The fourth acquisition unit is used to use the acquired risk attribute data of the transaction accounts corresponding to the n first verification samples, the first risk marking results and the second risk marking results as n second verification samples.

[0098] The second verification unit is used to input n second verification samples into the random forest model using the second model parameters to verify the second model parameters;

[0099] If the verification is passed, the second model parameters of the random forest model are applied to obtain the second risk prediction model.

[0100] According to the transaction early warning device 10 of the embodiment of the present disclosure, by obtaining the transaction information of the transaction account authorized by the user, the transaction information includes time-series transaction data and risk attribute data; inputting the time-series transaction data into the pre-constructed first risk prediction model to obtain the first risk prediction result; inputting the risk attribute data and the first risk prediction result into the pre-constructed second risk prediction model to obtain the second risk prediction result; when the second prediction result is a high-risk transaction, issuing an early warning prompt information. The present disclosure can collect and analyze transaction information in real time, monitor the transaction information in real time, and promptly discover potential abnormal transactions, effectively improving the timeliness of risk prevention and control. Through the advanced time series analysis method (first risk prediction model), the time series characteristics of transaction behavior can be deeply excavated, and the transaction behavior that deviates from the routine can be accurately identified, reducing the possibility of false alarms and omissions. The second risk prediction model can comprehensively consider multiple risk factors (risk attribute data), quantitatively evaluate and predict transaction risks, and improve the comprehensiveness and accuracy of risk assessment. The present disclosure also has an early warning function. Once a high-risk transaction is predicted, it will immediately trigger an early warning feedback, so that the bank can take measures at the first time to avoid or reduce possible economic losses. Based on this, the present disclosure can intelligently and accurately implement identification and prevention measures for high-risk transaction scenarios, avoid re-positioning and tracing problems after risks occur, and reduce remediation costs.

[0101] In addition, according to the embodiments of the present disclosure, any multiple modules among the acquisition module 1, the first prediction module 2, the second prediction module 3 and the early warning module 4 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module.

[0102] According to an embodiment of the present disclosure, at least one of the acquisition module 1, the first prediction module 2, the second prediction module 3 and the early warning module 4 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware and firmware, or in an appropriate combination of any of them.

[0103] Alternatively, at least one of the acquisition module 1, the first prediction module 2, the second prediction module 3 and the early warning module 4 may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be executed.

[0104] The transaction early warning device according to the embodiment of the present disclosure is described in detail below. It is worth noting that the following description is only an exemplary description and is not a specific limitation of the present disclosure.

[0105] In order to respond to the risk management issues of financial institutions and quickly capture changes and problems under the new situation, this paper takes data as the basis, deeply explores the value of data through technology and algorithms, refines anomaly monitoring, and uses a dynamic, holistic and related thinking mode to examine, summarize and solve problems through the large amount of information obtained. Ultimately, from the three aspects of automatic identification of abnormal data of high-risk transactions, full-link intelligent analysis, and transaction anomaly monitoring, it achieves the goals of accurate identification, early intervention and improved account security.

[0106] The present disclosure is mainly composed of a data acquisition module, a time series preprocessing module, an anomaly detection module, a high-risk transaction prediction module and an early warning feedback module.

[0107] 1. Data collection module: This module is responsible for obtaining transaction data from financial trading platforms in real time or regularly, including but not limited to transaction amount, transaction time, transaction type, transaction account information, etc., and constructing corresponding transaction time series data sets. It connects to the internal database or transaction interface of financial institutions to collect real-time transaction data including key fields such as transaction timestamp, transaction amount, transaction type (buy / sell), transaction account ID, and transaction status (success / failure).

[0108] 2. Time series preprocessing module: cleans, integrates and formats the collected raw transaction data, removes invalid and noisy data, fills in missing values ​​through interpolation, smoothing and other methods, and converts it into time series data that can be used for subsequent analysis.

[0109] Data cleaning: (1) Delete duplicate records and irrelevant data, such as redundant records of the same transaction or log information that is not related to the transaction. (2) Check and process missing values: You can use forward filling or backward filling methods to fill in the empty values ​​in the time series, or use interpolation methods (such as linear interpolation and polynomial interpolation) to supplement missing data points. (3) Remove extreme outliers: Filter out transaction records that are obviously beyond the normal range by setting a threshold (such as the 3σ principle), or use the box plot rule to eliminate atypical values.

[0110] 3. Anomaly detection module: In the prediction of high-risk financial transaction errors based on time series anomaly detection, the anomaly detection module adopts the LSTM (Long Short-Term Memory) algorithm, and its specific implementation steps are as follows.

[0111] (1) Feature engineering: Arrange the original transaction data in chronological order to form time series data. Extract meaningful features, such as transaction amount, transaction frequency, transaction interval, etc., and add auxiliary features such as risk attributes of trading accounts and historical trading behaviors. According to the requirements of the problem, normalize or standardize the continuous numerical features to make the data more suitable for LSTM model training.

[0112] (2) Build LSTM model: Define the LSTM model structure, including input layer, LSTM layer, fully connected layer (DenseLayer), etc. The number of LSTM layers and units, as well as the number of nodes in the fully connected layer, can be tuned based on experience or through grid search, random search, etc. The LSTM layer can capture the long-term dependency and periodicity characteristics in the time series, which can be used to understand the pattern of normal trading behavior.

[0113] (3) Training the LSTM model: Divide the data into a training set and a validation set (or further divide it into a test set). When training the model, mark normal transaction sequences as negative samples and abnormal transaction sequences as positive samples. The goal is to let the model learn to distinguish between normal transactions and abnormal transactions. The binary cross entropy loss function can be selected as the optimization target.

[0114] (4) Anomaly detection and threshold setting: The trained LSTM model predicts the new transaction sequence and obtains the anomaly probability at each time step. Set a suitable threshold. When the predicted anomaly probability exceeds the threshold, the current transaction is determined to be an abnormal transaction. The selection of the threshold can be determined by methods such as ROC curve and precision-recall curve to achieve the best anomaly detection effect.

[0115] 5. Result evaluation and optimization: Use the validation set or test set to evaluate the model performance, including accuracy, AUC value, F1 score and other indicators. Adjust and optimize the model parameters according to the evaluation results until the model achieves satisfactory results in the anomaly detection task.

[0116] 4. High-risk transaction prediction module: Based on the identified abnormal transaction patterns, combined with the risk level of the transaction account, historical transaction records and other factors, the high-risk transaction prediction module uses the random forest algorithm to build a probability prediction model. The specific implementation steps are as follows:

[0117] (1) Feature Engineering: Based on the abnormal transactions identified by the anomaly detection module, further refine and expand the features, including but not limited to: feature vectors of abnormal transactions (such as anomaly scores, abnormal duration, abnormal transaction frequency, etc.), risk attributes of trading accounts (such as credit ratings, historical defaults, etc.), and transaction characteristics (such as transaction amount, transaction type, transaction time, etc.). Appropriate preprocessing of features, such as discretization, one-hot encoding, and standardization, is performed to ensure that the features meet the input requirements of the random forest algorithm.

[0118] (2) Build a random forest model: Create a random forest classifier and set appropriate parameters, such as the number of trees (n_estimators), the maximum number of features (max_features), the minimum number of samples required for node partitioning (min_samples_split), the minimum number of samples for leaf nodes (min_samples_leaf), etc. Random forest integrates the prediction results of multiple decision trees to reduce the risk of overfitting and improve the stability and generalization ability of the model.

[0119] (3) Model training and prediction: Use the labeled abnormal transaction data (high-risk transactions are positive and low-risk transactions are negative) to train the random forest model. For newly emerging abnormal transaction data, use the trained model to predict and output the probability that each transaction is a high-risk transaction.

[0120] (4) Threshold setting and decision rules: A probability threshold is set according to the actual situation. When the probability of a high-risk transaction predicted by the model is higher than the threshold, the transaction is marked as a high-risk transaction and included in the focus list. The threshold can be analyzed through the ROC curve, and the balance point that maximizes TPR and TNR is selected as the optimal threshold.

[0121] (5) Model evaluation and optimization: Use an independent test set to evaluate the model and measure the prediction performance, such as accuracy, precision, recall, F1 score, etc. Tune the model parameters based on the evaluation results and iteratively optimize the model performance.

[0122] 5. Early warning feedback module: When the prediction module determines that a transaction has a high risk, the present disclosure will immediately generate an early warning signal and notify relevant management personnel through a visual interface, email, SMS, etc., so as to intervene in the investigation and processing in time to prevent the occurrence of erroneous transactions.

[0123] After the high-risk financial transaction error prediction based on time series anomaly monitoring is implemented, it has the following significant advantages:

[0124] 1. Real-time monitoring and prediction capabilities: The present disclosure can collect and analyze financial transaction data in real time, monitor transaction behaviors in real time, and promptly discover potential abnormal transactions, effectively improving the timeliness of risk prevention and control.

[0125] 2. Accurate anomaly detection: Advanced time series analysis methods (such as LSTM) can deeply explore the time series characteristics of trading behaviors, accurately identify trading behaviors that deviate from the norm, and reduce the possibility of false positives and false negatives.

[0126] 3. Comprehensive assessment of risk level: The high-risk transaction prediction module adopts the random forest algorithm, which can comprehensively consider multiple risk factors, such as abnormal transaction characteristics, account risk attributes, etc., to quantitatively assess and predict transaction risks, thereby improving the comprehensiveness and accuracy of risk assessment.

[0127] 4. Active early warning mechanism: This disclosure has an early warning function. Once a high-risk transaction is predicted, it will immediately trigger an early warning feedback, allowing the bank to take measures at the first time to avoid or mitigate possible economic losses.

[0128] 5. Intelligent decision support: Through big data and artificial intelligence technology, this disclosure can provide intelligent decision-making basis, assist risk management teams in making scientific decisions, optimize resource allocation, and improve risk control efficiency.

[0129] 6. Self-optimization and adaptability: Both the anomaly detection module and the high-risk transaction prediction module have certain self-optimization and learning capabilities, and can be adjusted according to changes in the market environment and emerging risk patterns to ensure the effectiveness and stability of this disclosure. This disclosure greatly enhances the ability of banks and other financial institutions to identify and predict high-risk transactions, helps financial institutions strengthen risk management, and ensures the healthy and stable operation of the financial market.

[0130] Figure 6 A block diagram of an electronic device suitable for implementing the above method according to an embodiment of the present disclosure is schematically shown.

[0131] like Figure 6 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 to a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0132] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0133] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the input / output (I / O) interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0134] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0135] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0136] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiment of the present disclosure.

[0137] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0138] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0139] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0140] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0141] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0142] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0143] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A transaction early warning method, characterized in that: include: Obtaining the user's authorization for transaction information of the transaction account, wherein the transaction information includes time-series transaction data and risk attribute data; After obtaining the user's authorization for the transaction information, inputting the time series transaction data into a pre-built first risk prediction model to obtain a first risk prediction result; Inputting the risk attribute data and the first risk prediction result into a pre-constructed second risk prediction model to obtain a second risk prediction result; When the second prediction result is a high-risk transaction, a warning prompt message is issued.

2. The transaction early warning method according to claim 1, characterized in that: The time series transaction data includes timestamp, transaction amount, transaction type and transaction status; and / or the risk attribute data includes historical transaction abnormality frequency, historical abnormal transaction amount for each transaction, historical abnormal transaction duration for each transaction, account credit rating, and historical default situation.

3. The transaction early warning method according to claim 1, characterized in that: The first risk prediction model is a model trained based on a long short-term memory network model, and / or the second risk prediction model is a model trained based on a random forest model.

4. The transaction early warning method according to claim 1, characterized in that: The steps of pre-building the first risk prediction model include: Obtaining first training samples of m users, wherein each of the first training samples includes time-series transaction data of a transaction account and a first risk marking result, and m is an integer greater than or equal to 1; Inputting the m first training samples into a long short-term memory network model, training model parameters of the long short-term memory network model, and obtaining first model parameters; The first model parameters of the long short-term memory network model are applied to obtain a first risk prediction model.

5. The transaction early warning method according to claim 4, characterized in that: After the step of inputting the m first training samples into the long short-term memory network model, training the model parameters of the long short-term memory network model, and obtaining the first model parameters, the step of pre-building the first risk prediction model also includes: Obtain n first verification samples, wherein each of the first verification samples includes time-series transaction data and a first risk marking result of a transaction account, and n is an integer greater than or equal to 1; Inputting the n first verification samples into a long short-term memory network model to which the first model parameters are applied to verify the first model parameters; If the verification is successful, the first model parameter of the long short-term memory network model is applied to obtain a first risk prediction model.

6. The transaction early warning method according to claim 5, characterized in that: The steps of pre-building the second risk prediction model include: The acquired risk attribute data of the trading accounts corresponding to the m first training samples, the first risk marking results, and the second risk marking results are used as m second training samples; Inputting the m second training samples into a random forest model, training model parameters of the random forest model, and obtaining second model parameters; The second model parameters of the random forest model are applied to obtain a second risk prediction model.

7. The transaction early warning method according to claim 6, characterized in that: After the step of inputting the m second training samples into the random forest model, training the model parameters of the random forest model, and obtaining the second model parameters, the step of pre-building the second risk prediction model also includes: The acquired risk attribute data of the trading accounts corresponding to the n first verification samples, the first risk marking results, and the second risk marking results are used as n second verification samples; Inputting the n second validation samples into a random forest model to which the second model parameters are applied to validate the second model parameters; If the verification is passed, the second model parameters of the random forest model are applied to obtain a second risk prediction model.

8. A transaction early warning device, characterized in that: include: An acquisition module, the acquisition module is used to execute authorization to acquire transaction information of a transaction account from a user, wherein the transaction information includes time-series transaction data and risk attribute data; A first prediction module, the first prediction module is used to input the time series transaction data into a pre-built first risk prediction model to obtain a first risk prediction result after obtaining the user's authorization for the transaction information; A second prediction module, the second prediction module is used to input the risk attribute data and the first risk prediction result into a pre-built second risk prediction model to obtain a second risk prediction result; The early warning module is used to issue an early warning message when the second prediction result is a high-risk transaction.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images