Target abnormal rule determination method and device, electronic equipment, medium and product

Abstract

The embodiment of the invention provides a target abnormal rule determination method and device, electronic equipment, a medium and a product. The method comprises the following steps: extracting a plurality of first factors from a plurality of anomaly recognition rules; acquiring a plurality of historical data; the multiple pieces of historical data comprise normal historical data and abnormal historical data; based on a genetic evolutionary algorithm, through an evaluation function, performing iterative optimization on individuals in the primary population to obtain a target individual, the individuals in the primary population being determined according to a plurality of first factors; the evaluation function is used for evaluating and determining the accuracy of a current rule according to a plurality of historical data, and the current rule is determined according to individuals in a current population; according to the method, the target anomaly rule is determined according to the target individual, so that the multiple anomaly recognition rules are split into independent factors, each factor focuses on the anomaly of a certain specific type, the reusability of the factors is improved, redundancy is reduced, and anomaly recognition efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, device, electronic device, medium and product for determining target anomaly rules. Background Art

[0002] With the rapid development of the financial industry, monitoring of abnormal employee behavior is an important measure to prevent internal risks and ensure the sound operation of institutions. It is also a key link in ensuring the stable operation of financial institutions and preventing risks.

[0003] In current risk management practices, the early warning and monitoring mechanism for employee abnormal trading behavior mainly relies on a series of abnormal trading rules constructed and combined by senior business experts based on professional knowledge and practical experience. These rules are designed to capture and identify abnormal behaviors that employees may exhibit in business operations.

[0004] However, the constructed rule set contains a large amount of repeated or similar logic, and the system is highly complex, resulting in high computing power consumption when the system identifies abnormal employee behavior and low anomaly identification efficiency. Summary of the invention

[0005] The embodiments of the present application provide a method, device, electronic device, medium and product for determining target anomaly rules, so as to improve recognition efficiency.

[0006] In a first aspect, an embodiment of the present application provides a method for determining a target abnormal rule, wherein the target abnormal rule is used to identify abnormal behavior of a user, including:

[0007] Extracting multiple first factors from multiple anomaly identification rules;

[0008] Acquire multiple historical data; the multiple historical data include normal historical data and abnormal historical data;

[0009] Based on the genetic evolution algorithm, the individuals in the primary population are iteratively optimized through an evaluation function to obtain a target individual, wherein the individuals in the primary population are all determined according to the multiple first factors; the evaluation function is used to evaluate and determine the accuracy of the current rule according to the multiple historical data, and the current rule is determined according to the individuals in the contemporary population;

[0010] According to the target individual, a target abnormality rule is determined.

[0011] Optionally, the method further includes:

[0012] According to the plurality of historical data, based on the trained abnormal factor identification model, screening out a plurality of second factors from the plurality of historical data;

[0013] Performing a deduplication operation on the multiple first factors and the multiple second factors to obtain multiple third factors;

[0014] Correspondingly, the individuals in the primary population are all determined based on the multiple third factors.

[0015] Optionally, multiple first factors are extracted from multiple exception rules, including:

[0016] For each abnormal rule, determining a plurality of first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor;

[0017] Accordingly, based on the genetic evolution algorithm, the individuals in the initial population are iteratively optimized through the evaluation function to obtain the target individuals, including:

[0018] For each abnormal rule, a plurality of first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor are taken as an individual in the primary population;

[0019] Based on the genetic evolution algorithm, individuals in the primary population are iteratively optimized through an evaluation function to obtain a target individual, wherein the target individual includes at least one target factor and a target threshold value corresponding to each target factor; the at least one target factor is selected from multiple first factors.

[0020] Optionally, for each abnormal rule, taking multiple first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor as an individual in the primary population includes:

[0021] For each abnormal rule, assign an initial weight to each first factor corresponding to the abnormal rule, and use the multiple first factors corresponding to the abnormal rule, and the first threshold and initial weight corresponding to each first factor as an individual in the initial population;

[0022] Correspondingly, the target individual also includes the target weights corresponding to each target factor.

[0023] Optionally, for each abnormal rule, taking multiple first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor as an individual in the primary population includes:

[0024] For each abnormal rule, determine the initial combination of multiple first factors corresponding to the abnormal rule; use the multiple first factors corresponding to the abnormal rule, the initial combination, and the first threshold corresponding to each first factor as an individual in the primary population;

[0025] Correspondingly, the target individual also includes target combinations of multiple first factors.

[0026] Optionally, the evaluation function of the genetic evolution algorithm includes: rule hit rate, rule false alarm rate and rule complexity;

[0027] The rule hit rate is used to indicate the proportion of abnormal historical data correctly identified by the current rule to all abnormal historical data; the current rule is determined based on individuals in the contemporary population;

[0028] The rule false alarm rate is used to indicate the ratio of the number of normal historical data misjudged as abnormal historical data by the current rule to all normal historical data;

[0029] The rule complexity is used to indicate the complexity of the current rule, which is positively correlated to the number of factors involved, the number and nesting levels of logical operators, and the time taken for execution, wherein the number and nesting levels of logical operators are determined according to the combination of individuals included in the contemporary population.

[0030] In a second aspect, an embodiment of the present application provides a device for determining a target abnormality rule, wherein the target abnormality rule is used to identify abnormal behavior of a user, including:

[0031] An extraction module, used for extracting a plurality of first factors from a plurality of anomaly identification rules;

[0032] An acquisition module, used for acquiring a plurality of historical data; the plurality of historical data includes normal historical data and abnormal historical data;

[0033] An iterative module, used for iteratively optimizing individuals in a primary population based on a genetic evolution algorithm through an evaluation function to obtain a target individual, wherein the individuals in the primary population are all determined according to the multiple first factors; the evaluation function is used for evaluating and determining the accuracy of a current rule according to the multiple historical data, and the current rule is determined according to individuals in a contemporary population;

[0034] A determination module is used to determine a target abnormality rule according to the target individual.

[0035] In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0036] The memory stores computer-executable instructions;

[0037] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0038] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0039] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0040] The method, device, electronic device, medium and product for determining target abnormal rules provided by the embodiment of the present application are as follows: extracting multiple first factors from multiple abnormal identification rules; obtaining multiple historical data; the multiple historical data include normal historical data and abnormal historical data; based on the genetic evolution algorithm, through the evaluation function, iteratively optimizing the individuals in the primary population to obtain the target individual, wherein the individuals in the primary population are all determined according to the multiple first factors; the evaluation function is used to evaluate and determine the accuracy of the current rule according to the multiple historical data, and the current rule is determined according to the individuals in the contemporary population; according to the target individual, the target abnormal rule is determined, so that multiple abnormal identification rules can be split into independent factors, each factor focuses on a specific type of abnormality, improves the reusability of the factor, reduces redundancy, and when it is necessary to add or modify a rule, only the corresponding factor needs to be adjusted, without large-scale rectification of the entire rule set, reducing maintenance costs. And combined with the genetic evolution algorithm to automatically update, combine and mutate the rules, overcome the problems of unreasonable condition attributes or thresholds, unreasonable rule combination methods, etc. in the existing rule base, improve the accuracy of employee abnormal behavior monitoring, and reduce the probability of internal risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0042] Figure 1 An application scenario diagram provided for an embodiment of the present application;

[0043] Figure 2 A flowchart of a method for determining a target anomaly rule provided in an embodiment of the present application;

[0044] Figure 3 A basic flow chart of a simple genetic evolution algorithm provided in an embodiment of the present application;

[0045] Figure 4 A schematic diagram of the structure of a device for determining target anomaly rules provided by the present application;

[0046] Figure 5 A schematic diagram of the structure of the electronic device provided in this application.

[0047] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0048] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0049] With the rapid development of the financial industry, employee abnormal behavior monitoring has become an important measure to prevent internal risks and ensure the sound operation of institutions. This process is not only a key link to ensure the stable operation of financial institutions, but also an important means to prevent potential risks and maintain market trust and compliance.

[0050] In current risk management practices, the early warning monitoring mechanism for employees’ abnormal trading behaviors mainly relies on the professional knowledge and practical experience of senior business experts. Based on years of industry experience, these experts have built a series of complex abnormal trading rules and combined these rules to capture and identify abnormal behaviors that employees may exhibit in business operations. These rules usually cover a variety of abnormal behavior patterns, such as frequent large-value transactions, abnormal interactions with customers, and irregular operation times.

[0051] Once an employee's transaction or behavior data triggers the preset warning threshold, the system will immediately activate the relevant warning mechanism. At this point, the employee will be included in the strict monitoring scope to ensure that any potential risks can be discovered and handled in a timely manner. Subsequently, the system will automatically trigger the review process, and relevant business personnel will further verify, analyze and evaluate these abnormal behaviors and issue a detailed risk analysis report. This process not only helps to identify and handle potential risks in a timely manner, but also provides an important reference for subsequent risk management strategies.

[0052] However, the rule set built by senior business experts based on their professional knowledge and practical experience contains a large amount of repeated or similar logic, and the system is highly complex, resulting in high computing power consumption and low recognition efficiency when the system identifies abnormal employee behavior.

[0053] In view of this, the present application provides a method for determining a target abnormal rule, which can extract multiple first factors from multiple abnormal identification rules, and based on a genetic evolutionary algorithm, through an evaluation function, iteratively optimize the individuals in the primary population to obtain a target individual, wherein the individuals in the primary population are determined according to multiple first factors, and the evaluation function is used to evaluate and determine the accuracy of the current rule according to multiple historical data, and the multiple historical data include normal historical data and abnormal historical data. The current rule is determined according to the individuals in the contemporary population; finally, according to the target individual, the target abnormal rule is determined, so that multiple abnormal identification rules can be split into independent factors, each factor focuses on a specific type of abnormality, improves the reusability of the factor, reduces redundancy, and when it is necessary to add or modify a rule, only the corresponding factor needs to be adjusted, without large-scale rectification of the entire rule set, reducing maintenance costs. And combined with the genetic evolutionary algorithm to automatically update, combine and mutate the rules, overcome the problems of unreasonable condition attributes or thresholds, unreasonable rule combination methods, etc. in the existing rule base, improve the accuracy of employee abnormal behavior monitoring, and reduce the probability of internal risks.

[0054] Figure 1 An application scenario diagram provided for an embodiment of the present application, wherein a client sends multiple exception identification rules and multiple historical data to a server, wherein the multiple historical data include normal historical data and abnormal historical data. After receiving the multiple exception identification rules, the server extracts multiple first factors from the multiple exception identification rules, and then based on a genetic evolutionary algorithm, performs iterative optimization on individuals in a primary population through an evaluation function to obtain target individuals, and the individuals in the primary population are all determined based on the multiple first factors; the evaluation function is used to evaluate and determine the accuracy of the current rule based on multiple historical data, and the current rule is determined based on individuals in a contemporary population. Finally, the server determines a target exception rule based on the obtained target individual, and then sends the target exception rule to the client, and the client displays the target exception rule on a display interface after receiving the table exception rule.

[0055] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0056] Figure 2 A flowchart of a method for determining a target anomaly rule provided in an embodiment of the present application is provided. The execution subject of the present embodiment can be any device with a data processing function. The present application is specifically described with the server as the execution subject. Figure 2As shown, an embodiment of the present application provides a method for determining a target abnormal rule, wherein the target abnormal rule is used to identify abnormal behavior of a user and may include:

[0057] Step 201: extract multiple first factors from multiple anomaly identification rules.

[0058] Specifically, the client sends a plurality of anomaly identification rules to the server, and after receiving the plurality of anomaly identification rules, the server extracts a plurality of first factors from the plurality of anomaly identification rules.

[0059] Among them, the anomaly identification rules can be any rules for identifying abnormal behavior, which is not limited in this application. The anomaly identification rules are usually logical or mathematical expressions used to detect abnormal behavior. These rules may consist of a set of conditions, thresholds, and logical operators (such as AND, OR, NOT) to identify abnormal patterns in the data.

[0060] For any anomaly identification rule, a plurality of first factors and the thresholds corresponding to each first factor are elements constituting the anomaly identification rule. The first factor is an indivisible, standardized detection unit.

[0061] For example, a certain abnormal identification rule is: if the transaction amount between 1:00 a.m. and 3:00 a.m. is greater than 10,000 yuan, it is considered as an abnormal behavior of the user, and the user here can be an employee of the bank.

[0062] There are two first factors extracted from the above anomaly identification rules, one is the transaction time, and the other is the transaction amount. The threshold corresponding to the transaction time is from 1:00 to 3:00 in the morning, and the threshold corresponding to the transaction amount is 10,000 yuan.

[0063] Optionally, multiple first factors may be extracted from multiple anomaly identification rules based on factor analysis.

[0064] Among them, the core principle of factor analysis is to extract common characteristics from massive data elements through in-depth research on the correlation between multiple attributes, thereby streamlining redundant data information and improving the ability to conduct in-depth analysis of data details.

[0065] Step 202: Acquire multiple historical data; the multiple historical data include normal historical data and abnormal historical data.

[0066] Specifically, the client sends a plurality of historical data to the server, each of which has a corresponding label, and the label is used to indicate whether the historical data is normal historical data or abnormal historical data. The server obtains the plurality of historical data.

[0067] Optionally, the present application does not limit the order of steps 201 and 202. The client may first send multiple exception identification rules to the server, and then send multiple historical data to the server. Alternatively, the client may first send multiple historical data to the server, and then send multiple exception identification rules. Alternatively, the client may send multiple historical data and multiple exception identification rules to the server at the same time.

[0068] Step 203: Based on the genetic evolution algorithm, the individuals in the primary population are iteratively optimized through an evaluation function to obtain target individuals, wherein the individuals in the primary population are all determined based on the multiple first factors; the evaluation function is used to evaluate and determine the accuracy of the current rule based on the multiple historical data, and the current rule is determined based on the individuals in the contemporary population.

[0069] Specifically, individuals in the primary population may be determined based on multiple first factors, and the present application does not limit the manner in which individuals in the primary population are determined based on multiple first factors.

[0070] In an optional implementation, several first factors can be randomly selected from multiple first factors, and the threshold corresponding to each selected first factor can be determined by an expert or randomly selected, which is not limited in this application. The selected several first factors and each first factor can constitute individuals in the primary population.

[0071] Exemplarily, the multiple first factors are: transaction time, transaction number and transaction amount.

[0072] The initial population includes 3 individuals:

[0073] Individual 1: Trading time: 1:00 a.m. to 3:00 a.m.; Number of transactions: 3 times;

[0074] Individual 2: Number of transactions: 4 times; Transaction amount: 10,000 yuan;

[0075] Individual 3: Trading time: 2:00 a.m. to 5:00 a.m.; Number of transactions: 2 times; Trading amount: 5,000 yuan.

[0076] The current rule is determined based on the individuals in the current population and the combination methods corresponding to the first factors in the individuals. The combination method is the combination method of multiple first factors, which can be: and, or, etc. The combination method can be pre-set, and the combination method corresponding to each individual can be the same, or different combination methods can be set for different individuals.

[0077] If the combination mode pre-set for individual 1 is "and", the current rule determined based on individual 1 is: the transaction time is from 1 am to 3 am, and the number of transactions is greater than 3 times.

[0078] If the combination method pre-set for individual 2 is "or", the current rule determined based on individual 2 is: the number of transactions is greater than 4 times, or the transaction amount is greater than 10,000 yuan.

[0079] If the combination mode pre-set for individual 3 is "first and then either", the current rule determined based on individual 3 is: the transaction time is between 2 am and 5 am, and the number of transactions is greater than 2 times, or the transaction amount is greater than 5,000 yuan. The understanding of "first and then either" can also be set in advance. For example, the current rule determined based on individual 3 can be understood as follows: the transaction time is between 2 am and 5 am and the number of transactions is greater than 2 times, which is considered abnormal behavior; the transaction time is between 2 am and 5 am and the transaction amount is greater than 5,000 yuan, which is also considered abnormal behavior.

[0080] The current rules determined by individual 3 can also be understood as follows: trading time between 2 am and 5 am, and the number of transactions greater than 2 times is considered abnormal behavior; transaction amount greater than 5,000 yuan is considered abnormal behavior.

[0081] After determining the current rule corresponding to each individual, the evaluation function determines the accuracy of the current rule based on the multiple historical data evaluations. Individuals corresponding to the current rule with higher accuracy have a higher probability of entering the next generation. Two or more individuals are selected from the current quasi-group. Through crossover or mutation operations, the first factor corresponding to each individual and the thresholds corresponding to each factor are adjusted to obtain new individuals. The new individuals form a new generation of populations. The evaluation function is used again to evaluate the individuals in the new generation of populations. According to the evaluation results, it is determined whether the preset termination conditions are met, such as reaching the maximum number of iterations or finding the optimal individual that meets the requirements. If the termination conditions are met, the current optimal individual is output; otherwise, the individuals in the current population continue to be iterated.

[0082] Among them, the genetic evolutionary algorithm (GA) is a global optimization search algorithm that simulates the biological evolution process in nature. It searches for the optimal solution or approximate optimal solution in the solution space by simulating biological evolution mechanisms such as natural selection, inheritance and mutation. The genetic evolutionary algorithm has the characteristics of adaptability, global search capability, parallelism and robustness, so it has high practical value in solving complex optimization problems.

[0083] Figure 3 A basic flow chart of a simple genetic evolution algorithm provided in the embodiment of the present application is as follows: Figure 3 As shown in Figure 2, the basic steps of the genetic evolution algorithm are as follows:

[0084] Initialize the population: Randomly generate a certain number of individuals as the initial population.

[0085] Evaluate fitness: Calculate the fitness value of each individual to evaluate its quality.

[0086] Selection operation: Selection is performed based on the fitness value of the individual. Excellent individuals have a higher probability of being selected into the next generation.

[0087] Crossover operation: Randomly select two individuals from the current population, exchange part of their genetic information according to certain rules, and generate new individuals.

[0088] Mutation operation: Randomly mutate the newly generated individuals to increase the diversity of the population.

[0089] Update population: Replace some individuals in the original population with newly generated individuals to form a new generation of population.

[0090] Termination condition judgment: Check whether the preset termination condition is met, such as reaching the maximum number of iterations or finding the optimal solution that meets the requirements. If the termination condition is met, the current optimal solution is output; otherwise, return to step 2, that is, evaluate the fitness, and continue execution.

[0091] The main parameters of the genetic evolution algorithm include population size, crossover probability, mutation probability, selection strategy, etc. The selection and adjustment of these parameters have a great impact on the performance and effect of the algorithm and need to be adjusted according to specific problems.

[0092] Optionally, the method for determining a target anomaly rule provided in the embodiment of the present application further includes:

[0093] According to the plurality of historical data, based on the trained abnormal factor identification model, screening out a plurality of second factors from the plurality of historical data;

[0094] Performing a deduplication operation on the multiple first factors and the multiple second factors to obtain multiple third factors;

[0095] Correspondingly, the individuals in the primary population are all determined based on the multiple third factors.

[0096] Specifically, the server may input a plurality of historical data with labels into a trained abnormal factor identification model, and output a plurality of screened second factors, wherein the trained abnormal factor identification model is used to screen out abnormal factors, namely, second factors, from the plurality of historical data.

[0097] Afterwards, multiple first factors and multiple second factors are deduplicated to obtain multiple third factors. The set consisting of multiple third factors can be regarded as the intersection of the set consisting of multiple first factors and the set consisting of multiple second factors.

[0098] The individuals in the initial population can be determined based on multiple third factors.

[0099] In this way, based on the trained abnormal factor identification model, multiple second factors can be screened out from multiple historical data, which can enrich the source of factors and find key judgment indicators that have not yet been discovered, thereby further improving the accuracy of abnormal behavior identification.

[0100] Optionally, multiple first factors are extracted from multiple exception rules, including:

[0101] For each abnormal rule, determining a plurality of first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor;

[0102] Accordingly, based on the genetic evolution algorithm, the individuals in the initial population are iteratively optimized through the evaluation function to obtain the target individuals, including:

[0103] For each abnormal rule, a plurality of first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor are taken as an individual in the primary population;

[0104] Based on the genetic evolution algorithm, individuals in the primary population are iteratively optimized through an evaluation function to obtain a target individual, wherein the target individual includes at least one target factor and a target threshold value corresponding to each target factor; the at least one target factor is selected from multiple first factors.

[0105] For example, an abnormal rule is: the transaction time is between 1:00 and 3:00 a.m. and the number of transactions exceeds three times. The two first factors corresponding to the abnormal rule are the transaction time and the number of transactions. The first threshold corresponding to the transaction time is: between 1:00 and 3:00 a.m.; the first threshold corresponding to the number of transactions is: three times.

[0106] The individuals corresponding to the above abnormal rules are: trading time: 1:00 to 3:00 in the morning; number of transactions: 3 times.

[0107] The individuals corresponding to the above rules are taken as individuals in the initial population.

[0108] Based on the genetic evolution algorithm, the individuals in the initial population are iteratively optimized through the evaluation function to obtain the target individual, wherein the target individual includes at least one target factor and the target threshold value corresponding to each target factor; the at least one target factor is selected from multiple first factors.

[0109] In this way, using the individuals determined by the existing rule base as the initial population can reduce the number of iterations of the genetic simplification algorithm and improve the efficiency and accuracy of determining the target individuals.

[0110] Optionally, for each abnormal rule, taking multiple first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor as an individual in the primary population includes:

[0111] For each abnormal rule, assign an initial weight to each first factor corresponding to the abnormal rule, and use the multiple first factors corresponding to the abnormal rule, and the first threshold and the initial weight corresponding to each first factor as an individual in the initial population;

[0112] Correspondingly, the target individual also includes the target weights corresponding to each target factor.

[0113] Specifically, the initial weight assigned to each first factor corresponding to the abnormal rule may be determined by an expert or randomly selected, and this application does not limit this.

[0114] Based on the genetic evolution algorithm, in addition to adjusting the multiple first factors corresponding to the individual and the thresholds corresponding to each factor, the weight value corresponding to each first factor can also be dynamically adjusted so that the important first factors have a higher weight. The target individual finally obtained also includes the target weight corresponding to each target factor.

[0115] Exemplarily, an individual in the current population is: opponent account attribute: foreign account, weight: 0.3; transaction amount: 4,000 yuan, weight: 0.2; transaction time: 1:00 to 3:00 in the morning, weight 0.5. The current rule determined based on this individual is: the opponent account attribute is a foreign account, the transaction amount is greater than 4,000 yuan, and the transaction time is from 1:00 to 3:00 in the morning. If a certain historical data satisfies the opponent account attribute of being a foreign account and the transaction time is from 1:00 to 3:00 in the morning, but does not meet the transaction amount greater than 4,000 yuan, then the score is 0.3+0.5=0.8 points. If the preset score exceeds 0.6 points, the historical data is judged to be abnormal historical data, and the accuracy of the current rule is determined based on the judgment result.

[0116] In this way, in addition to adjusting the multiple first factors corresponding to the individual and the thresholds corresponding to each factor, the weight value corresponding to each first factor can also be dynamically adjusted so that important first factors have a higher weight, which can further improve the accuracy of the identified target individual.

[0117] Optionally, for each abnormal rule, taking multiple first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor as an individual in the primary population includes:

[0118] For each abnormal rule, determine the initial combination of multiple first factors corresponding to the abnormal rule; use the multiple first factors corresponding to the abnormal rule, the initial combination, and the first threshold corresponding to each first factor as an individual in the primary population;

[0119] Correspondingly, the target individual also includes target combinations of multiple first factors.

[0120] Specifically, the initial combination mode assigned to each first factor corresponding to the abnormal rule is determined. The initial combination mode may be determined by an expert or randomly selected, and this application does not limit this.

[0121] Based on the genetic evolutionary algorithm, in addition to adjusting the multiple first factors corresponding to the individual and the thresholds corresponding to each factor, the initial combination of each first factor can also be dynamically adjusted. For example, some factors need to be satisfied at the same time to trigger the rule under certain circumstances, while other factors may only need to satisfy one of them. Through the genetic algorithm, these combinations can be automatically explored to find the optimal combination.

[0122] In this way, based on the genetic evolution algorithm, the initial combination method assigned by each first factor can be dynamically adjusted to further improve the accuracy of the determined target individual.

[0123] Optionally, for each abnormal rule, taking multiple first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor as an individual in the primary population includes:

[0124] For each abnormal rule, assign an initial weight to each first factor corresponding to the abnormal rule, and determine an initial combination method of multiple first factors corresponding to the abnormal rule; use the multiple first factors corresponding to the abnormal rule, the initial combination method, and the first threshold and initial weight corresponding to each first factor as an individual in the primary population;

[0125] Correspondingly, the target individual also includes target combinations of multiple first factors and target weights corresponding to each target factor.

[0126] In this way, based on the genetic evolution algorithm, the initial combination of multiple first factors and the initial combination assigned by each first factor can be dynamically adjusted, which can further improve the accuracy of the determined target individuals.

[0127] Optionally, the evaluation function of the genetic evolution algorithm includes: rule hit rate, rule false alarm rate and rule complexity;

[0128] The rule hit rate is used to indicate the proportion of abnormal historical data correctly identified by the current rule to all abnormal historical data; the current rule is determined based on individuals in the contemporary population;

[0129] The rule false alarm rate is used to indicate the ratio of the number of normal historical data misjudged as abnormal historical data by the current rule to all normal historical data;

[0130] The rule complexity is used to indicate the complexity of the current rule, which is positively correlated to the number of factors involved, the number and nesting levels of logical operators, and the time taken for execution, wherein the number and nesting levels of logical operators are determined according to the combination of individuals included in the contemporary population.

[0131] In this way, the evaluation function provides a comprehensive and flexible optimization framework for the genetic evolution algorithm by comprehensively considering the accuracy, false alarm rate and complexity of the rules. This not only improves the effect of anomaly detection, but also ensures the simplicity and execution efficiency of the rules, making them more practical.

[0132] Step 204: Determine a target anomaly rule based on the target individual.

[0133] Specifically, when the target individual only includes the target factor and the target threshold corresponding to the target factor, the target abnormality rule is determined according to the target factor, the target threshold corresponding to the target factor and the preset combination method, and / or the preset weights corresponding to each target factor.

[0134] When the target individual includes a target factor, a target threshold corresponding to the target factor, and a target combination method, the target anomaly rule is determined according to the target factor, the target threshold corresponding to the target factor, the target combination method, and / or the preset weights corresponding to each target factor.

[0135] When the target individual includes a target factor, a target threshold corresponding to the target factor, and a target weight corresponding to each target factor, the target anomaly rule is determined according to the target factor, the target threshold corresponding to the target factor, the target weight corresponding to each target factor, and / or a preset combination.

[0136] When the target individual includes the target factor, the target threshold corresponding to the target factor, the target weight corresponding to each target factor, and the target combination method, the target abnormality rule is determined according to the target factor, the target threshold corresponding to the target factor, the target weight corresponding to each target factor, and the target combination method.

[0137] The method for determining the target abnormal rule provided by the embodiment of the present application is to extract multiple first factors from multiple abnormal identification rules; obtain multiple historical data; the multiple historical data include normal historical data and abnormal historical data; based on the genetic evolution algorithm, through the evaluation function, iteratively optimize the individuals in the primary population to obtain the target individual, wherein the individuals in the primary population are all determined according to the multiple first factors; the evaluation function is used to evaluate and determine the accuracy of the current rule according to the multiple historical data, and the current rule is determined according to the individuals in the contemporary population; according to the target individual, determine the target abnormal rule, so that multiple abnormal identification rules can be split into independent factors, each factor focuses on a specific type of abnormality, improves the reusability of the factor, reduces redundancy, and when it is necessary to add or modify a rule, only the corresponding factor needs to be adjusted, without large-scale rectification of the entire rule set, reducing maintenance costs. And combined with the genetic evolution algorithm to automatically update, combine and mutate the rules, overcome the problems of unreasonable condition attributes or thresholds, unreasonable rule combination methods, etc. in the existing rule base, improve the accuracy of employee abnormal behavior monitoring, and reduce the probability of internal risks.

[0138] The embodiment of the present application also provides another method for determining a target anomaly rule, where the target anomaly rule is used to determine abnormal transactions of internal bank employees.

[0139] The main steps are as follows:

[0140] (1) Abnormal transaction information collation: The system first collects suspicious event information including rule numbers and rule codes (specific to employee transaction abnormality monitoring rules). This information will serve as the basic data for monitoring employee transaction abnormalities. The data comes from independent factors split from the original rule base: each rule in the rule base defined by business experts is split into multiple factors, each factor contains specific attributes and thresholds.

[0141] (2) Analysis of abnormal transaction factor triggers: The system analyzes the triggering of factors such as the principal customer number, customer account number, bookkeeping account number, serial number, amount, currency, counterparty account number and transaction date in the employee transaction data in suspicious cases. This will help the system identify which factors are key indicators of abnormal transactions.

[0142] (3) Combined with genetic evolution algorithm: Using the original rule base factor data set as the initial population, the automatic optimization of rules is achieved through operations such as selection, crossover, and mutation.

[0143] (4) Factor combination optimization: In the genetic evolution algorithm, an optimization strategy for factor combination is introduced. By adjusting the combination method and weights of factors, efficient coordination between rules is achieved, thereby improving the overall hit rate of rules.

[0144] (5) Evaluation mechanism: Set an evaluation function to evaluate the rules optimized by the genetic evolution algorithm and select the best rules to enter the next generation population. The evaluation function includes the following factors: first, the hit rate of the rule: that is, the proportion of abnormal trading behaviors that the rule can correctly identify; second, the false alarm rate of the rule: that is, the proportion of normal trading behaviors that the rule misjudges as abnormal trading behaviors; third, the complexity of the rule: that is, the number of factors contained in the rule and the complexity of the combination method.

[0145] (6) Continuous optimization:

[0146] Specific optimization strategies can include the following aspects. Weight adjustment: assign a weight value to each factor, and dynamically adjust these weight values ​​through crossover and mutation operations in genetic algorithms, so that important factors have higher weights in the rules; combination optimization: in addition to weight adjustment, the combination of factors can also be considered. For example, some factors need to be met at the same time in certain circumstances to trigger the rules, while other factors may only need to meet one of them. Through genetic algorithms, these combinations can be automatically explored to find the optimal combination. Evaluation function: used to measure the performance of optimized rules.

[0147] (7) Once the system identifies an abnormal transaction, it will immediately trigger an early warning mechanism to notify relevant personnel for further investigation and processing. At the same time, the system will also generate a detailed abnormal transaction report so that management can understand the current risk situation and take appropriate measures.

[0148] This method is based on a factor system for monitoring abnormal trading behavior of employees. It innovatively refines the monitoring rules into factors composed of attributes and parameters through big data analysis technology, and introduces an optimization strategy for the combination of factors by combining genetic evolutionary algorithms. By adjusting the combination method and weights of factors, efficient coordination between rules is achieved, and a highly reusable and easy-to-expand factor system is constructed to enhance the comprehensiveness and accuracy of the rules in monitoring suspicious trading behaviors of employees.

[0149] The present application also provides an anomaly detection method, including:

[0150] Acquire at least one piece of data to be detected;

[0151] The at least one data to be detected is detected based on the target anomaly rule to determine the detection result corresponding to each data to be detected, and the detection result is used to indicate whether the data to be detected is abnormal, wherein the target anomaly rule is the target anomaly rule described in any of the above embodiments.

[0152] Corresponding to the above-mentioned method for determining target abnormality rules, the embodiment of the present application further provides a device for determining target abnormality rules. Figure 4This is a schematic diagram of the structure of the device for determining the target abnormal rule provided by the present application, wherein the target abnormal rule is used to identify the abnormal behavior of the user, such as Figure 4 As shown, the target abnormality rule determination device provided in this embodiment includes:

[0153] An extraction module 401 is used to extract a plurality of first factors from a plurality of anomaly identification rules;

[0154] The acquisition module 402 is used to acquire a plurality of historical data; the plurality of historical data includes normal historical data and abnormal historical data;

[0155] Iteration module 403, used for iteratively optimizing individuals in the primary population based on the genetic evolution algorithm through an evaluation function to obtain target individuals, wherein the individuals in the primary population are all determined according to the multiple first factors; the evaluation function is used for evaluating and determining the accuracy of the current rule according to the multiple historical data, and the current rule is determined according to the individuals in the contemporary population;

[0156] The determination module 404 is used to determine a target abnormality rule according to the target individual.

[0157] Optionally, the iteration module 403 is further used for:

[0158] According to the plurality of historical data, based on the trained abnormal factor identification model, screening out a plurality of second factors from the plurality of historical data;

[0159] Performing a deduplication operation on the multiple first factors and the multiple second factors to obtain multiple third factors;

[0160] Correspondingly, the individuals in the primary population are all determined based on the multiple third factors.

[0161] Optionally, the refining module 401 is specifically used for:

[0162] For each abnormal rule, determining a plurality of first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor;

[0163] Accordingly, the iteration module 403 is specifically used for:

[0164] For each abnormal rule, a plurality of first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor are taken as an individual in the primary population;

[0165] Based on the genetic evolution algorithm, individuals in the primary population are iteratively optimized through an evaluation function to obtain a target individual, wherein the target individual includes at least one target factor and a target threshold value corresponding to each target factor; the at least one target factor is selected from multiple first factors.

[0166] Optionally, when the iteration module 403 uses, for each abnormal rule, a plurality of first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor as an individual in the primary population, the following is specifically used:

[0167] For each abnormal rule, assign an initial weight to each first factor corresponding to the abnormal rule, and use the multiple first factors corresponding to the abnormal rule, and the first threshold and the initial weight corresponding to each first factor as an individual in the initial population;

[0168] Correspondingly, the target individual also includes the target weights corresponding to each target factor.

[0169] Optionally, when the iteration module 403 uses, for each abnormal rule, a plurality of first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor as an individual in the primary population, the following is specifically used:

[0170] For each abnormal rule, determine the initial combination of multiple first factors corresponding to the abnormal rule; use the multiple first factors corresponding to the abnormal rule, the initial combination, and the first threshold corresponding to each first factor as an individual in the primary population;

[0171] Correspondingly, the target individual also includes target combinations of multiple first factors.

[0172] Optionally, the evaluation function of the genetic evolution algorithm includes: rule hit rate, rule false alarm rate and rule complexity;

[0173] The rule hit rate is used to indicate the proportion of abnormal historical data correctly identified by the current rule to all abnormal historical data; the current rule is determined based on individuals in the contemporary population;

[0174] The rule false alarm rate is used to indicate the ratio of the number of normal historical data misjudged as abnormal historical data by the current rule to all normal historical data;

[0175] The rule complexity is used to indicate the complexity of the current rule, which is positively correlated to the number of factors involved, the number and nesting levels of logical operators, and the time taken for execution, wherein the number and nesting levels of logical operators are determined according to the combination of individuals included in the contemporary population.

[0176] The target anomaly rule determination device provided in this embodiment can execute the method provided in the above method embodiment, and its implementation principle and technical effect are similar, which will not be described in detail in this embodiment.

[0177] Figure 5This is a schematic diagram of the structure of the electronic device provided in this application. Figure 5 As shown, the electronic device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the device 50 also includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0178] In a specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502, so that at least one processor 501 executes the above method.

[0179] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0180] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0181] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0182] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0183] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0184] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0185] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0186] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0187] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0188] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0189] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0190] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0191] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0192] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for determining a target anomaly rule, characterized in that: The target anomaly rule is used to identify abnormal behavior of users, including: Extracting multiple first factors from multiple anomaly identification rules; Acquire multiple historical data; the multiple historical data include normal historical data and abnormal historical data; Based on the genetic evolution algorithm, the individuals in the primary population are iteratively optimized through an evaluation function to obtain a target individual, wherein the individuals in the primary population are all determined according to the multiple first factors; the evaluation function is used to evaluate and determine the accuracy of the current rule according to the multiple historical data, and the current rule is determined according to the individuals in the contemporary population; According to the target individual, a target abnormality rule is determined.

2. The method according to claim 1, characterized in that: The method further comprises: According to the plurality of historical data, based on the trained abnormal factor identification model, screening out a plurality of second factors from the plurality of historical data; Performing a deduplication operation on the multiple first factors and the multiple second factors to obtain multiple third factors; Correspondingly, the individuals in the primary population are all determined based on the multiple third factors.

3. The method according to claim 1, characterized in that Multiple first factors are extracted from multiple abnormal rules, including: For each abnormal rule, determining a plurality of first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor; Accordingly, based on the genetic evolution algorithm, the individuals in the initial population are iteratively optimized through the evaluation function to obtain the target individuals, including: For each abnormal rule, a plurality of first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor are taken as an individual in the primary population; Based on the genetic evolution algorithm, individuals in the primary population are iteratively optimized through an evaluation function to obtain a target individual, wherein the target individual includes at least one target factor and a target threshold value corresponding to each target factor; the at least one target factor is selected from multiple first factors.

4. The method according to claim 3, characterized in that For each abnormal rule, a plurality of first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor are taken as an individual in the primary population, including: For each abnormal rule, assign an initial weight to each first factor corresponding to the abnormal rule, and use the multiple first factors corresponding to the abnormal rule, and the first threshold and initial weight corresponding to each first factor as an individual in the initial population; Correspondingly, the target individual also includes the target weights corresponding to each target factor.

5. The method according to claim 3, characterized in that: For each abnormal rule, a plurality of first factors corresponding to the abnormal rule and a first threshold corresponding to each first factor are taken as an individual in the primary population, including: For each abnormal rule, determine the initial combination of multiple first factors corresponding to the abnormal rule; use the multiple first factors corresponding to the abnormal rule, the initial combination, and the first threshold corresponding to each first factor as an individual in the primary population; Correspondingly, the target individual also includes target combinations of multiple first factors.

6. The method according to claim 5, characterized in that The evaluation functions of the genetic evolution algorithm include: rule hit rate, rule false alarm rate and rule complexity; The rule hit rate is used to indicate the proportion of abnormal historical data correctly identified by the current rule to all abnormal historical data; the current rule is determined based on individuals in the contemporary population; The rule false alarm rate is used to indicate the ratio of the number of normal historical data misjudged as abnormal historical data by the current rule to all normal historical data; The rule complexity is used to indicate the complexity of the current rule, which is positively correlated to the number of factors involved, the number and nesting levels of logical operators, and the time taken for execution, wherein the number and nesting levels of logical operators are determined according to the combination of individuals included in the contemporary population.

7. A device for determining target abnormality rules, characterized in that: The target anomaly rule is used to identify abnormal behavior of users, including: An extraction module, used for extracting a plurality of first factors from a plurality of anomaly identification rules; An acquisition module, used for acquiring a plurality of historical data; the plurality of historical data includes normal historical data and abnormal historical data; An iterative module, used for iteratively optimizing individuals in a primary population based on a genetic evolution algorithm through an evaluation function to obtain a target individual, wherein the individuals in the primary population are all determined according to the multiple first factors; the evaluation function is used for evaluating and determining the accuracy of a current rule according to the multiple historical data, and the current rule is determined according to individuals in a contemporary population; A determination module is used to determine a target abnormality rule according to the target individual.

8. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images