Bank transaction risk assessment method based on big data analysis

Abstract

The invention relates to the technical field of financial intelligent risk management and control, and discloses a bank transaction risk assessment method based on big data analysis, and the method comprises the steps: collecting historical bank transaction data, extracting abnormal transaction data and related influence factors, and carrying out the analysis of the abnormal transaction data; the abnormal transaction data comprises abnormal indexes of transaction amount, transaction frequency, geographic position and user behavior mode; constructing a risk assessment model by using a big data analysis technology, performing weight distribution and feature extraction on the associated influence factors, and generating a dynamic risk assessment rule; and inputting real-time bank transaction data into the risk assessment model, calculating a risk probability value of the transaction, dividing the risk probability value into a high level, a middle level and a low level according to a dynamic risk assessment rule, and storing the risk probability value into a hierarchical database. According to the invention, the attention mechanism and incremental learning are combined and applied to the dynamic allocation of the risk weights, so that the automatic closed loop of risk grading and disposal strategies is realized, and the early warning accuracy and real-time performance of transaction risks are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of financial intelligent risk control, and particularly to a bank transaction risk assessment method based on big data analysis. Background Art

[0002] With the accelerating advancement of the financial digitalization process, the bank transaction risk assessment technology has gradually evolved from the traditional rule engine-driven to an intelligent analysis system. At the technical development level, the current mainstream methods mainly rely on machine learning algorithms and statistical analysis models. Among them, classification algorithms such as random forest and support vector machine under the supervised learning framework have formed a standardized application paradigm in the field of abnormal transaction recognition.

[0003] In the prior art, there are still several bottlenecks that need to be urgently broken through: First, the traditional supervised learning model highly depends on the quality of labeled samples, and the rapid iteration of new fraud patterns in actual business leads to insufficient generalization ability of the model, and there is a significant "concept drift" problem; Second, there are technical obstacles in the integration of multi-dimensional heterogeneous data, and it is difficult to effectively couple geographical spatial information, user behavior trajectories and transaction timing characteristics, resulting in a single dimension of risk factor extraction; Third, the existing dynamic weight allocation mechanism mostly adopts the moving average method with a fixed time window, lacking the elastic response ability to sudden risk events.

[0004] In terms of real-time performance, the batch processing-based computing architecture is difficult to meet the millisecond-level risk interception requirement, and although the streaming computing framework can improve the processing speed, it faces technical challenges such as feature drift and online model update; In addition, the existing risk level classification mostly adopts the static threshold method, without fully considering the dynamic influence of exogenous variables such as market environment and regulatory policies, resulting in a high false alarm rate of risk warning.

[0005] Currently, the traditional method has obvious shortcomings in user behavior pattern modeling, and fails to effectively integrate new data sources such as mobile terminal sensor data and biometric recognition information, restricting the dimension and accuracy of risk assessment. Summary of the Invention

[0006] The purpose of this part is to outline some aspects of the embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this part, the abstract of the specification and the title of the invention of the present application to avoid obscuring the purpose of this part, the abstract of the specification and the title of the invention, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0007] In view of the above existing problems, the present invention is proposed.

[0008] Therefore, the technical problem solved by the present invention is that the existing bank transaction risk assessment technology has problems of insufficient dynamic adaptability, low multi-dimensional data integration degree, and weak real-time response efficiency.

[0009] To solve the above technical problems, the present invention provides the following technical solutions: collect historical bank transaction data, extract abnormal transaction data and its associated influencing factors, and the abnormal transaction data includes abnormal indicators of transaction amount, transaction frequency, geographical location, and user behavior pattern;

[0010] Use big data analysis technology to construct a risk assessment model, assign weights and extract features for the associated influencing factors, and generate dynamic risk assessment rules;

[0011] Input real-time bank transaction data into the risk assessment model, calculate the risk probability value of the transaction, and divide it into three levels of high, medium, and low according to the dynamic risk assessment rules, and store it in the hierarchical database.

[0012] As a preferred solution of the bank transaction risk assessment method based on big data analysis of the present invention, the extraction of the abnormal transaction data includes:

[0013] Based on the historical transaction amount distribution, use the 3σ principle and the interquartile range algorithm to identify outliers. If the current transaction amount meets one of the abnormal determination conditions, it is determined as abnormal;

[0014] Calculate the number of transactions per unit time by the time window sliding statistical method. If the current transaction frequency exceeds 200% of the highest frequency in the same historical period, it is determined as abnormal;

[0015] Based on the longitude and latitude coordinates of the user's common location, use the Haversine formula to calculate the distance deviation between the real-time transaction location and the common location. If the distance exceeds 100 kilometers, an abnormality is triggered;

[0016] Statistically analyze the user's operation habits through a sliding window, and use KL divergence to detect sudden changes in behavior distribution. If the divergence value exceeds 0.5, it is determined as abnormal;

[0017] Among them, the abnormal determination conditions include:

[0018] The absolute difference between the transaction amount and the historical mean exceeds 3 times the standard deviation;

[0019] The transaction amount is lower than the first quartile minus 1.5 times the interquartile range, or higher than the third quartile plus 1.5 times the interquartile range.

[0020] As a preferred solution of the bank transaction risk assessment method based on big data analysis of the present invention, the extraction of the associated influencing factors includes:

[0021] Obtain the user's credit score from the central bank's credit investigation system or a third-party credit agency. If the user's credit score is lower than 600 points, it is listed as a high-risk associated factor;

[0022] Count the number of overdue times of the user account in the past year. If the number ≥ 3 times, it is listed as a medium-high risk factor;

[0023] Extract the transaction device ID, MAC address, and browser fingerprint. If there is no historical record in the device fingerprint database, it is marked as suspicious;

[0024] Compare through the blacklist database. If the IP address is involved in a known fraud area, it is listed as a high risk factor;

[0025] Define the inactive period as from 22:00 local time to 6:00 the next day. If the transaction occurs within this interval and the amount exceeds 50% of the daily average value, it is listed as a high risk factor.

[0026] As a preferred solution of the bank transaction risk assessment method based on big data analysis described in the present invention, the construction of the risk assessment model includes:

[0027] Perform Z-Score standardization processing on numerical features to eliminate the dimension difference;

[0028] Use One-Hot encoding for discrete features to generate a sparse matrix;

[0029] Fill in the missing fields with the mode of the historical data of similar users and add a flag bit;

[0030] Use the random forest algorithm to calculate the feature contribution degree, and retain the features with the top 80% contribution degree ranking;

[0031] Optimize the feature weights based on the gradient boosting decision tree, update the weights through incremental learning every 24 hours, and the single training time limit is ≤ 5 minutes;

[0032] Construct a neural network model, which includes at least an input layer, two hidden layers, and an output layer;

[0033] Among them, the output layer uses the Sigmoid activation function and is trained through the Adam optimizer. The two hidden layers respectively contain 128 and 64 nodes.

[0034] As a preferred solution of the bank transaction risk assessment method based on big data analysis described in the present invention, the generation of dynamic risk assessment rules includes:

[0035] Fully update the rule library every hour, and the update time is within 5 minutes after the hour;

[0036] When the change rate of the user behavior pattern exceeds 10%, a new blacklist is pushed in the external risk intelligence, or the false alarm rate / miss rate of the model exceeds 5% for 3 consecutive hours, an update is immediately triggered;

[0037] Extract data from the samples of nearly 30 high-risk transactions, use the Apriori algorithm to mine frequent itemsets, and generate association rules;

[0038] If there is a conflict between the thresholds of the old and new rules, retain the rule with a high recall rate according to the recall rate priority;

[0039] The generated new rules need to be verified in the sandbox environment with an accuracy rate ≥ 95%, and gradually replace the old rules through the blue-green deployment strategy.

[0040] As a preferred solution of the bank transaction risk assessment method based on big data analysis described in the present invention, the risk probability value of the calculation transaction is realized by the following formula:

[0041]

[0042] Among them, w i is the feature dynamic weight, x i is the normalized feature value, b is the bias term, n is the number of features, and e is the natural constant.

[0043] As a preferred solution of the bank transaction risk assessment method based on big data analysis described in the present invention, setting the risk level division threshold according to the risk probability value includes:

[0044] When P(r) ≥ 0.7, the risk level is high risk, and real-time transaction interception is triggered;

[0045] When 0.3 ≤ P(r) < 0.7, the risk level is medium risk, and secondary verification is triggered;

[0046] When P(r) < 0.3, the risk level is low risk, and only the log is recorded.

[0047] As a preferred solution of the bank transaction risk assessment method based on big data analysis described in the present invention, storing the high, medium, and low three risk levels in a hierarchical database includes:

[0048] High-risk data is stored in an independent SSD encrypted partition, with a retention period ≥ 5 years, using AES-256 encryption and dynamic key management;

[0049] Medium-risk data is stored in a distributed columnar database, with a retention period of 2 years, and 10% of the data is extracted every six months for model retraining;

[0050] Low-risk data is compressed and stored in Parquet format, with a retention period of 6 months, and is automatically cleared after expiration.

[0051] As a preferred solution of the bank transaction risk assessment method based on big data analysis according to the present invention, based on the similarity matching between real-time transaction data and historical data in the hierarchical database, a warning signal of the corresponding level is triggered, and the similarity matching adopts an improved cosine similarity algorithm, including:

[0052] Convert the real-time transaction data and historical data into multi-dimensional feature vectors, including normalized transaction amounts, timestamp encodings, geographical location hash values, and behavior pattern embedding vectors;

[0053] Calculate the weighted cosine similarity in the feature space, and calculate the total similarity by combining the cosine similarity and the normalized Euclidean distance. Among them, the weight of the cosine similarity is set to 0.6, and the weight of the normalized Euclidean distance is set to 0.4;

[0054] If the similarity exceeds the preset threshold, it is determined as a similar risk event and a warning is triggered;

[0055] Among them, the basic value of the preset threshold is 0.85. If the fraud rate rises by more than 20%, it is adjusted down to 0.75. If the system load is lower than 30%, it is adjusted up to 0.9. Manual intervention is allowed to adjust the range by ±0.1.

[0056] Advantages of the present invention:

[0057] 1. By adopting an unsupervised anomaly detection module based on the isolation forest algorithm and cooperating with an adaptive sliding time window mechanism, it effectively overcomes the high dependence of traditional supervised learning on labeled data, and identifies the non-linear coupling relationship between cross-dimensional influencing factors through association rule mining technology, such as the collaborative anomaly of high-frequency small-amount transactions and geographical location mutations, providing a feature space with high information density for subsequent model training;

[0058] 2. By introducing a dynamic feature weight allocation algorithm and an attention mechanism, heterogeneous integration of the LSTM time series modeling unit and the GNN topology analysis module is carried out, and a gated fusion mechanism is used to jointly encode the spatio-temporal features of the transaction link, solving the problem of model rigidity caused by static weight allocation in traditional methods. Through the cooperation of the online incremental learning algorithm and the sliding time window, the model can capture the influence of exogenous variables such as market policy changes and new crime methods in real time, shortening the dynamic adjustment delay of the feature weight matrix from 6-8 hours in traditional methods to within 15 minutes;

[0059] 3. By mapping the risk probability values to the three-dimensional decision space constructed by the dynamic Gaussian mixture model and combining with the real-time market risk index for threshold elasticity calibration, the hierarchical database adopts columnar storage and vectorized indexing technology, compressing the retrieval response time of high-dimensional risk features to the microsecond level. At the same time, it supports 72-dimensional correlation traceability required for regulatory auditing. Through the automatic mapping mechanism of risk levels and disposal strategies, a closed-loop management from risk identification to the execution of control measures is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings. Among them:

[0061] Figure 1 It is a flowchart of a bank transaction risk assessment method based on big data analysis shown in the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0062] To make the above objects, features, and advantages of the present invention more obvious and understandable, the specific embodiments of the present invention will be described in detail below with reference to the drawings of the specification. Obviously, the described embodiments are some embodiments of the present invention, not all embodiments.

[0063] Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0064] In the following description, many specific details are set forth to fully understand the present invention. However, the present invention can also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the connotation of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed below.

[0065] According to the embodiments of the present invention, in combination with Figure 1 the flowchart shown, a bank transaction risk assessment method based on big data analysis specifically includes the following steps:

[0066] S1. Collect historical bank transaction data, extract abnormal transaction data and its associated influencing factors. The abnormal transaction data includes abnormal indicators such as transaction amount, transaction frequency, geographical location, and user behavior patterns. Here, it should be noted that the extraction of abnormal transaction data includes:

[0067] In an alternative embodiment, the anomaly detection of the transaction amount is based on the historical transaction amount distribution, and the 3σ principle and the interquartile range (IQR) algorithm are used to identify outliers. If the transaction amount meets any of the following conditions, it is determined to be abnormal:

[0068] |x - μ| > 3σ or x < Q1 - 1.5×IQR or x > Q3 + 1.5×IQR;

[0069] where x is the current transaction amount, μ is the historical amount mean, σ is the historical amount standard deviation, Q1 and Q3 are the first and third quartiles respectively, and IQR = Q3 - Q1, which is the interquartile range;

[0070] In an alternative embodiment, the anomaly detection of the transaction frequency is through the time window sliding statistical method to calculate the number of transactions within a unit time. If it exceeds 200% of the highest frequency in the same historical period, it is determined to be abnormal;

[0071] In an alternative embodiment, the determination of geographical location anomaly is based on the user's usual location (longitude L user , latitude B user ). The Haversine formula is used to calculate the distance deviation of the real-time transaction location (longitude L real , latitude B real ). The calculation formula is:

[0072]

[0073] ΔL = L real - L user

[0074] ΔB = B real - B user

[0075] where R is the radius of the earth; if d > 100 km, an anomaly is triggered;

[0076] In an alternative embodiment, for the anomaly of the user behavior pattern, a sliding window is used to statistically analyze the user's operation habits (such as login time, device type), and the KL divergence is used to detect mutations in the behavior distribution. If the divergence value D L

[0077] > 0.5, it is determined to be abnormal.

[0078] Furthermore, it should also be noted in this step that the extraction rules for associated influencing factors include:

[0079] User credit score: Obtain a dynamic score from the central bank's credit investigation system or a third-party credit institution. If the score is lower than 600 points, it is listed as a high-risk associated factor;

[0080] Account historical overdue records: Count the number of overdue times in the past year. If the number ≥ 3 times, it is listed as a medium-high risk factor;

[0081] Transaction device fingerprint features: Extract the device ID, MAC address, and browser fingerprint. If there is no historical record in the device fingerprint library, it is marked as suspicious;

[0082] IP address credibility: By comparing with the blacklist library, if the IP address is involved in known fraud regions (such as specific countries or autonomous states), it is listed as a high risk factor;

[0083] Abnormality of transaction time period: Define the inactive period as from 22:00 local time to 6:00 the next day. If a transaction occurs within this interval and the amount exceeds 50% of the daily average value, an anomaly is triggered.

[0084] S2. Use big data analysis technology to construct a risk assessment model, assign weights and extract features for the associated influencing factors, and generate dynamic risk assessment rules. Among them, it should be noted in this step that:

[0085] In an optional implementation, for numerical features (such as transaction amount, frequency), Z-Score standardization is adopted to eliminate the dimension difference; for discrete features (such as device type, geographical location), One-Hot encoding is adopted to generate a sparse matrix to avoid bias introduced by numerical magnitudes; for missing fields, the mode or mean of historical data of similar users is used for filling, and the filling positions are marked to distinguish the original data.

[0086] Exemplarily, the random forest algorithm (the number of trees ≥ 100, maximum depth = 10) is used to calculate the feature contribution degree, and its contribution degree calculation method is:

[0087]

[0088] Among them, Importance i is the importance of the i-th feature, N rees is the total number of decision trees, GiniDecrease i (t) is the reduction in the Gini coefficient brought by the i-th feature in the t-th tree;

[0089] Retain the features with the top 80% contribution degree rankings, and eliminate low contribution degree features (such as user gender) to reduce model redundancy;

[0090] Optimize the feature weight w based on the gradient boosting decision tree, and its objective function is:

[0091]

[0092] Among them, y j is the label (0 or 1) of the j-th sample, P(rj ) is the predicted probability of the j-th sample, w is the feature weight vector, λ = 0.01, which is the regularization coefficient for controlling overfitting, represents the vector norm;

[0093] The weights are updated through incremental learning every 24 hours. When updating, only 10% of the newly added data is loaded to balance the computational efficiency.

[0094] In an alternative embodiment, a neural network structure is adopted for constructing the risk assessment model, where: input layer (feature dimension m) → hidden layer 1 (128 nodes, ReLU activation) → hidden layer 2 (64 nodes, ReLU activation) → output layer (1 node, Sigmoid activation);

[0095] Further, the loss function of the model adopts binary cross-entropy, and the optimizer is Adam (learning rate = 0.001, momentum parameter β1 = 0.9, β2 = 0.999). Exemplarily, the update formula of the optimizer Adam is:

[0096]

[0097] where, m t and v t are the exponentially weighted moving averages of the first-order and second-order gradients respectively, is the value after correcting the bias, θ t represents the model parameters at the t-th iteration, represents the gradient of the loss function with respect to the parameter θ, α represents the learning rate, and is the smoothing term;

[0098] Early stopping is used during training. If the loss function does not decrease for 3 consecutive rounds on the validation set, the training is stopped.

[0099] In an alternative embodiment, the generation of the dynamic risk assessment rule includes:

[0100] The rule base is updated once an hour, and the update basis includes the latest risk event labels (such as fraud transaction confirmation results), triggering rule reconstruction when the change rate of the user behavior pattern exceeds 10%, and automatically synchronizing external risk intelligence (such as the update of the central bank's anti-money laundering list) to the rule base;

[0101] Further, the rule update trigger conditions include:

[0102] Time trigger: The rule base is updated in full once an hour, and the update time is within 5 minutes after the hour;

[0103] Event trigger: Update immediately when any of the following conditions is met:

[0104] The change rate of the user behavior pattern ΔB exceeds 10%, which is defined as follows:

[0105]

[0106] Among them, V new , V old respectively represent the user's new behavior vector and old behavior vector. If ΔB > 10%, the rule update is triggered;

[0107] The external risk intelligence interface (such as the central bank's anti-money laundering system) pushes the newly added high-risk account or IP blacklist;

[0108] The false positive rate or false negative rate of the model exceeds 5% for 3 consecutive hours.

[0109] It should be noted that the reconstruction of the dynamic risk assessment rules includes:

[0110] Screen high-risk transaction samples (labeled as 1) and an equal amount of normal samples within the last 30 days from historical data, and recalculate the feature weights;

[0111] Use the Apriori algorithm to mine frequent item sets, with a minimum support of 0.1% and a minimum confidence of 70%, to generate association rules such as "Device A + IP address B → High risk";

[0112] If there is a conflict in the thresholds of the old and new rules (such as the old rule threshold is amount > 100,000 yuan and the new rule is > 50,000 yuan), then retain the rule with a high recall rate according to the recall rate priority.

[0113] In an alternative implementation, the new rule runs in an isolated environment for sandbox testing, is verified using a test set (accounting for 20%), and requires an accuracy rate ≥ 95% and a misjudgment rate ≤ 3%; adopt a blue-green deployment strategy, first replace 10% of the server nodes, monitor the real-time misjudgment rate, and if there is no abnormality within 1 hour, go live in full volume.

[0114] It should also be noted in this embodiment that the traditional method uses simple numerical mapping for discrete features (such as device type), resulting in misjudged correlations in the model. For example, encoding the device type as 1 / 2 / 3 will introduce a false order relationship; while the method provided in the embodiment of the present invention eliminates the feature coupling effect through heterogeneous data processing, establishes a unified representation space, and maps discrete features to a high-dimensional sparse matrix through One-Hot encoding to eliminate the pseudo-order relationship; for example, after encoding the device type (mobile phone / PC / ATM), the model can capture independent risk features such as "ATM device + off-site login", and the misjudgment rate is reduced; when performing mode filling + marker bit processing for missing values, the original data and patched data are distinguished by filling indicators to avoid the interference of traditional mean filling on anomaly detection. For example, if the missing transaction amount is filled with the mean, it will cover up the real anomaly.

[0115] Traditional static weight allocation methods (such as fixed coefficients in logistic regression) cannot adapt to the mutation of fraud patterns. For example, the surge in online transactions during the epidemic has led to the drift of risk characteristics. In this step, the time-varying response of feature weights is achieved by combining the optimization of the dynamic weight allocation algorithm (GBDT) and incremental learning. Among them, the synergistic effect of the cross-entropy term and L2 regularization in the GBDT objective function enables the weight vector w to maintain low variance characteristics while ensuring classification accuracy.

[0116] Preferably, fixed rule bases (such as IF-THEN rules) are difficult to cope with the rule detection and avoidance strategies of black production gangs. In this embodiment, by setting the thresholds of support 0.1% and confidence 70% in the Apriori algorithm, low-frequency high-risk patterns (such as "10 small cross-bank transfers initiated by the same device within 5 minutes") can be effectively captured.

[0117] S3. Input the real-time bank transaction data into the risk assessment model, calculate the risk probability value of the transaction, and divide it into three levels: high, medium, and low according to the dynamic risk assessment rules, and store it in the hierarchical database.

[0118] It should be noted in this step that:

[0119] As an example, the risk probability value of the transaction is calculated through the following formula:

[0120]

[0121] Among them, w i is the dynamic weight of the feature, x i is the normalized feature value, b is the bias term, n is the number of features, and e is the natural constant;

[0122] The setting of the risk level division threshold according to the risk probability value includes:

[0123] When P(r)≥0.7, the risk level is high risk, and real-time transaction interception is triggered;

[0124] When 0.3≤P(r)<0.7, the risk level is medium risk, and secondary verification is triggered;

[0125] When P(r)<0.3, the risk level is low risk, and only the log is recorded.

[0126] In an alternative embodiment, the hierarchical storage includes:

[0127] High-risk data: Stored in an independent SSD encrypted partition, with a read / write latency ≤10ms, encrypted using the AES-256 algorithm, the key is managed by a hardware security module, a temporary key needs to be dynamically generated for each access, the retention period ≥5 years, and a data integrity check is performed once a year (such as comparing SHA-256 hash values);

[0128] Medium-risk data: Stored in a distributed database (such as HBase), compressed using column family compression (Snappy algorithm), access requires dynamic token authorization, the token validity period ≤ 5 minutes, the retention period is 2 years, and 10% of the data is extracted every six months for model retraining;

[0129] Low-risk data: Compressed into Parquet format and stored in object storage, with metadata retained for quick retrieval, retained for 6 months, marked as to be deleted after expiration, and a physical deletion task is executed at 2:00 am every day.

[0130] It should be noted that accessing high-risk data requires dual authentication (fingerprint / face recognition + dynamic SMS verification code), and operation logs are recorded (including IP, time, operator). The operation log record fields include operation time, IP address, user ID, operation type (query / modification / deletion), and the log retention period ≥ 10 years; querying medium- and low-risk data requires approval by role permissions (such as risk control administrators), and the audit log retention period is consistent with the data life cycle and is automatically cleared after expiration.

[0131] In an optional implementation, based on the similarity matching between real-time transaction data and historical data in the hierarchical database, corresponding-level warning signals are triggered. The similarity matching uses an improved cosine similarity algorithm, including:

[0132] Convert real-time transaction data and historical data into multi-dimensional feature vectors, including normalized transaction amount, timestamp encoding, geographical location hash value, and behavior pattern embedding vector;

[0133] Calculate the weighted cosine similarity in the feature space, and calculate the total similarity by combining the cosine similarity and the normalized Euclidean distance. Among them, the weight of the cosine similarity is set to 0.6, and the weight of the normalized Euclidean distance is set to 0.4;

[0134] If the similarity exceeds the preset threshold, it is determined as the same type of risk event and a warning is triggered;

[0135] Among them, the basic value of the preset threshold is 0.85, it is adjusted down to 0.75 if the fraud rate rises by more than 20%, and it is adjusted up to 0.9 if the system load is lower than 30%. Manual intervention is allowed to adjust the range by ±0.1.

[0136] Exemplarily, the specific process of similarity matching further includes:

[0137] Normalize the transaction amount to the interval [0, 1], and the formula is as follows:

[0138]

[0139] Among them, Amount is the current transaction amount, Amount histis the set of historical transaction amounts, v amount is the normalized amount feature;

[0140] Convert the longitude and latitude of the geographical location into a Geohash code (6 digits), and then map it to a 128-dimensional embedding vector;

[0141] The behavior pattern extracts the hidden state of the user operation sequence through the LSTM network, and the formula is:

[0142] h t = LSTM(x t , h t-1 )

[0143] where x t is the input feature at time t (such as the user's current operation), and h t is the hidden state at time t;

[0144] Define the comprehensive similarity as the weighted sum of the cosine similarity and the normalized Euclidean distance as:

[0145] Similarity = 0.6×Cosine + 0.4×(1 - NormalizedEuclidean)

[0146] where Cosine represents the cosine similarity, and NormalizedEuclidean represents the normalized Euclidean distance, with a value range of [0,1];

[0147] The specific formula for the normalized Euclidean distance is:

[0148]

[0149] where v real,i , v hist,i represent the real-time feature value and the historical feature value of the dimension, β i represents the importance weight of the i-th feature, and Feature i represents the possible value range of the i-th feature in the historical data;

[0150] Define the basic threshold Similarity ≥ 0.85, and judge it as the same type of risk event;

[0151] If the current system risk level is "high" (such as an increase in the recent fraud rate), the threshold is automatically lowered to 0.75 to expand the warning range;

[0152] If the system is in a low-load period (such as early morning), the threshold is raised to 0.90 to reduce false alarms;

[0153] If the system detects that the fraud rate has increased by more than 20% in the past hour, the threshold is lowered to 0.75;

[0154] If the system is in a low-load period (CPU utilization < 30%), the threshold is increased to 0.9;

[0155] Manual intervention: The risk control administrator can manually adjust the threshold, and the adjustment range is limited to ±0.1.

[0156] It should be further noted that the method of the present invention establishes a dynamic mapping relationship between the risk probability threshold and the system state. For example, the fraud rate trigger threshold is lowered: when the fraud rate increases by 20%, the threshold drops from 0.85 to 0.75; the load perception threshold is increased: when the system load < 30%, the threshold rises to 0.9, and redundant computing power is used to perform fine-grained matching; the manual intervention limit is ±0.1: by restricting the threshold adjustment range, it prevents systematic risks caused by operational errors.

[0157] In the prior art, the unified storage strategy results in insufficient protection for high-risk data and excessive storage costs for low-risk data. The method of the present invention uses SSD + AES-256 encryption. For high-risk data, the read / write latency of the SSD ≤ 10ms meets the real-time interception requirements, and the AES-256 algorithm is certified by NIST and can resist brute-force cracking by quantum computers.

[0158] The conversion method of the foregoing multi-dimensional feature vector can be carried out by means and methods in the prior art, and will not be elaborated herein.

[0159] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present invention, and they should all be covered within the scope of the claims of the present invention.

Claims

1. A bank transaction risk assessment method based on big data analysis, characterized in that: include: Collect historical bank transaction data, extract abnormal transaction data and its associated influencing factors, the abnormal transaction data includes abnormal indicators of transaction amount, transaction frequency, geographic location and user behavior pattern; Use big data analysis technology to build a risk assessment model, assign weights and extract features for the associated influencing factors, and generate dynamic risk assessment rules; The real-time bank transaction data is input into the risk assessment model, the risk probability value of the transaction is calculated, and the transaction is divided into three levels of high, medium and low according to the dynamic risk assessment rules, and stored in the classification database.

2. The bank transaction risk assessment method based on big data analysis according to claim 1 is characterized in that: The extracting of abnormal transaction data includes: Based on the historical transaction amount distribution, the 3σ principle and interquartile range algorithm are used to identify outliers. If the current transaction amount meets one of the abnormality judgment conditions, it is judged as abnormal; The number of transactions per unit time is calculated by the time window sliding statistics method. If the current transaction frequency exceeds 200% of the highest frequency in the same period of history, it is considered abnormal. Based on the latitude and longitude coordinates of the user's frequently used location, the Haversine formula is used to calculate the distance deviation between the real-time transaction location and the frequently used location. If the distance exceeds 100 kilometers, an exception is triggered; The user operation habits are counted through a sliding window, and KL divergence is used to detect sudden changes in behavior distribution. If the divergence value exceeds 0.5, it is considered abnormal. The abnormality determination conditions include: The absolute difference between the transaction amount and the historical mean exceeds 3 standard deviations; The transaction amount is lower than the first quartile minus 1.5 times the interquartile range, or higher than the third quartile plus 1.5 times the interquartile range.

3. The bank transaction risk assessment method based on big data analysis according to claim 1 or 2 is characterized in that: The extraction of the associated influencing factors includes: Obtain the user's credit score from the central bank's credit reporting system or a third-party credit agency. If the user's credit score is less than 600 points, it will be listed as a high-risk association factor; Count the number of overdue payments in the user's account in the past year. If the number is ≥ 3 times, it is classified as a medium-high risk factor; Extract the transaction device ID, MAC address, and browser fingerprint. If there is no history in the device fingerprint library, it will be marked as suspicious. Through blacklist comparison, if the IP address involves a known fraud area, it will be listed as a high-risk factor; The inactive period is defined as 22:00 to 6:00 the next day local time. If a transaction occurs in this period and the amount exceeds 50% of the daily average, it is listed as a high-risk factor.

4. The bank transaction risk assessment method based on big data analysis according to claim 1 is characterized in that: The risk assessment model is constructed, including: Perform Z-Score normalization on numerical features to eliminate dimensional differences; One-Hot encoding is used to generate sparse matrices for discrete features; For missing fields, fill them with the majority of historical data of similar users and add a marker. The random forest algorithm is used to calculate the feature contribution, and the top 80% of the contribution features are retained; Optimize feature weights based on gradient boosting decision trees, update weights through incremental learning every 24 hours, and limit single training time to ≤5 minutes; Build a neural network model, which includes at least an input layer, two hidden layers, and an output layer; The output layer uses a Sigmoid activation function and is trained using an Adam optimizer, and the two hidden layers contain 128 and 64 nodes respectively.

5. The bank transaction risk assessment method based on big data analysis according to claim 4 is characterized in that: The generating of dynamic risk assessment rules comprises: The rule base is fully updated every hour, and the update time is within 5 minutes after the hour; When the user behavior pattern change rate exceeds 10%, the external risk intelligence pushes a new blacklist, or the model false positive rate / missing rate exceeds 5% for three consecutive hours, the update is triggered immediately; Extract data from high-risk transaction samples in the past 30 days, use the Apriori algorithm to mine frequent item sets, and generate association rules; If the thresholds of the new and old rules conflict, the rule with the higher recall rate will be retained according to the recall rate priority; The generated new rules must be verified in a sandbox environment with an accuracy rate of ≥ 95%, and the old rules must be gradually replaced through a blue-green deployment strategy.

6. The bank transaction risk assessment method based on big data analysis according to claim 1 is characterized in that: The risk probability value of the transaction is calculated by the following formula: Among them, w i is the feature dynamic weight, x i is the normalized eigenvalue, b is the bias term, n is the number of features, and e is a natural constant.

7. The bank transaction risk assessment method based on big data analysis according to claim 6 is characterized in that: The risk level classification threshold is set according to the risk probability value, including: When P(r)≥0.7, the risk level is high, triggering real-time transaction interception; When 0.3≤P(r)<0.7, the risk level is medium risk, triggering secondary verification; When P(r)<0.3, the risk level is low and only logs are recorded.

8. The bank transaction risk assessment method based on big data analysis according to claim 7 is characterized in that: The three risk levels of high, medium and low are stored in a classification database, including: High-risk data is stored in an independent SSD encrypted partition with a retention period of ≥ 5 years, using AES-256 encryption and dynamic key management; Medium-risk data is stored in a distributed column-based database with a retention period of 2 years. 10% of the data is extracted every six months for model retraining. Low-risk data is compressed and stored in Parquet format with a retention period of 6 months. It will be automatically deleted after the expiration date.

9. The bank transaction risk assessment method based on big data analysis according to claim 1 is characterized in that: Based on the similarity matching between the real-time transaction data and the historical data in the hierarchical database, a warning signal of a corresponding level is triggered, wherein the similarity matching adopts an improved cosine similarity algorithm, including: Converting the real-time transaction data and historical data into a multi-dimensional feature vector, including a normalized transaction amount, a timestamp code, a geographic location hash value, and a behavior pattern embedding vector; Calculate the weighted cosine similarity in the feature space, and calculate the total similarity by combining the cosine similarity and the normalized Euclidean distance, wherein the cosine similarity weight is set to 0.6 and the normalized Euclidean distance weight is set to 0.4; If the similarity exceeds the preset threshold, it is determined to be a similar risk event and triggers an early warning; The basic value of the preset threshold is 0.

85. If the fraud rate increases by more than 20%, it is lowered to 0.

75. If the system load is less than 30%, it is raised to 0.

9. Manual intervention is allowed to adjust the range by ±0.1.

Images