Risk data processing method and system based on multi-rule engine

Abstract

The invention discloses a risk data processing method and system based on a multi-rule engine, belongs to the technical field of big data processing, and aims to solve the technical problems of field limitation, rule stiffness, processing capability bottleneck, insufficient intelligent degree and limited expansibility faced by data processing. Comprising the following steps: constructing a multi-rule engine comprising a business rule module, a statistical model module and a real-time analysis module; carrying out standardization processing on the collected risk data; monitoring the standardized data through a message queue, calling a multi-rule engine, and performing rule parallel evaluation on the labeled data based on a specific field rule, a machine learning model and a streaming computing method; arbitration is carried out based on a dynamic weight distribution algorithm of scene features; and executing a corresponding risk handling operation based on the handling strategy.

Description

Technical Field

[0001] The present invention relates to the field of big data processing technology, and in particular to a risk data processing method and system based on a multi-rule engine. Background Art

[0002] With the rapid development of big data technology, all industries are facing the challenge of identifying and controlling risks in massive amounts of data. Current risk data processing technologies have the following limitations:

[0003] 1. Domain limitations: Existing risk management systems are mostly specialized solutions for vertical fields, such as financial anti-fraud systems and network security threat detection systems. The rule engines and algorithm models used in these systems are often optimized for specific fields and difficult to directly migrate and apply to other industry scenarios. This requires enterprises to repeatedly build multiple independent risk management platforms.

[0004] 2. Rigid rules: Traditional rule-based systems rely primarily on manually preset static rules, such as threshold determination and blacklist and whitelist matching. This approach exhibits significant shortcomings when dealing with complex and changing risk scenarios: It cannot adaptively adjust rule weights, and it struggles to handle conflicts among multiple rules.

[0005] 3. Data processing capacity bottleneck: With the exponential growth of data volumes, traditional centralized processing architectures face severe challenges in terms of real-time performance. This is especially true in scenarios such as the Internet of Things and mobile internet. Existing systems struggle to meet the business demands of millisecond-level risk response.

[0006] 4. Insufficient intelligence: Although some new systems have introduced machine learning algorithms, they generally suffer from poor model interpretability and require large amounts of labeled data for training. Furthermore, pure algorithmic solutions struggle to incorporate the experience of industry experts, limiting their applicability in actual business scenarios.

[0007] 5. System scalability issues: Most existing solutions use a tightly coupled architecture. When new risk identification dimensions need to be added or disposal strategies need to be adjusted, system-level modifications and upgrades are often required, making it impossible to dynamically update rules.

[0008] The domain limitations, rigid rules, processing capacity bottlenecks, insufficient intelligence and limited scalability faced by data processing are technical problems that need to be solved. Summary of the Invention

[0009] The technical task of the present invention is to address the above shortcomings and provide a risk data processing method and system based on a multi-rule engine to solve the technical problems faced by data processing, such as domain limitations, rigid rules, processing capacity bottlenecks, insufficient intelligence and limited scalability.

[0010] In a first aspect, the present invention provides a risk data processing method based on a multi-rule engine, comprising the following steps:

[0011] Multi-rule engine construction: Build a multi-rule engine that includes a business rule module, a statistical model module, and a real-time analysis module. The business rule module is used to define domain-specific rules. The statistical model module is used to calculate risk probabilities in real time based on preconfigured machine learning models. The real-time analysis module is used to detect short-term behavioral anomalies based on streaming computing methods.

[0012] Data collection: Access multiple data sources through distributed data collection, obtain cross-domain heterogeneous risk data from multiple data sources, and standardize the collected risk data to obtain standardized data;

[0013] Event-driven rule triggering: Monitors standardized data through message queues and calls multiple rule engines to perform parallel rule evaluations on the annotated data based on specific domain rules, machine learning models, and streaming computing methods to obtain rule evaluation results.

[0014] Rule conflict arbitration: When conflicting rule evaluation results occur, the arbitration process is triggered. A dynamic weight allocation algorithm based on scenario characteristics is used for arbitration to determine the risk level and corresponding disposal strategy.

[0015] Disposal execution: Execute corresponding risk disposal operations based on the disposal strategy, record the disposal results and feed them back to the rule engine. Based on the disposal results, train and optimize the machine learning model and dynamic weight allocation algorithm;

[0016] Monitoring optimization: Record the process of multi-rule engine construction, data collection, event-driven rule triggering, rule conflict arbitration, and disposal execution to form an operation log, perform performance monitoring based on the operation log and disposal results, and hot update domain-specific rules based on the monitoring situation.

[0017] Preferably, the business rule module is used to define domain-specific rules based on expert experience and support the configuration of logical expressions of domain-specific rules through a visual interface;

[0018] The statistical model module supports dynamic loading and A / B testing of machine learning models through a visual interface.

[0019] Preferably, data collection includes the following operations:

[0020] Connect to multiple data sources to obtain structured, semi-structured, and unstructured data, and support mainstream data protocols, including Kafka, HTTP API, and database CDC;

[0021] For the collected data, fields from different sources are uniformly mapped to standard risk attributes, and data enhancement operations are performed to supplement the contextual information of the data.

[0022] As a preference, when arbitrating using a dynamic weight allocation algorithm based on scenario characteristics, the final risk score is calculated based on the weights of domain-specific rules, and the risk level and corresponding handling strategy are obtained based on the final risk score;

[0023] The calculation formula of the final risk score is: final risk score = ∑ (rule output * weight) + fuzzy logic correction factor;

[0024] Risk levels include high risk, medium risk, and low risk. The corresponding handling strategy for high risk is blocking and warning, the corresponding handling strategy for medium risk is secondary verification, and the corresponding handling strategy for low risk is record release.

[0025] Correspondingly, risk management operations include blocking transactions, secondary verification, and generating alarms.

[0026] In a second aspect, the present invention provides a risk data processing system based on a multi-rule engine, comprising a multi-rule engine construction module, a data acquisition module, an event-driven rule triggering module, a rule conflict arbitration module, a disposal execution module, and a monitoring optimization module;

[0027] The multi-rule engine construction module is used to perform the following: build a multi-rule engine including a business rule module, a statistical model module, and a real-time analysis module. The business rule module is used to define domain-specific rules. The statistical model module is used to calculate risk probabilities in real time based on pre-configured machine learning models. The real-time analysis module is used to detect short-term behavioral anomalies based on streaming computing methods.

[0028] The data collection module is used to perform the following: access multiple data sources through distributed data collection, obtain cross-domain heterogeneous risk data from multiple data sources, and standardize the collected risk data to obtain standardized data;

[0029] The event-driven rule triggering module is used to perform the following operations: monitor the normalized data through the message queue, call multiple rule engines, and perform parallel rule evaluation on the annotated data based on specific domain rules, machine learning models, and streaming computing methods to obtain the rule evaluation results;

[0030] The rule conflict arbitration module is used to perform the following operations: When conflicting rule evaluation results occur, the arbitration process is triggered. The arbitration is performed based on a dynamic weight allocation algorithm based on scenario characteristics to determine the risk level and corresponding disposal strategy.

[0031] The disposal execution module is used to perform the following: execute corresponding risk disposal operations based on the disposal strategy, record the disposal results and feed them back to the rule engine, and train and optimize the machine learning model and dynamic weight allocation algorithm based on the disposal results;

[0032] The monitoring and optimization module is used to perform the following: record the process of multi-rule engine construction, data collection, event-driven rule triggering, rule conflict arbitration and disposal execution to form an operation log, perform performance monitoring based on the operation log and disposal results, and hot update domain-specific rules based on the monitoring situation.

[0033] Preferably, the business rule module is used to define domain-specific rules based on expert experience and support the configuration of logical expressions of domain-specific rules through a visual interface;

[0034] The statistical model module supports dynamic loading and A / B testing of machine learning models through a visual interface.

[0035] Preferably, the data acquisition module is used to perform the following operations:

[0036] Connect to multiple data sources to obtain structured, semi-structured, and unstructured data, and support mainstream data protocols, including Kafka, HTTP API, and database CDC;

[0037] For the collected data, fields from different sources are uniformly mapped to standard risk attributes, and data enhancement operations are performed to supplement the contextual information of the data.

[0038] As a preference, when arbitrating using a dynamic weight allocation algorithm based on scenario characteristics, the final risk score is calculated based on the weights of domain-specific rules, and the risk level and corresponding handling strategy are obtained based on the final risk score;

[0039] The calculation formula of the final risk score is: final risk score = ∑ (rule output * weight) + fuzzy logic correction factor;

[0040] Risk levels include high risk, medium risk, and low risk. The corresponding handling strategy for high risk is blocking and warning, the corresponding handling strategy for medium risk is secondary verification, and the corresponding handling strategy for low risk is record release.

[0041] Correspondingly, risk management operations include blocking transactions, secondary verification, and generating alarms.

[0042] The risk data processing method and system based on a multi-rule engine of the present invention have the following advantages:

[0043] 1. Cross-domain adaptability: Through a configurable multi-rule engine architecture, it supports risk identification needs in multiple fields such as finance, e-commerce, network security, and the Internet of Things, avoiding the duplication of multiple independent systems and significantly reducing enterprise operating costs.

[0044] 2. Intelligent Decision-Making: This system integrates expert experience (business rules) with data-driven approaches (statistical models), maintaining the interpretability of rules while improving the accuracy of risk assessments. The misjudgment rate is reduced by over 50% compared to traditional methods. A dynamic weighted arbitration mechanism automatically adjusts rule priorities to meet the needs of different business scenarios (e.g., financial scenarios prioritize compliance, while e-commerce scenarios prioritize behavioral analysis).

[0045] 3. Efficient real-time processing: Using a distributed streaming computing framework, it supports millisecond-level responses to 10,000 risk events per second (latency <100ms), meeting the real-time risk control requirements in high-concurrency scenarios.

[0046] 4. Flexible scalability: Hot rule loading and dynamic model update capabilities enable the system to quickly adapt to new risk models (such as new fraud methods) without requiring downtime for maintenance, improving operation and maintenance efficiency by 80%;

[0047] 5. Automated closed-loop disposal: Automates the entire process from risk detection to disposal execution, reducing manual intervention and improving processing efficiency by over 70%, while ensuring standardization and traceability of disposal actions.

[0048] 6. Resource optimization: Through intelligent arbitration, unnecessary processing actions (such as false interception) are reduced, business friction is reduced, user experience is improved, and computing resource consumption is saved by 20%-30%. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0050] The present invention will be further described below with reference to the accompanying drawings.

[0051] Figure 1 This is a flowchart of a risk data processing method based on a multi-rule engine in Example 1. DETAILED DESCRIPTION

[0052] The present invention will be further described below with reference to the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments given are not intended to limit the present invention. Unless there is a conflict, the embodiments of the present invention and the technical features in the embodiments may be combined with each other.

[0053] The embodiments of the present invention provide a risk data processing method and system based on a multi-rule engine, which are used to solve the technical problems faced by data processing, such as domain limitations, rigid rules, processing capacity bottlenecks, insufficient intelligence, and limited scalability.

[0054] Example 1:

[0055] The present invention provides a risk data processing method based on a multi-rule engine, which includes six steps: multi-rule engine construction, data collection, event-driven rule triggering, rule conflict arbitration, disposal execution, and monitoring optimization.

[0056] Step S100: Multi-rule engine construction: Construct a multi-rule engine including a business rule module, a statistical model module and a real-time analysis module. The business rule module is used to define domain-specific rules, the statistical model module is used to calculate risk probabilities in real time based on preconfigured machine learning models, and the real-time analysis module is used to detect short-term behavioral anomalies based on streaming computing methods.

[0057] The business rule module defines domain-specific rules (such as financial anti-fraud rules and network security threat detection rules) based on expert experience. It also supports the configuration of logical expressions for these domain-specific rules through a visual interface (for example, for financial data: IF transaction amount > threshold THEN high risk). The statistical model module supports dynamic loading and A / B testing of machine learning models such as Random Forest and XGBoost through a visual interface. The real-time analysis module uses streaming computing (such as Flink / Spark Streaming) to detect short-term behavioral anomalies (such as high login frequency and IP address mutations).

[0058] The rule engine uses a distributed database (such as MongoDB) to store rules, supports version control and backtracking, and provides a visual configuration interface that allows non-technical personnel to define rule logic through drag-and-drop.

[0059] Step S200: Data collection: access multiple data sources through distributed data collection, obtain cross-domain heterogeneous risk data from multiple data sources, and standardize the collected risk data to obtain standardized data.

[0060] As a specific implementation of data collection, this step includes the following operations:

[0061] (1) Access multiple data sources to obtain structured (database), semi-structured (log) and unstructured data (text / image), and support mainstream data protocols (such as Kafka, HTTP API, and database CDC). Mainstream data protocols include Kafka, HTTP API, and database CDC;

[0062] (2) For the collected data, the fields from different sources are uniformly mapped to standard risk attributes (such as user_id→user unique identifier), and data enhancement operations are performed to supplement the contextual information of the data (such as IP geolocation and user historical behavior portrait).

[0063] Step S300 event-driven rule triggering: monitor the standardized data through the message queue, call the multi-rule engine, perform parallel rule evaluation on the annotated data based on specific domain rules, machine learning models and streaming computing methods, and obtain the rule evaluation results.

[0064] This step monitors data streams through a message queue (such as Kafka) to trigger rule evaluation. Examples of event types include large transfers and remote logins in the financial sector, and abnormal device signals in the IoT sector. Multi-threaded / distributed computing (such as Apache Storm) is used to simultaneously execute business rule matching (Boolean judgments), statistical model inference (probabilistic output), and real-time behavior analysis (sliding window statistics).

[0065] Step S400: Rule conflict arbitration: When the rule evaluation results conflict, the arbitration process is triggered, and arbitration is performed based on the dynamic weight allocation algorithm of the scenario characteristics to obtain the risk level and the corresponding disposal strategy.

[0066] In this embodiment, when arbitration is performed based on the dynamic weight allocation algorithm of scenario characteristics, the final risk score is calculated based on the weight of the domain-specific rules, and the risk level and the corresponding disposal strategy are obtained based on the final risk score; wherein, the calculation formula of the final risk score is: final risk score = ∑ (rule output * weight) + fuzzy logic correction factor.

[0067] Risk levels include high risk, medium risk and low risk. The corresponding handling strategy for high risk is blocking and warning, the corresponding handling strategy for medium risk is secondary verification, and the corresponding handling strategy for low risk is record release.

[0068] As a specific implementation, during conflict detection, when the rule outputs are inconsistent (for example, the business rule determines high risk but the statistical model outputs low probability), the arbitration process is triggered. The weight distribution strategy is as follows:

[0069] Preset weightings for each domain: 70% for compliance rules in financial scenarios and 60% for behavioral rules in e-commerce scenarios.

[0070] Real-time adjustment: Dynamic fine-tuning based on data confidence (e.g., reducing the weight of statistical models for low-quality data);

[0071] Arbitration algorithm: Final risk score = ∑(rule output * weight) + fuzzy logic correction factor.

[0072] Step S500: Disposal execution: Execute corresponding risk disposal operations based on the disposal strategy, record the disposal results and feed them back to the rule engine, and train and optimize the machine learning model and dynamic weight allocation algorithm based on the disposal results.

[0073] In this embodiment, risk management operations include blocking transactions, secondary verification, and generating alarms.

[0074] As a specific implementation, it involves action distribution and feedback loop.

[0075] When distributing actions, preset operations are executed through API calls, such as blocking transactions (finance), isolating devices (IoT), and banning IP addresses (network security).

[0076] Step S600 monitoring optimization: record the process of multi-rule engine construction, data collection, event-driven rule triggering, rule conflict arbitration and disposal execution to form an operation log, perform performance monitoring based on the operation log and disposal results, and hot update domain-specific rules based on the monitoring situation.

[0077] Through monitoring optimization, the dashboard can be monitored in real time and rules can be updated hotly. Core indicators such as risk event processing time, rule hit rate, and false positive rate can be displayed on the dashboard. For relevant rules, new / modified rules can be added / modified without downtime, and changes are verified through grayscale release.

[0078] The method of this embodiment first establishes a multi-rule engine framework comprising a business rule module, a statistical model module, and a real-time analysis module. Secondly, a distributed data acquisition system is used to acquire heterogeneous risk data from different domains in real time. An event-driven mechanism is then used to trigger the parallel evaluation of multiple rules. When rule conflicts arise, a dynamic weighting algorithm based on scenario characteristics is used for intelligent arbitration. Finally, the corresponding risk management process is automatically executed based on the decision-making results. By building a multi-dimensional rule engine system, this method achieves intelligent identification and management of cross-domain risk data.

[0079] Example 2:

[0080] The present invention provides a risk data processing system based on a multi-rule engine, comprising a multi-rule engine construction module, a data acquisition module, an event-driven rule triggering module, a rule conflict arbitration module, a disposal execution module and a monitoring optimization module.

[0081] The multi-rule engine construction module is used to perform the following: build a multi-rule engine including a business rule module, a statistical model module and a real-time analysis module. The business rule module is used to define domain-specific rules. The statistical model module is used to calculate risk probabilities in real time based on preconfigured machine learning models. The real-time analysis module is used to detect short-term behavioral anomalies based on streaming computing methods.

[0082] The business rule module defines domain-specific rules (such as financial anti-fraud rules and network security threat detection rules) based on expert experience. It also supports the configuration of logical expressions for these domain-specific rules through a visual interface (for example, for financial data: IF transaction amount > threshold THEN high risk). The statistical model module supports dynamic loading and A / B testing of machine learning models such as Random Forest and XGBoost through a visual interface. The real-time analysis module uses streaming computing (such as Flink / Spark Streaming) to detect short-term behavioral anomalies (such as high login frequency and IP address mutations).

[0083] The rule engine building module uses a distributed database (such as MongoDB) to store rules, supports version control and backtracking, and provides a visual configuration interface that allows non-technical personnel to define rule logic through drag-and-drop.

[0084] The data collection module is used to perform the following: access multiple data sources through distributed data collection, obtain cross-domain heterogeneous risk data from multiple data sources, and standardize the collected risk data to obtain standardized data.

[0085] As a specific implementation of the data acquisition module, this module is used to perform the following operations:

[0086] (1) Access multiple data sources to obtain structured (database), semi-structured (log) and unstructured data (text / image), and support mainstream data protocols (such as Kafka, HTTP API, and database CDC). Mainstream data protocols include Kafka, HTTP API, and database CDC;

[0087] (2) For the collected data, the fields from different sources are uniformly mapped to standard risk attributes (such as user_id→user unique identifier), and data enhancement operations are performed to supplement the contextual information of the data (such as IP geolocation and user historical behavior portrait).

[0088] The event-driven rule triggering module is used to perform the following: listen to the standardized data through the message queue, call the multi-rule engine, and perform parallel rule evaluation on the annotated data based on specific domain rules, machine learning models, and streaming computing methods to obtain the rule evaluation results.

[0089] This module monitors data streams through message queues (such as Kafka) and triggers rule evaluation. Examples of event types include large transfers and remote logins in the financial sector, and abnormal device signals in the IoT sector. It uses multi-threaded / distributed computing (such as Apache Storm) to simultaneously execute business rule matching (Boolean judgments), statistical model reasoning (probabilistic output), and real-time behavior analysis (sliding window statistics).

[0090] The rule conflict arbitration module is used to perform the following: when the rule evaluation results conflict, the arbitration process is triggered, and arbitration is performed based on the dynamic weight allocation algorithm of the scenario characteristics to obtain the risk level and the corresponding disposal strategy.

[0091] In this embodiment, when arbitration is performed based on the dynamic weight allocation algorithm of scenario characteristics, the final risk score is calculated based on the weight of the domain-specific rules, and the risk level and the corresponding disposal strategy are obtained based on the final risk score; wherein, the calculation formula of the final risk score is: final risk score = ∑ (rule output * weight) + fuzzy logic correction factor.

[0092] Risk levels include high risk, medium risk and low risk. The corresponding handling strategy for high risk is blocking and warning, the corresponding handling strategy for medium risk is secondary verification, and the corresponding handling strategy for low risk is record release.

[0093] As a specific implementation, during conflict detection, when the rule outputs are inconsistent (for example, the business rule determines high risk but the statistical model outputs low probability), the arbitration process is triggered. The weight distribution strategy is as follows:

[0094] Preset weightings for each domain: 70% for compliance rules in financial scenarios and 60% for behavioral rules in e-commerce scenarios.

[0095] Real-time adjustment: Dynamic fine-tuning based on data confidence (e.g., reducing the weight of statistical models for low-quality data);

[0096] Arbitration algorithm: Final risk score = ∑(rule output * weight) + fuzzy logic correction factor.

[0097] The disposal execution module is used to perform the following: execute corresponding risk disposal operations based on the disposal strategy, record the disposal results and feed them back to the rule engine, and train and optimize the machine learning model and dynamic weight allocation algorithm based on the disposal results.

[0098] In this embodiment, risk management operations include blocking transactions, secondary verification, and generating alarms.

[0099] As a specific implementation, it involves action distribution and feedback loop.

[0100] When distributing actions, preset operations are executed through API calls, such as blocking transactions (finance), isolating devices (IoT), and banning IP addresses (network security).

[0101] The monitoring and optimization module is used to perform the following: record the process of multi-rule engine construction, data collection, event-driven rule triggering, rule conflict arbitration and disposal execution to form an operation log, perform performance monitoring based on the operation log and disposal results, and hot update domain-specific rules based on the monitoring situation.

[0102] Through monitoring optimization, the dashboard can be monitored in real time and rules can be updated hotly. Core indicators such as risk event processing time, rule hit rate, and false positive rate can be displayed on the dashboard. For relevant rules, new / modified rules can be added / modified without downtime, and changes are verified through grayscale release.

[0103] The system of this embodiment can execute the method disclosed in Example 1 to realize automatic processing of risk data.

[0104] The above is a detailed introduction to the risk data processing method and system based on a multi-rule engine provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A risk data processing method based on a multi-rule engine, characterized in that: The steps include: Multi-rule engine construction: Build a multi-rule engine that includes a business rule module, a statistical model module, and a real-time analysis module. The business rule module is used to define domain-specific rules. The statistical model module is used to calculate risk probabilities in real time based on preconfigured machine learning models. The real-time analysis module is used to detect short-term behavioral anomalies based on streaming computing methods. Data collection: Access multiple data sources through distributed data collection, obtain cross-domain heterogeneous risk data from multiple data sources, and standardize the collected risk data to obtain standardized data; Event-driven rule triggering: Monitors standardized data through message queues and calls multiple rule engines to perform parallel rule evaluations on the annotated data based on specific domain rules, machine learning models, and streaming computing methods to obtain rule evaluation results. Rule conflict arbitration: When conflicting rule evaluation results occur, the arbitration process is triggered. A dynamic weight allocation algorithm based on scenario characteristics is used for arbitration to determine the risk level and corresponding disposal strategy. Disposal execution: Execute corresponding risk disposal operations based on the disposal strategy, record the disposal results and feed them back to the rule engine. Based on the disposal results, train and optimize the machine learning model and dynamic weight allocation algorithm; Monitoring optimization: Record the process of multi-rule engine construction, data collection, event-driven rule triggering, rule conflict arbitration, and disposal execution to form an operation log, perform performance monitoring based on the operation log and disposal results, and hot update domain-specific rules based on the monitoring situation.

2. The risk data processing method based on a multi-rule engine according to claim 1 is characterized in that: The business rule module is used to define domain-specific rules based on expert experience and supports the configuration of logical expressions of domain-specific rules through a visual interface; The statistical model module supports dynamic loading and A / B testing of machine learning models through a visual interface.

3. The risk data processing method based on a multi-rule engine according to claim 1, characterized in that: Data collection includes the following operations: Connect to multiple data sources to obtain structured, semi-structured, and unstructured data, and support mainstream data protocols, including Kafka, HTTP API, and database CDC; For the collected data, fields from different sources are uniformly mapped to standard risk attributes, and data enhancement operations are performed to supplement the contextual information of the data.

4. The risk data processing method based on a multi-rule engine according to claim 1, characterized in that: When arbitrating using a dynamic weight allocation algorithm based on scenario characteristics, the final risk score is calculated based on the weights of domain-specific rules, and the risk level and corresponding disposal strategy are derived based on the final risk score; The calculation formula of the final risk score is: final risk score = ∑ (rule output * weight) + fuzzy logic correction factor; Risk levels include high risk, medium risk, and low risk. The corresponding handling strategy for high risk is blocking and warning, the corresponding handling strategy for medium risk is secondary verification, and the corresponding handling strategy for low risk is record release. Correspondingly, risk management operations include blocking transactions, secondary verification, and generating alarms.

5. A risk data processing system based on a multi-rule engine, characterized in that: It includes multi-rule engine construction module, data acquisition module, event-driven rule triggering module, rule conflict arbitration module, disposal execution module and monitoring optimization module; The multi-rule engine construction module is used to perform the following: build a multi-rule engine including a business rule module, a statistical model module, and a real-time analysis module. The business rule module is used to define domain-specific rules. The statistical model module is used to calculate risk probabilities in real time based on pre-configured machine learning models. The real-time analysis module is used to detect short-term behavioral anomalies based on streaming computing methods. The data collection module is used to perform the following: access multiple data sources through distributed data collection, obtain cross-domain heterogeneous risk data from multiple data sources, and standardize the collected risk data to obtain standardized data; The event-driven rule triggering module is used to perform the following operations: monitor the normalized data through the message queue, call multiple rule engines, and perform parallel rule evaluation on the annotated data based on specific domain rules, machine learning models, and streaming computing methods to obtain the rule evaluation results; The rule conflict arbitration module is used to perform the following operations: When conflicting rule evaluation results occur, the arbitration process is triggered. The arbitration is performed based on a dynamic weight allocation algorithm based on scenario characteristics to determine the risk level and corresponding disposal strategy. The disposal execution module is used to perform the following: execute corresponding risk disposal operations based on the disposal strategy, record the disposal results and feed them back to the rule engine, and train and optimize the machine learning model and dynamic weight allocation algorithm based on the disposal results; The monitoring and optimization module is used to perform the following: record the process of multi-rule engine construction, data collection, event-driven rule triggering, rule conflict arbitration and disposal execution to form an operation log, perform performance monitoring based on the operation log and disposal results, and hot update domain-specific rules based on the monitoring situation.

6. The risk data processing system based on multiple rule engines according to claim 5, characterized in that: The business rule module is used to define domain-specific rules based on expert experience and supports the configuration of logical expressions of domain-specific rules through a visual interface; The statistical model module supports dynamic loading and A / B testing of machine learning models through a visual interface.

7. The risk data processing system based on multiple rule engines according to claim 5, characterized in that: The data acquisition module is used to perform the following operations: Connect to multiple data sources to obtain structured, semi-structured, and unstructured data, and support mainstream data protocols, including Kafka, HTTP API, and database CDC; For the collected data, fields from different sources are uniformly mapped to standard risk attributes, and data enhancement operations are performed to supplement the contextual information of the data.

8. The risk data processing system based on multiple rule engines according to claim 5, characterized in that: When arbitrating using a dynamic weight allocation algorithm based on scenario characteristics, the final risk score is calculated based on the weights of domain-specific rules, and the risk level and corresponding disposal strategy are derived based on the final risk score; The calculation formula of the final risk score is: final risk score = ∑ (rule output * weight) + fuzzy logic correction factor; Risk levels include high risk, medium risk, and low risk. The corresponding handling strategy for high risk is blocking and warning, the corresponding handling strategy for medium risk is secondary verification, and the corresponding handling strategy for low risk is record release. Correspondingly, risk management operations include blocking transactions, secondary verification, and generating alarms.

Images