Suspicious transaction processing method and device

Abstract

The invention discloses a suspicious transaction processing method, and the method comprises the steps: obtaining a preset monitoring index corresponding to a target suspicious transaction if a transaction analysis instruction for carrying out suspicious analysis on the target suspicious transaction is detected; obtaining transaction index data corresponding to the target suspicious transaction; acquiring historical analysis experience data matched with the target suspicious transaction; determining m first large models for performing suspicious information analysis from a model library; wherein m is an integer greater than or equal to 1; performing suspicious information analysis on the preset monitoring index, the transaction index data and the historical analysis experience data for the target suspicious transaction by adopting the m first large models to obtain a target analysis result; wherein the target analysis result is at least used for indicating suspicious information existing in the target suspicious transaction. The invention further discloses a suspicious transaction processing device.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to a method and device for processing suspicious transactions. Background Art

[0002] In order to ensure the property safety of users, identifying suspicious transactions is one of the important aspects of anti-money laundering work. In the existing suspicious transaction processing process, the relevant information of suspicious transactions is usually reviewed and analyzed manually. Due to the large amount of data and wide range of suspicious transactions, manual review and analysis of suspicious transactions are prone to analysis errors and low analysis efficiency. How to realize automated and efficient analysis of suspicious transactions has become a technical problem that needs to be solved urgently.

[0003] Application Contents

[0004] In order to solve the above technical problems, the present application hopes to provide a suspicious transaction processing method and device, which solves the current problem of low efficiency in analyzing suspicious anti-money laundering transactions, and proposes a technical solution for automatically and efficiently analyzing suspicious anti-money laundering transactions, which effectively improves the analysis efficiency and ensures the accuracy of the analysis.

[0005] The technical solution of this application is achieved as follows:

[0006] The present application provides a method for handling suspicious transactions, the method comprising:

[0007] If a transaction analysis instruction for performing a suspicious analysis on a target suspicious transaction is detected, obtaining a preset monitoring indicator corresponding to the target suspicious transaction;

[0008] Obtaining transaction indicator data corresponding to the target suspicious transaction;

[0009] Acquire historical analysis experience data matching the target suspicious transaction;

[0010] Determining m first largest models for analyzing suspicious information from a model library; wherein m is an integer greater than or equal to 1;

[0011] The m first large models are used to perform suspicious information analysis on the target suspicious transaction using the preset monitoring indicators, the transaction indicator data, and the historical analysis experience data to obtain a target analysis result; wherein the target analysis result is at least used to indicate the existence of suspicious information in the target suspicious transaction.

[0012] In the above solution, the m first large models are used to perform suspicious information analysis on the target suspicious transaction based on the preset monitoring indicators, the transaction indicator data, and the historical analysis experience data to obtain target analysis results, including:

[0013] perform suspicious information analysis on the preset monitoring indicators, the transaction indicator data and the historical analysis experience data by each first large model to obtain a reference analysis result of each first large model;

[0014] perform quality evaluation on the reference analysis result of each first large model from a target dimension to obtain a first evaluation value of each first large model, and further obtain m first evaluation values; wherein the target dimension includes one or more of the following dimensions: accuracy, integrity, logic, readability and security;

[0015] based on the m first evaluation values, determine the target analysis result from the m reference analysis results.

[0016] In the above scheme, the method further comprises:

[0017] if a report analysis instruction for performing report summary analysis on a target suspicious report is detected, the target suspicious report is obtained;

[0018] based on the target suspicious report, generate report summary content;

[0019] output the report summary content for user review.

[0020] In the above scheme, the method further comprises:

[0021] from the model library, determine n second large models for text recognition; wherein n is an integer greater than or equal to 1;

[0022] using the n second large models, perform report analysis on the target suspicious report to obtain report summary content.

[0023] In the above scheme, the method further comprises:

[0024] if a report review instruction for performing report review on a target suspicious report is detected, the target suspicious report is obtained;

[0025] from the model library, determine p third large models for report review analysis; wherein p is an integer greater than or equal to 1;

[0026] using the p third large models, perform report review analysis on the target suspicious report to obtain a report analysis result; wherein the report analysis result is used at least to indicate the reliability of the target suspicious report.

[0027] In the above scheme, the method further comprises:

[0028] From the model library, determine q fourth large models for performing report content verification processing; wherein q is an integer greater than or equal to 1;

[0029] Using the q fourth large models, perform report content verification processing on the target suspicious report to obtain a verification result;

[0030] Based on the verification result, generate an audit suggestion;

[0031] Output the audit suggestion.

[0032] The above scheme, the method further comprises:

[0033] If a data query instruction is detected, determine the database corresponding to the data query instruction based on the data query instruction;

[0034] Call the application interface of the database to obtain the target data corresponding to the data query instruction;

[0035] Output the target data.

[0036] The above scheme, the method further comprises:

[0037] If a user question and answer instruction is detected, determine the first user intent information based on the user question and answer instruction;

[0038] From the model library, determine k fifth large models for generating user reply content; wherein k is an integer greater than or equal to 1;

[0039] Using the k fifth large models, generate reply content corresponding to the first user intent information;

[0040] Output the reply content.

[0041] The above scheme, the method further comprises:

[0042] Display a suspicious transaction set; wherein the suspicious transaction set includes one or more currently identified suspicious transactions;

[0043] Obtain user input information;

[0044] Obtain second user intent information from the user input information;

[0045] Based on the second user intent information, generate a to-be-executed instruction; wherein the to-be-executed instruction is at least one of the following instructions: transaction analysis instruction, report analysis instruction, report audit instruction, data query instruction, and user question and answer instruction.

[0046] The above scheme, the method further comprises:

[0047] If it is detected that a target model in the model library needs to be updated, a historical sample data set corresponding to the target model in the sample pool is obtained; wherein the target model is any large model in the model library;

[0048] The target model is trained using the historical sample data set to obtain an updated target model.

[0049] The present application provides a suspicious transaction processing device, the device comprises: an acquisition unit, a determination unit and an analysis unit; wherein:

[0050] The acquisition unit is configured to acquire a preset monitoring indicator corresponding to a target suspicious transaction if a transaction analysis instruction for suspicious analysis of the target suspicious transaction is detected;

[0051] The acquisition unit is further configured to acquire transaction indicator data corresponding to the target suspicious transaction;

[0052] The acquisition unit is further configured to acquire historical analysis experience data matching the target suspicious transaction;

[0053] The determination unit is configured to determine m first large models for suspicious information analysis from a model library; wherein m is an integer greater than or equal to 1;

[0054] The analysis unit is configured to use the m first large models to perform suspicious information analysis on the preset monitoring indicator, the transaction indicator data and the historical analysis experience data for the target suspicious transaction to obtain a target analysis result; wherein the target analysis result is used at least to indicate suspicious information existing in the target suspicious transaction.

[0055] The present application provides an electronic device, the device at least comprises: a memory, a processor and a communication bus; wherein:

[0056] The memory is configured to store executable instructions;

[0057] The communication bus is configured to realize communication connection between the processor and the memory;

[0058] The processor is configured to execute the suspicious transaction processing program stored in the memory to realize the steps of the suspicious transaction processing method according to any one of the above.

[0059] The present application provides a storage medium, the storage medium stores a suspicious transaction processing program, and the suspicious transaction processing program is executed by a processor to realize the steps of the suspicious transaction processing method according to any one of the above.

[0060] The present application provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the suspicious transaction method according to any one of the preceding items.

[0061] The embodiment of the present application provides a suspicious transaction processing method and device, if a transaction analysis instruction for suspicious analysis of a target suspicious transaction is detected, a preset monitoring index corresponding to the target suspicious transaction is acquired, transaction index data corresponding to the target suspicious transaction is acquired, historical analysis experience data matched with the target suspicious transaction is acquired, m first large models used for suspicious information analysis are determined from a model library, the m first large models are used to perform suspicious information analysis on the preset monitoring index, the transaction index data and the historical analysis experience data for the target suspicious transaction, and a target analysis result is obtained. In this way, when the transaction analysis instruction for suspicious analysis of the target suspicious transaction is detected, the preset monitoring index and the transaction index data corresponding to the target suspicious transaction and the historical analysis experience data are analyzed by using the plurality of first large models to obtain a reliable target analysis result. Since the same object is analyzed by using the plurality of large models to obtain an analysis result, the reliability of the final analysis result is ensured, the problem of low analysis efficiency of the anti-money laundering suspicious transaction is solved, and a technical solution for automatically and efficiently analyzing the anti-money laundering suspicious transaction is provided, so that the analysis efficiency is effectively improved, and the analysis accuracy is ensured. BRIEF DESCRIPTION OF DRAWINGS

[0062] Figure 1 A flowchart of a suspicious transaction processing method provided by the embodiment of the present application is shown in the figure;

[0063] Figure 2 An application flowchart of the suspicious transaction processing method provided by the embodiment of the present application is shown in the figure Figure One ;

[0064] Figure 3 An application flowchart of the suspicious transaction processing method provided by the embodiment of the present application is shown in the figure Figure Two ;

[0065] Figure 4 An application flowchart of the suspicious transaction processing method provided by the embodiment of the present application is shown in the figure Figure Three ;

[0066] Figure 5 An application flowchart of the suspicious transaction processing method provided by the embodiment of the present application is shown in the figure Figure Four ;

[0067] Figure 6 An application flowchart of the suspicious transaction processing method provided by the embodiment of the present application is shown in the figure Figure Five ;

[0068] Figure 7An application flowchart of a suspicious transaction processing method provided by an embodiment of the present application Figure Six ;

[0069] Figure 8 A structure diagram of a suspicious transaction processing device provided by an embodiment of the present application

[0070] Figure 9 A structure diagram of a suspicious transaction processing device provided by an embodiment of the present application DETAILED DESCRIPTION

[0071] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application.

[0072] An embodiment of the present application provides a suspicious transaction processing method, referring to Figure 1 The method is applied to a suspicious transaction processing device, and the method comprises the following steps:

[0073] Step 101: If a transaction analysis instruction for suspicious analysis of a target suspicious transaction is detected, a preset monitoring index corresponding to the target suspicious transaction is acquired.

[0074] In the embodiments of the present application, the suspicious transaction processing device can be a device with computing capability, for example, can be a computer device, can also be a server device, and can also be a smart mobile terminal device, etc. The target suspicious transaction can be a transaction with suspicious transaction behavior screened out by pre-suspicious analysis. The preset monitoring index is an evaluation index parameter for judging suspicious transaction set for different transactions in advance. For each suspicious transaction, the preset monitoring index corresponding thereto comprises one or more index parameters.

[0075] For example, the suspicious transaction processing device can acquire the suspicious transactions screened out in advance, and can display in the form of a list. In this way, an analyst can select the suspicious transactions displayed in the list to obtain the target suspicious transaction, and further process the selected target suspicious transaction for transaction analysis. After the suspicious transaction processing device detects the transaction analysis instruction for suspicious analysis of the target suspicious transaction, the preset monitoring index that can be used for suspicious analysis of the target suspicious transaction is determined, so as to subsequently further confirm and analyze the selected target suspicious transaction to determine whether the target suspicious transaction is a real suspicious transaction.

[0076] Step 102: Transaction index data corresponding to the target suspicious transaction is acquired.

[0077] In the embodiments of the present application, the transaction index data corresponding to the target suspicious transaction refers to the data content corresponding to the target suspicious transaction when it is determined as a suspicious transaction, which can be stored in a storage area independent of the suspicious transaction processing device. In implementation, the suspicious transaction processing device can access the storage area and obtain data from the storage area. In some application scenarios, the suspicious transaction processing device can provide the storage area. In this way, the data of the transaction can be stored in the storage area of the suspicious transaction processing device for subsequent analysis by the suspicious transaction processing device. After determining the target suspicious transaction, the suspicious transaction processing device also obtains the transaction index data corresponding to the target suspicious transaction, so as to analyze the transaction index data and determine whether the target suspicious transaction is indeed a suspicious transaction.

[0078] Step 103, obtaining historical analysis experience data matched with the target suspicious transaction.

[0079] In the embodiments of the present application, the historical analysis experience data is the analysis experience when suspicious analysis is performed on the transaction of the same type as the target suspicious transaction in the historical analysis process. In the historical analysis process, the analysis process of each suspicious analysis performed on the transaction of the same type as the target suspicious transaction can be continuously adjusted and corrected according to the actual situation or actual demand. In this way, the historical analysis experience data can be obtained.

[0080] Step 104, determining m first large models used for suspicious information analysis from the model library.

[0081] Wherein, m is an integer greater than or equal to 1.

[0082] In the embodiments of the present application, various types of large models are stored in the model library, and the models in the model library can be continuously updated and supplemented according to actual conditions in the application process, including updating the large models in the model library to the latest trained large models, or deleting the large models in the model library that are not applicable, or adding the newly proposed large models to the model library when new large models are proposed, so as to ensure the accuracy and reliability of the large models in the model library and the quality of the subsequent analysis results. According to the type of the target suspicious transaction, a large model that can be used to analyze suspicious information of the target suspicious transaction is determined from the model library, and m first large models are obtained, wherein m can be a pre-set experience value, or the total number of the first large models actually determined from the model library. For example, if the model library includes 5 large models that can be used to analyze suspicious information of the target suspicious transaction, the value of m can be a pre-set experience value of 3, at this time, 3 large models can be determined from the 5 large models to analyze suspicious information of the target suspicious transaction, or the 5 large models can be directly determined from the model library to analyze suspicious information of the target suspicious transaction, at this time, the value of m is 5.

[0083] Step 105, using m first large models, analyzing suspicious information of the target suspicious transaction based on the preset monitoring indicators, transaction indicator data and historical analysis experience data to obtain a target analysis result.

[0084] The target analysis result is at least used to indicate suspicious information of the target suspicious transaction.

[0085] In the embodiments of the present application, the preset monitoring indicators, transaction indicator data and historical experience data are respectively input into each first large model included in the m first large models, so that each first large model analyzes suspicious information of the target suspicious transaction to obtain a reference analysis result of each large model. The corresponding target analysis result can be an analysis result with the best analysis result quality in the reference analysis results of the m first large models. In some application scenarios, the target analysis result can also be an analysis result obtained by comprehensively processing the reference analysis results of the m first large models. For example, the results of each reference analysis result that best evaluates the target suspicious transaction can be combined to obtain the target analysis result. The specific determination can be determined by actual conditions, which is not limited here.

[0086] Based on the foregoing embodiments, in other embodiments of the present application, step 105 uses m first large models to analyze suspicious information of the target suspicious transaction based on the preset monitoring indicators, transaction indicator data and historical analysis experience data to obtain a target analysis result, which can be realized by the following steps:

[0087] The suspicious information analysis is performed on the preset monitoring indicators, transaction indicator data and historical analysis experience data by each first large model, and reference analysis results of each first large model are obtained.

[0088] The reference analysis results of each first large model are quality evaluated from a target dimension, and a first evaluation value of each first large model is obtained, and then m first evaluation values are obtained; wherein the target dimension includes one or more of the following dimensions: accuracy, integrity, logic, readability, security;

[0089] Based on the m first evaluation values, a target analysis result is determined from the m reference analysis results.

[0090] In the embodiments of the present application, the preset monitoring indicators, transaction indicator data and historical analysis experience data are respectively input into each first large model, suspicious information analysis of the target suspicious transaction can be performed by each first large model, and the corresponding reference analysis result is output, after the reference analysis results of the m first large models are obtained, the quality of each first large model is evaluated according to the target dimension, and the m first evaluation values are obtained, then the m first evaluation values are compared and analyzed, and the target analysis result is determined from the m reference analysis results, for example, when the evaluation value is larger, it indicates that the quality of the reference analysis result of the first large model is better, the first evaluation value with the largest value is determined from the m first evaluation values, and the reference analysis result corresponding to the first evaluation value with the largest value is determined as the target analysis result.

[0091] In some application scenarios, when the quality of each first large model is evaluated according to the target dimension, if the target dimension includes multiple dimensions of the following dimensions: accuracy, integrity, logic, readability, security, the weight coefficient of each dimension can be determined, then each reference analysis result is analyzed, the evaluation value of each dimension included in the target dimension is determined, then the weight coefficient of each temperature and the corresponding evaluation value are weighted and operated, and then the first evaluation value of each first large model is obtained.

[0092] Based on the foregoing embodiments, in other embodiments of the present application, the suspicious transaction processing device is further used to perform the following steps:

[0093] If a report analysis instruction for performing report summary analysis on the target suspicious report is detected, the target suspicious report is obtained;

[0094] Based on the target suspicious report, a report abstract content is generated;

[0095] The report abstract content is output for user review.

[0096] In the embodiments of the present application, the suspicious transaction processing device also has a report analysis function, so that when the suspicious transaction processing device detects a report analysis instruction for summarizing and analyzing a target suspicious report sent by a user, the target suspicious report is obtained from a report storage area. The report storage area can be a database storing suspicious reports, or a storage area independent of the suspicious transaction processing device, or a storage area of the suspicious transaction processing device, which can be determined by actual conditions and is not limited here. After the suspicious transaction processing device obtains the target suspicious report, the target suspicious report is summarized and analyzed to obtain report abstract content, and the report abstract content is output for processing so that the user can view the report abstract content. The suspicious transaction processing device can output the report abstract content to the display screen of the suspicious transaction processing device, or to a display device having a display screen and being in communication connection with the suspicious transaction processing device, such as a mobile terminal device or a computer device.

[0097] After the suspicious transaction processing device obtains the target suspicious report, the target suspicious report can be summarized and analyzed by using artificial intelligence analysis.

[0098] Based on the foregoing embodiments, in other embodiments of the present application, the step of generating report abstract content based on the target suspicious report can be implemented by the following steps:

[0099] From the model library, n second large models for text recognition are determined; wherein n is an integer greater than or equal to 1;

[0100] The n second large models are used to analyze the target suspicious report to obtain report abstract content.

[0101] In the embodiments of the present application, a way of analyzing a target suspicious report to generate report abstract content is as follows: it is determined that the current task is suspicious report analysis, therefore, n second large models that can be used for suspicious report analysis, i.e., text recognition, are obtained from the model library according to the suspicious report analysis task, and then the target suspicious report is input into each second large model to make each second large model analyze the target suspicious report to obtain a corresponding report analysis result, and report abstract content is obtained according to the n report analysis results. N can be an empirical value obtained according to a large number of experiments or experience, or the actual number of second large models that can be used for report analysis in the model library, which can be determined by actual conditions and is not limited here.

[0102] The report abstract content obtained according to the n report analysis results can be obtained by performing content fusion processing on the n report analysis results. For example, the content with the highest accuracy and reliability in each report analysis result is determined from the n report analysis results, and then the content with the highest accuracy and reliability in each report analysis result is spliced to obtain the report abstract content. The report abstract content obtained according to the n report analysis results can also be obtained by determining a report with the best quality from the n report analysis results. The actual situation can determine this and no specific limitation is made here.

[0103] It should be noted that for some second large models, in order to improve the model analysis efficiency of the second large model, the target suspicious report can be preprocessed to obtain a to-be-analyzed text, and then the to-be-analyzed file is subjected to feature vectorization processing to obtain a text feature vector. The text feature vector is input into the second large model, so that the second large model analyzes the text feature vector, for example, by performing text recognition on the text feature vector by the second large model to obtain a key sentence. Then, after extracting the core vocabulary from the target suspicious report, the report is generated according to the key sentence and the core vocabulary to obtain the report abstract content. In this way, the analysis of the target suspicious report is realized, and the report abstract content is generated.

[0104] The pre-processing of the target suspicious report can be data cleaning, such as supplementing missing data, unifying text format, and removing error data.

[0105] Based on the foregoing embodiments, in other embodiments of the present application, the suspicious transaction processing device is further configured to perform the following steps:

[0106] If a report auditing instruction for detecting the target suspicious report for report auditing is detected, the target suspicious report is obtained.

[0107] From the model library, p third large models used for report auditing analysis are determined; wherein p is an integer greater than or equal to 1.

[0108] The p third large models are used to perform report auditing analysis on the target suspicious report to obtain report analysis results; wherein the report analysis results are used to at least indicate the reliability of the target suspicious report.

[0109] In the embodiments of the present application, the suspicious transaction processing device further has an auditing function of auditing the contents of the report summary. The report auditing instruction for auditing the target suspicious report can be generated when the user performs the auditing operation on the target suspicious report, and is used to instruct the suspicious transaction processing device to perform the report auditing on the target suspicious report. At this time, after detecting the report auditing instruction of the target suspicious report, the suspicious transaction processing device responds to the report auditing instruction, acquires the target suspicious report, determines p third large models that can be used for report auditing analysis from the model library, and inputs the target suspicious report into each third large model to perform the report auditing analysis on the target suspicious report through each third large model to obtain the corresponding auditing analysis result, and thus determines the report analysis result based on the p auditing analysis results. p is an empirical value set according to a large number of experiments or experience, and can also be the number of third large models actually determined from the model library.

[0110] The determination of the report analysis result based on the p auditing analysis results can be to determine a most reliable result from the p auditing analysis results as the report analysis result, or to comprehensively analyze the p auditing analysis results, for example, to count the result with the largest number of same results in the p auditing analysis results as the report analysis result. The specific implementation process can be determined by the actual situation, and is not limited here.

[0111] Based on the foregoing embodiments, in other embodiments of the present application, the suspicious transaction processing device is further used to perform the following steps:

[0112] Determine q fourth large models for performing the report content verification processing from the model library; wherein q is an integer greater than or equal to 1;

[0113] Perform the report content verification processing on the target suspicious report by using the q fourth large models to obtain a verification result;

[0114] Generate an auditing suggestion based on the verification result;

[0115] Output the auditing suggestion.

[0116] In the embodiment of the present application, after obtaining the target suspicious report, the suspicious transaction processing device further has the function of report content verification processing. At this time, the suspicious transaction processing device determines q fourth large models that can be used for report content verification processing from the model library, inputs the target suspicious report into each fourth large model, performs report content verification processing on the target suspicious report through each fourth large model, determines whether the report content is real content, obtains q report verification results, determines the verification result based on the q report verification results, and generates an audit suggestion according to the verification result, that is, a suggestion for how the user processes the target suspicious report. In this way, the generated audit suggestion is output for processing so that the user can view the audit suggestion and perform audit processing on the target suspicious report according to the audit suggestion.

[0117] wherein q can be an empirical value set according to a large number of experiments or experience, or the number of all fourth large models included in the model library.

[0118] The specific implementation process of determining the verification result based on the q report verification results can be: determining a result with the highest quality as the verification result from the q report verification results, or comprehensively analyzing the q report verification results, for example, determining the content with the most repeated verification content as the verification result from the q report verification results, or fusing the content approved by the verification in the q report verification results to generate the verification result.

[0119] Based on the foregoing embodiment, in other embodiments of the present application, the suspicious transaction processing device is further used to perform the following steps:

[0120] If the data query instruction is detected, the database corresponding to the query data is determined based on the data query instruction;

[0121] The application interface of the database is called to obtain the target data corresponding to the data query instruction;

[0122] The target data is output.

[0123] In the embodiment of the present application, the suspicious transaction processing device also has the function of data query. After the suspicious transaction processing device detects the data query instruction, the suspicious transaction processing device responds to the data query instruction, determines the database indicated in the data query instruction according to the data query instruction, and the database can be directly indicated in the data query instruction or determined according to the query content indicated in the data query instruction. The specific determination can be determined by the actual situation, which is not limited here. After the suspicious transaction processing device determines the database, the suspicious transaction processing device calls the pre-set application interface for accessing the database, establishes a communication connection with the database through the application interface, obtains the target data corresponding to the data query instruction from the database, and then outputs the target data. In this way, the response to the data query instruction is realized, the data in the database is quickly obtained, and the user experience is improved.

[0124] Based on the foregoing embodiment, in other embodiments of the present application, the suspicious transaction processing device is also used to perform the following steps:

[0125] If the user question and answer instruction is detected, the first user intention information is determined based on the user question and answer instruction;

[0126] From the model library, the k fifth largest models used to generate the user reply content are determined; wherein k is an integer greater than or equal to 1;

[0127] The k fifth largest models are used to generate the reply content corresponding to the first user intention information;

[0128] The reply content is output.

[0129] In the embodiment of the present application, the suspicious transaction processing device also has the function of question and answer. The user question and answer instruction is input by the user to the suspicious transaction processing device, and is used to inquire the suspicious transaction processing device. The user question and answer instruction can be input to the suspicious transaction processing device through the input device of the suspicious transaction processing device, such as microphone, keyboard, touchable screen, etc. In some application scenarios, it can also be sent to the suspicious transaction processing device through a third party device, for example, the third party device is a smart mobile terminal device, the smart mobile terminal device collects the user question and answer instruction, and then sends the user question and answer instruction to the suspicious transaction processing device.

[0130] After the suspicious transaction processing device detects the user question and answer instruction, the suspicious transaction processing device performs user intention recognition on the user question and answer instruction to obtain the first user intention information. In this process, the suspicious transaction processing device can perform user intention recognition on the user question and answer instruction through artificial intelligence technology, or through other user intention recognition methods such as keyword extraction. The process of user intention recognition can be determined according to the actual application scenario, which is not limited here.

[0131] The suspicious transaction processing device obtains k fifth largest models for generating the user reply from the model library, and inputs the first user intention information into each fifth largest model, so that each fifth largest model generates content for the first user intention information to reply, obtains k reply contents, and then obtains final reply content based on the k reply contents. The process of obtaining the final reply content based on the k reply contents can be: selecting the most reliable content from the k reply contents as the reply content, or comprehensively processing the k reply contents, for example, combining the reliable contents in the k reply contents to obtain the final reply content. The specific implementation process can be determined by actual conditions, which is not limited here.

[0132] Based on the foregoing embodiments, in other embodiments of the present application, the suspicious transaction processing device is further configured to perform the following steps:

[0133] displaying a suspicious transaction set; wherein the suspicious transaction set includes one or more currently identified suspicious transactions;

[0134] obtaining user input information;

[0135] obtaining second user intention information from the user input information;

[0136] generating a to-be-executed instruction based on the second user intention information; wherein the to-be-executed instruction is at least one of the following instructions: a transaction analysis instruction, a report analysis instruction, a report review instruction, a data query instruction, and a user question and answer instruction.

[0137] In the embodiments of the present application, the suspicious transaction set can be composed of suspicious transactions determined by the suspicious transaction processing device after analyzing the transactions, or can be a suspicious transaction set determined by other devices analyzing the transactions and sent to the suspicious transaction processing device. The specific implementation can be determined by actual conditions, which is not limited here. The suspicious transaction set includes one or more determined suspicious transactions.

[0138] The user input information can be input by the user through the input device of the suspicious transaction processing device, such as keyboard, microphone, touchable display screen, etc., or can be sent to the suspicious transaction processing device through a device having communication connection with the suspicious transaction processing device, such as a smart mobile terminal device, or a user computer device, etc. The user input information is information indicating the suspicious transaction processing device to perform related operations. In this way, the user can control the suspicious transaction processing device to perform corresponding task operations through natural language, ensuring the user's experience effect.

[0139] The suspicious transaction processing device performs intent recognition on the user input information, which can be achieved through artificial intelligence or other intent recognition methods, and is not limited specifically herein. For example, after the suspicious transaction processing device recognizes the second user intent information through artificial intelligence, it generates a corresponding to-be-executed instruction according to the recognized second user intent information, executes the to-be-executed instruction to perform a corresponding task, obtains a result corresponding to the user input information, and ensures the user's experience effect.

[0140] Based on the foregoing embodiments, in other embodiments of the present application, the suspicious transaction processing device is further configured to perform the following steps:

[0141] If it is detected that the target model in the model library needs to be updated, the historical sample data set corresponding to the target model in the sample pool is obtained; the target model is any large model in the model library.

[0142] The target model is trained using the historical sample data set to obtain an updated target model.

[0143] In the embodiments of the present application, detecting that the target model in the model library needs to be updated can be automatically generated after detecting that the number of samples in the sample pool exceeds a certain number, can be achieved according to a preset model update time, or can be achieved by a user performing a model update operation. The specific method can be determined by the actual situation, and is not limited specifically herein. The sample data stored in the sample pool is obtained after each sample is collected.

[0144] When it is detected that the target model in the model library needs to be updated, the historical sample data set corresponding to the target model is obtained from the sample pool using model training, and the target model is trained using the historical sample data set using model training until a trained target model is obtained. The original target model is replaced with the trained target model to achieve model updating and obtain an updated target model.

[0145] Based on the foregoing embodiments, the embodiments of the present application provide a suspicious transaction case assistant for implementing the suspicious transaction processing method described above, which is a highly integrated and intelligent system capable of providing professional support in the field of suspicious transactions for users through natural language interaction. The core of the assistant is based on advanced large model technology, which accurately analyzes the intent of the user's input question to obtain accurate recognition results, so that the focus of the user's intent can be quickly identified, such as asking about the characteristics of the case triggering suspicious transactions, querying the data of the client related dimensions, or requesting to review the case report. Then, based on the accurate recognition results, the system intelligently calls the corresponding processing branch to ensure that the user obtains the most relevant and accurate response. In the specific implementation process, the workflow of the entire system of the assistant can be implemented based on the AGENT platform, and the full automation and seamless connection from user input to final answer generation can be achieved by constructing workflow nodes and arranging multiple functional modules. Specifically, the assistant can include three main implementation processes, namely intelligent analysis process, intelligent review process, and self-iteration optimization process. Specifically, it can be as follows:

[0146] I. Intelligent analysis process

[0147] The intelligent analysis process mainly includes the following branch processes: question flow, corresponding to the implementation process when the data query instruction is detected; intelligent question and answer flow, corresponding to the implementation process when the user question and answer instruction is detected; and auxiliary analysis flow.

[0148] Among them, the question flow can be implemented by a question assistant. The question assistant can be designed as a highly intelligent query module focused on building a highly intelligent query module for quickly responding to and returning the index data of the client in the basic information, transaction records, fund transfer, and other key business fields through the convenient way of natural language interaction. In the implementation process, the question assistant fully utilizes the powerful data processing capability of the big data platform to deeply process and statistically analyze the complex data of the client in various dimensions. The bottom data accessed in the question flow mainly includes: the basic information of the client, such as the identity information and contact information of the client; the over-the-counter transaction information, including transaction type, amount, time, and operation traces; and the fund transfer information, including fund account number, transfer time, and amount.

[0149] In the implementation process, in order to build a comprehensive and detailed data view, the data index system has the characteristics of multi-dimensionality and multi-time span, that is, hundreds of refined indicators such as client basic information, transaction indicators, transfer indicators, account data, and operation flow indicators are used to meet the data analysis needs of different levels and different perspectives, and the above data also has high accuracy, timeliness, and usability.

[0150] Thus, a specific flow of an implementation can refer to Figure 2 As shown, the corresponding flow can be summarized as follows: in the application process, when the user raises a question through natural language, i.e., the user input question, first, the intention of the question is preliminarily identified by using advanced large model technology, and when it is confirmed that the question belongs to the question intention category according to the intention, the understanding of the intention of the question is further deepened, the data type and specific aspects that the user hopes to query are accurately analyzed, and the query dimensions and query parameters such as time range, account type, transaction dimension, and other key information are extracted from the user question to generate data query instructions. Then, the question assistant calls a series of application interfaces closely connected with the underlying data warehouse, efficiently responds to the data query instructions, executes the data query task, and outputs the query result. In this way, in the entire query process, the user does not need to perform any complex operation or learn a specific query syntax, and only needs to express the query requirement through natural and intuitive language to easily realize data query work across different time spans and covering different dimensions, greatly improving the convenience and efficiency of data query, and providing an unprecedented data insight experience for the user.

[0151] Among them, the intelligent question and answer flow focuses on providing instant answer services for users to address alarm indicator logic, system operation usage guidance, and other universally applicable problems. In the actual implementation process, Retrieval-Augmented Generation (RAG) can be used to achieve it. As a natural language processing technology combining information retrieval and text generation, RAG retrieves relevant information from an external knowledge base to provide rich background information and knowledge support for the generation model, thereby significantly improving the accuracy and relevance of text generation, enhancing the generation capability of the model, and making the generated content more accurate, reliable, and traceable. The workflow of RAG technology mainly includes three steps: indexing, retrieval, and generation. The specific implementation process is as follows: 1) Indexing: documents in external knowledge bases such as professional journals, books, etc. are segmented into chunks and encoded into vector form and stored in a vector database; 2) Retrieval: when the user inputs a query, the system encodes the query into a vector representation and retrieves the top-k chunks most relevant to the query in the vector database, where these chunks will serve as additional contextual information for generating text; 3) Generation: the original query and the retrieved data chunks are input into a pre-trained Transformer model, and the model generates the final answer or text by combining these information.

[0152] In implementing the functions of the intelligent question-answering process, it is first necessary to comprehensively and deeply summarize and organize the contents of index logic system, system operation process description, typical case analysis points, and review and evaluation standards, etc. to refine various key definitions, logical mapping relationships, question-answer (QA) pairs, and core point documents, laying a solid foundation for subsequent construction of the question-answering knowledge base. In the process of constructing the question-answering knowledge base, text processing techniques such as Natural Language Processing (NLP) can be used to convert knowledge base documents into vectorized data representations for storage, in order to improve data retrieval efficiency and better capture semantic associations between texts, providing strong support for subsequent semantic retrieval recall. Thus, as shown in the implementation process of Figure 3 the user inputs a question, the user's input question is converted into a semantic vector using NLP technology; then semantic retrieval recall corresponding to the semantic vector is performed in the constructed knowledge base vector index library, that is, the similarity between the semantic vector and each answer vector in the knowledge base is calculated to evaluate their degree of association; and after merging and sorting the calculated similarity indicators to obtain a sorting result, the large model combines the sorting result to generate and return the output answer that is most relevant and has the highest matching degree to the user's question, thereby achieving accurate and efficient answers to the user's question. In this way, user satisfaction and efficiency in the use process can be significantly improved, providing users with a more convenient and intelligent interactive experience.

[0153] Among them, the implementation process of the auxiliary analysis process aims to help users quickly grasp the analysis points of the current case, provide effective analysis clues and directions, and indicate which dimensions should be analyzed. In the implementation process, first, the various monitoring indicators hit by the current client triggering the alarm and their corresponding logical rules are identified, among which the monitoring indicators are the direct cause of the client triggering the suspicious transaction alarm and can be used as the starting point and preliminary clue for analysis. Second, the core indicator data calculated by the current client based on the counter processing is obtained, which corresponds to the indicator data of each dimension of the client described in the aforementioned question assistant, and can reflect the client's transaction behavior, fund flow, account activity, risk status, and other important information. Introducing these core indicator data is beneficial for subsequent in-depth analysis and provides a solid foundation. At the same time, in some application scenarios, case analysis point rules can be input, it should be noted that these case analysis point rules can be obtained by summarizing the characteristics, patterns, and analysis points of different abnormal suspicious scenarios according to the experience and lessons of past cases, to provide a rich knowledge base and reference for the reasoning analysis of the large model.

[0154] In this way, after obtaining the above information, all the information is input into the large model, and the large model is configured to write corresponding prompt words. The prompt words are used to guide the large model to conduct in-depth analysis on the current customer according to specific analysis requirements by using the excellent reasoning ability of the large model. According to the monitoring indicators, core indicator data and case analysis point rules, the large model can automatically sort out the analysis points that need to be paid attention to in the current case. These points may include the identity of the customer, abnormal transaction situation, transfer situation and other key features. At the same time, the large model will also deeply analyze the potential suspicious points of the case to obtain the corresponding target analysis as mentioned above. In this process, by using complex algorithms, the transaction behavior of the customer is analyzed and compared in detail to find abnormal points that do not conform to the normal behavior pattern, and to intelligently identify the same case associated personnel and convergent transaction personnel. By comparing the transaction characteristics of the customer with the characteristics and patterns of suspicious scenarios, the large model can accurately determine whether the customer has some suspicious transaction behavior or potential risk. These suspicious points are usually hidden in complex transaction data, and by using the powerful data processing and analysis capabilities of the large model, suspicious information can be accurately identified. In this way, the implementation process corresponding to the detection of the transaction analysis instruction is realized. Correspondingly, the approximate implementation process of the above process can be referred to as shown in Figure 4 The large model is trained based on customer indicator data, indicator logic, analysis points and case detail data, i.e., case sample data.

[0155] In addition, the auxiliary analysis process can also have the function of networking search with the Internet in the implementation process, so as to accurately retrieve information on the external Internet according to the input intention of the user. In this way, relevant external Internet data such as the employment situation of the customer and the operating status of the enterprise can be quickly obtained. These data not only enrich the information source, but also provide a more solid basis for the model's judgment. By integrating these external data, various factors can be considered comprehensively to conduct more in-depth and comprehensive analysis and to dig out more potential suspicious points, so as to obtain more accurate and reliable conclusions. This combination of real-time data and intelligent analysis capabilities makes the auxiliary analysis process excellent in decision support, risk assessment and information verification, greatly improving the work efficiency and decision quality of the user.

[0156] In this way, the assisted analysis process provides analysts with clear analytical clues and directions, automatically generating more professional and accurate investigation conclusions. These clues and conclusions not only help analysts quickly understand the background and circumstances of the case, but also guide them to delve deeper into the nature and root causes of the problem, thereby formulating more precise and effective response strategies. This significantly improves the efficiency and accuracy of analysis and provides strong support for financial institutions' risk prevention and control efforts.

[0157] 2. Intelligent Review Process

[0158] The intelligent audit process mainly includes the following branch processes: report summary process, which corresponds to the implementation process after the aforementioned report analysis instructions are detected; report audit process, which corresponds to the implementation process after the aforementioned report audit instructions are detected.

[0159] The report summary process is based on the latest big model technology, using deep learning and NLP technology to summarize suspicious reports. The executive summary is determined by identifying the intent of the user input question and can automatically extract key information and core points from the report. The report summary process implemented using the big model can include the following implementation steps:

[0160] 1. Text preprocessing: Perform text preprocessing on suspicious reports.

[0161] Text preprocessing includes at least data cleaning, word segmentation, stemming, and stop word removal. The purpose of this step is to remove irrelevant information and unify the data format to facilitate feature extraction and model training.

[0162] 2. Feature Extraction: Using text vectorization techniques such as the Bag of Words model and Term Frequency–Inverse Document Frequency (TF-IDF), the pre-processed suspicious report text is converted into numerical features for processing by machine learning models. When converting to numerical features, pre-trained word embedding models such as Word2Vec, GloVe, and FastText can be used to convert words into fixed-size vector features that capture the semantic information of the words.

[0163] 3. Key information extraction: Use text mining techniques such as topic modeling and keyword extraction to identify key topics and high-frequency words in the report, thereby determining the core content of the report.

[0164] 4. Semantic Analysis: Through deep learning large models, the sentences in the report are analyzed semantically, and sentences and paragraphs with important meanings are identified, which are often the essence of the report.

[0165] The deep learning large model corresponds to the aforementioned second large model.

[0166] 5. Abstract Generation: Based on the above analysis, the intelligent summary function will generate a concise report abstract, which includes the main findings, key evidence and conclusions of the report.

[0167] Finally, human review assistance: output the report abstract to help the reviewer quickly grasp the key points of the report, and then analyze the specific details in depth, so as to improve the accuracy and efficiency of the review.

[0168] Correspondingly, the above process can be simplified as shown in the process implementation diagram. Figure 5

[0169] Among them, the abstract generated by the intelligent summary function aims to assist human review and reduce the workload of the reviewer, rather than replacing the work of the reviewer, ensuring the quality and efficiency of the review. This allows the reviewer to focus more on analysis and decision-making rather than being bogged down by tedious data sorting work, thereby ensuring compliance while saving the institution a lot of time and resources.

[0170] Among them, the report review process in the process of reviewing the report, first of all, can use advanced algorithms and technical means to accurately identify the key points of attention and potential suspicious points in the current suspicious cases, and the specific identification process can refer to the aforementioned auxiliary analysis process. These key points of attention may include but are not limited to customer identity information, transfer aspects, transaction patterns, and transaction behaviors that do not match the known business or risk status of the customer. At the same time, the system will also analyze the details of the transaction records, such as transaction time, transaction channel, and currency used, to fully capture possible hidden suspicious scenarios.

[0171] Then check the analysis content of the device report one by one, ensure that these analyses not only cover all the key points of attention and suspicious points identified in advance, but also conduct in-depth and detailed analysis of these elements. The system will review the data analysis logic and reasoning process in the report to verify whether it is rigorous, reasonable, and whether any important clues or evidence have been missed. This step aims to ensure that the analysis content of the report is comprehensive and accurate, and can fully reflect the true situation and potential risks of the case.

[0172] ​Further, it is necessary to determine whether the analysis content of the audit report is sufficient to support the conclusion. Specifically, it can be determined by evaluating whether the conclusion in the audit report is consistent with the facts, whether it is based on sufficient analysis and reasonable inference, etc. If it is found that the conclusion in the audit report has logical flaws, insufficient evidence or reasoning errors, etc., the report audit process can point out the problems in time, and provide specific and targeted audit suggestions for the auditors based on other problems and potential risks found in the report audit process. These suggestions may involve strengthening the depth and breadth of data analysis, perfecting the evaluation dimensions, confirming the analysis conclusions, etc., aiming to help auditors more efficiently identify and handle suspicious transactions, and ensure the accuracy and authority of the report. With the assistance of the report audit process, auditors can more accurately grasp the key information of the case and improve the accuracy and efficiency of the audit work.

[0173] Correspondingly, the above process can be simplified as a process implementation schematic diagram as shown in Figure 6 .

[0174] The report audit process can be implemented based on advanced large model technology and fine prompt word engineering. Large model technology provides powerful data processing and analysis capabilities for the report audit process, enabling it to handle complex and diverse suspicious transaction cases; prompt word engineering guides the large model in the report audit process to more accurately understand and process key information in the case through carefully designed prompt words and rules, thereby realizing the function of intelligent audit. In this way, it can quickly identify and handle a large number of suspicious transaction cases in a short period of time, provide strong support for the handling of suspicious transactions, reduce the workload and error rate of manual audit, and improve the overall audit efficiency and quality.

[0175] III. Self-iterative optimization process

[0176] The foregoing intelligent analysis process and intelligent audit process can fully utilize the data and experience in historical reports, and continuously tap the value of historical case libraries to realize self-iterative updating of the system. Specifically, the intelligent analysis process and the intelligent audit process can learn from historical suspicious reports regularly, deeply mine and analyze a large number of historical case reports, accurately capture various suspicious transaction patterns and evolution trends, and identify key analysis elements and important content in reports under different suspicious scenarios, and systematically summarize and organize them. Based on these analysis results, the system will update and optimize the relevant knowledge base, prompt words and model parameters in time, ensuring that the system is always synchronized with the latest risk situation and regulatory requirements, maintaining an efficient and accurate operating state.

[0177] In this way, through dynamic learning and autonomous optimization, the limitations of traditional methods are broken through, and the performance can be continuously improved in a changing environment. By fully releasing the potential value of historical cases, the system provides more intelligent and forward-looking decision support for users, significantly improving the accuracy of intelligent analysis and review, and providing strong technical support for risk prevention and compliance management of financial institutions.

[0178] In some application scenarios, when applying the model for analysis and processing in the foregoing intelligent analysis process and intelligent review process, the model can be determined through a multi-model collaborative architecture system, as shown in Figure 7 The specific implementation process includes at least the following implementation steps:

[0179] Step a11, receiving a user query instruction qurry.

[0180] Step a12, identifying the user qurry to obtain the user intent.

[0181] Step a13, based on the user intent, filtering a certain number of large models from the model library for parallel computing to obtain an output result.

[0182] The model library can also be a model pool, which can include a large number of various large models, including single-modal large models and multi-modal large models. The specific implementation can be determined by actual conditions, and is not limited here. When selecting large models into the model library, the selection criteria for selecting large models mainly consider the current best performance of each model in a specific task, field adaptability, response time delay and economic cost balance, etc.

[0183] Through intent recognition, domain classification and complexity evaluation on the user query, the system intelligently assigns the user query to 3-5 most suitable models for parallel computing to ensure optimal utilization of computing resources.

[0184] Step a14, evaluating the output result of each large model from different dimensions to obtain an evaluation result.

[0185] The output result of each large model includes at least the following dimensions: accuracy (Accuracy): factual correctness, data precision; completeness (Completeness): proportion of covering user demand points; logicality (Coherence): completeness of argument chain; readability (Readability): language fluency, professional term adaptability; safety (Safety): compliance, privacy protection.

[0186] Step a15, scoring the evaluation result of each large model to obtain a quantitative evaluation value.

[0187] Wherein, when scoring each evaluation result of the large model, a trained Gradient Boosting Decision Tree (GBDT) algorithm model can be selected to fuse the evaluation results of each large model to determine the final score of each evaluation result, that is, the probability of each evaluation result being selected by the user under the current conditions. Wherein, the trained GBDT algorithm model can be trained by the following training method: obtaining sample data, wherein the sample data can be obtained by using a large model in combination with artificial forms to construct labels and the like, and then based on the obtained sample data, an initial GBDT algorithm model is trained by using a model training method until a trained GBDT algorithm model is obtained, so that a supervised machine learning model is obtained.

[0188] Step a16, output the large model with the highest quantitative evaluation value.

[0189] It should be noted that for the foregoing model library, the following processing can be performed on the model library to ensure the reliability of the sample data in the model library: a result annotation pool is established, and manual review is performed regularly, for example, a sampling rate ≥ 5%; a reinforcement learning framework is constructed, and a Deep Q-Network (DQN) algorithm is used to optimize the model scheduling strategy; a model pool library implements a weekly update mechanism, for example, accessing the latest research results from arXiv, PubMed, and the like.

[0190] In this way, the professional depth of a single model is retained, and the systemic risk of a single model is avoided through the balancing and supervision mechanism between models, providing an innovative solution for building a trusted artificial intelligence system.

[0191] In this way, the comprehensive intelligent analysis system integrating natural language interaction, intelligent question answering, auxiliary analysis, report summarization, and review proposed by the embodiments of the present application applies multiple technologies such as natural language processing, big data technology, large model technology, and AGENT platform to suspicious transaction case analysis and review links. Users only need to use natural language dialogue to easily obtain customer basic information, transaction index data, and case analysis guidance, helping analysis personnel to conduct in-depth case analysis. At the same time, it can also help review personnel to efficiently summarize reports and preliminarily review the contents of the reports, improve the quality of suspicious transaction reports, improve the work efficiency of analysis and review personnel, realize comprehensive and detailed monitoring and analysis of suspicious transaction cases, and provide omnidirectional and intelligent support for the processing of suspicious transactions.

[0192] It should be noted that the foregoing embodiments in the present application can be combined as needed to achieve the actual situation, and will not be described in detail here.

[0193] The suspicious transaction processing method provided by the embodiments of the present application comprises the following steps: if a transaction analysis instruction for suspicious analysis of a target suspicious transaction is detected, preset monitoring indexes corresponding to the target suspicious transaction are acquired, transaction index data corresponding to the target suspicious transaction is acquired, historical analysis experience data matched with the target suspicious transaction is acquired, m first large models for suspicious information analysis are determined from a model library, the m first large models are used to perform suspicious information analysis on the preset monitoring indexes, the transaction index data and the historical analysis experience data for the target suspicious transaction, and a target analysis result is obtained. In this way, when the transaction analysis instruction for suspicious analysis of the target suspicious transaction is detected, the preset monitoring indexes and the transaction index data corresponding to the target suspicious transaction and the historical analysis experience data are analyzed by using the plurality of first large models to obtain a reliable target analysis result. Since the same object is analyzed by using the plurality of large models to obtain the analysis result, the reliability of the final analysis result is ensured, the problem of low analysis efficiency of the anti-money laundering suspicious transaction is solved, and a technical solution for automatically and efficiently analyzing the anti-money laundering suspicious transaction is provided, thereby effectively improving the analysis efficiency and ensuring the analysis accuracy.

[0194] Based on the foregoing embodiments, the embodiments of the present application provide a suspicious transaction processing device, which can be applied to Figure 8 As shown in the method embodiments, the suspicious transaction processing device 2 at least comprises an acquisition unit 21, a determination unit 22 and an analysis unit 23.

[0195] The acquisition unit 21 is configured to acquire preset monitoring indexes corresponding to a target suspicious transaction if a transaction analysis instruction for suspicious analysis of the target suspicious transaction is detected.

[0196] The acquisition unit 21 is further configured to acquire transaction index data corresponding to the target suspicious transaction.

[0197] The acquisition unit 21 is further configured to acquire historical analysis experience data matched with the target suspicious transaction.

[0198] The determination unit 22 is configured to determine m first large models for suspicious information analysis from a model library; wherein m is an integer greater than or equal to 1.

[0199] The analysis unit 23 is configured to use the m first large models to perform suspicious information analysis on the preset monitoring indexes, the transaction index data and the historical analysis experience data for the target suspicious transaction, and obtain a target analysis result; wherein the target analysis result is at least used to indicate suspicious information existing in the target suspicious transaction.

[0200] In other embodiments of the present application, the analysis unit is specifically configured to implement the following steps:

[0201] The suspicious information analysis is performed on the preset monitoring indicators, transaction indicator data and historical analysis experience data by each first large model, to obtain a reference analysis result of each first large model;

[0202] The reference analysis result of each first large model is quality evaluated from a target dimension, to obtain a first evaluation value of each first large model, and then m first evaluation values are obtained; wherein, the target dimension includes one or more of the following dimensions: accuracy, integrity, logic, readability, security;

[0203] Based on the m first evaluation values, a target analysis result is determined from the m reference analysis results.

[0204] In other embodiments of the present application, the suspicious transaction processing apparatus further comprises a generation unit and an output unit; wherein:

[0205] The acquisition unit is further configured to acquire the target suspicious report if a report analysis instruction for performing report summary analysis on the target suspicious report is detected;

[0206] The generation unit is configured to generate report summary content based on the target suspicious report;

[0207] The output unit is configured to output the report summary content for user review.

[0208] In other embodiments of the present application, the generation unit is specifically configured to implement the following steps:

[0209] From the model library, n second large models for text recognition are determined; wherein, n is an integer greater than or equal to 1;

[0210] The n second large models are used to perform report analysis on the target suspicious report, to obtain report summary content.

[0211] In other embodiments of the present application,

[0212] The acquisition unit is further configured to acquire the target suspicious report if a report review instruction for performing report review on the target suspicious report is detected;

[0213] The determination unit is further configured to determine, from the model library, p third large models for report review analysis; wherein, p is an integer greater than or equal to 1;

[0214] The analysis unit is further configured to use the p third large models to perform report review analysis on the target suspicious report, to obtain a report analysis result; wherein, the report analysis result is at least used to indicate the reliability of the target suspicious report.

[0215] In other embodiments of the present application,

[0216] The determining unit is further configured to determine q fourth large models for performing the report content verification processing from the model library, q being an integer greater than or equal to 1.

[0217] The analyzing unit is further configured to perform the report content verification processing on the target suspicious report by using the q fourth large models to obtain a verification result.

[0218] The generating unit is further configured to generate an audit suggestion based on the verification result.

[0219] The output unit is further configured to output the audit suggestion.

[0220] In other embodiments of the present application,

[0221] The determining unit is further configured to determine a database corresponding to the data query instruction based on the data query instruction if the data query instruction is detected.

[0222] The obtaining unit is further configured to call an application interface of the database to obtain target data corresponding to the data query instruction.

[0223] The output unit is further configured to output the target data.

[0224] In other embodiments of the present application,

[0225] The determining unit is further configured to determine the first user intent information based on the user question and answer instruction if the user question and answer instruction is detected.

[0226] The determining unit is further configured to determine k fifth large models for generating user reply content from the model library, k being an integer greater than or equal to 1.

[0227] The generating unit is further configured to generate reply content corresponding to the first user intent information by using the k fifth large models.

[0228] The output unit is further configured to output the reply content.

[0229] In other embodiments of the present application, the suspicious transaction processing apparatus further includes a display unit and an obtaining unit, wherein:

[0230] The display unit is configured to display a suspicious transaction set, wherein the suspicious transaction set includes one or more currently identified suspicious transactions.

[0231] The obtaining unit is further configured to obtain user input information.

[0232] The obtaining unit is further configured to obtain user input information.

[0233] The generating unit is configured to generate an instruction to be executed based on the second user intention information, wherein the instruction to be executed is at least one of a transaction analysis instruction, a report analysis instruction, a report review instruction, a data query instruction, and a user question and answer instruction.

[0234] In other embodiments of the present application, the suspicious transaction processing apparatus further comprises an updating unit and a model training unit, wherein:

[0235] The updating unit is configured to, if it is detected that a target model in the model library needs to be updated, obtain a historical sample data set corresponding to the target model in the sample pool, wherein the target model is any large model in the model library.

[0236] The model training unit is configured to perform model training on the target model using the historical sample data set to obtain an updated target model.

[0237] It should be noted that the interaction process between the units and modules in the embodiments of the present application can refer to the interaction process between the same steps in the foregoing method embodiments, which will not be described in detail here.

[0238] The suspicious transaction processing apparatus provided in the embodiments of the present application, if a transaction analysis instruction for suspicious analysis of a target suspicious transaction is detected, obtains a preset monitoring indicator corresponding to the target suspicious transaction, and obtains transaction indicator data corresponding to the target suspicious transaction, and after obtaining historical analysis experience data matched with the target suspicious transaction, determines m first large models for suspicious information analysis from the model library, and uses the m first large models to perform suspicious information analysis on the preset monitoring indicator, the transaction indicator data and the historical analysis experience data for the target suspicious transaction to obtain a target analysis result. In this way, when a transaction analysis instruction for suspicious analysis of a target suspicious transaction is detected, a plurality of first large models are used to perform suspicious analysis on the preset monitoring indicator and the transaction indicator data corresponding to the target suspicious transaction and the historical analysis experience data to obtain a reliable target analysis result. Since the same object is analyzed by multiple large models to obtain an analysis result, the reliability of the final analysis result is ensured, the problem of low analysis efficiency of anti-money laundering suspicious transactions is solved, and a technical solution for automatically and efficiently analyzing anti-money laundering suspicious transactions is proposed, which effectively improves the analysis efficiency and ensures the accuracy of the analysis.

[0239] Based on the foregoing embodiments, an embodiment of the present application provides a suspicious transaction processing device, which can be applied to Figure 1 In the suspicious transaction processing method provided by the corresponding embodiments, refer to Figure 9 As shown in the figure, the suspicious transaction processing device 3 at least includes a storage 31, a processor 32 and a communication bus 33, wherein:

[0240] The storage 31 is configured to store executable instructions.

[0241] a communication bus 33 for enabling communications between the processor and the memory;

[0242] a processor 32 for executing a suspicious transaction processing program stored in the memory, to implement the suspicious transaction processing method as described above, and Figure 1 the implementation process in the suspicious transaction processing method provided by the corresponding embodiments, which will not be repeated here.

[0243] Based on the foregoing embodiments, the embodiments of the present application provide a computer readable storage medium, referred to as a storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the implementation process in the suspicious transaction processing method as described above with reference to Figure 1 the implementation process in the suspicious transaction processing method provided by the corresponding embodiments, which will not be repeated here.

[0244] Based on the foregoing embodiments, the embodiments of the present application further provide a computer program product, which includes a computer program, and the computer program can be executed by a processor of a scheduling node or a processor of a first task execution platform to complete any method step described above.

[0245] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage, etc.) containing computer-usable program code.

[0246] The present application is described with reference to flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure One a means for implementing each one or more functions specified in a flow or a block. Figure One a means for implementing each one or more functions specified in a flow or a block.

[0247] These computer program instructions can also be stored in a computer-readable memory capable of guiding a computer or other programmable data processing devices to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction means, which implements the functions specified in the flowcharts and / or block diagrams. Figure Oneone or more processes and / or blocks Figure One the function specified in the one or more blocks.

[0248] These computer program instructions can also be loaded into computer or other programmable data processing devices, so that a series of operation steps are performed on the computer or other programmable data processing devices to generate computer-implemented processes, thus the instructions executed on the computer or other programmable data processing devices provide processes for implementing the flow Figure One one or more processes and / or blocks Figure One the function specified in the one or more blocks.

[0249] The above description is only the preferred embodiment of the present application, not for limiting the protection range of the present application.

Claims

1. A method for handling suspicious transactions, characterized in that: The method comprises: If a transaction analysis instruction for performing a suspicious analysis on a target suspicious transaction is detected, obtaining a preset monitoring indicator corresponding to the target suspicious transaction; Obtaining transaction indicator data corresponding to the target suspicious transaction; Acquire historical analysis experience data matching the target suspicious transaction; Determining m first largest models for analyzing suspicious information from a model library; wherein m is an integer greater than or equal to 1; The m first large models are used to perform suspicious information analysis on the target suspicious transaction using the preset monitoring indicators, the transaction indicator data, and the historical analysis experience data to obtain a target analysis result; wherein the target analysis result is at least used to indicate the existence of suspicious information in the target suspicious transaction.

2. The method according to claim 1, characterized in that The m first large models are used to perform suspicious information analysis on the target suspicious transaction based on the preset monitoring indicators, the transaction indicator data, and the historical analysis experience data to obtain a target analysis result, including: Performing suspicious information analysis on the preset monitoring indicators, the transaction indicator data, and the historical analysis experience data using each of the first models to obtain a reference analysis result of each of the first models; Performing a quality assessment on the reference analysis results of each of the first large models based on a target dimension to obtain a first assessment value for each of the first large models, thereby obtaining m first assessment values; wherein the target dimension includes one or more of the following dimensions: accuracy, completeness, logic, readability, and security; Based on the m first evaluation values, the target analysis result is determined from the m reference analysis results.

3. The method according to claim 1, characterized in that The method further comprises: If a report analysis instruction for performing a report summary analysis on a target suspicious report is detected, obtaining the target suspicious report; Generate a report summary based on the target suspicious report; Output the report summary for user review.

4. The method according to claim 1, wherein The method further comprises: If a target suspicious report is detected, a report review instruction for report review is provided to obtain the target suspicious report; Determining, from the model library, p third largest models for performing report review analysis; wherein p is an integer greater than or equal to 1; The p third largest models are used to perform a report review and analysis on the target suspicious report to obtain a report analysis result; wherein the report analysis result is at least used to indicate the reliability of the target suspicious report.

5. The method according to claim 4, characterized in that The method further comprises: Determining, from the model library, q fourth largest models for performing report content verification processing; wherein q is an integer greater than or equal to 1; Using the q fourth-largest models, verify the content of the target suspicious report to obtain a verification result; generating audit recommendations based on the verification results; Output the audit suggestion.

6. The method according to claim 1, characterized in that The method further comprises: If a data query instruction is detected, determining a database corresponding to the data query instruction based on the data query instruction; Calling the application interface of the database to obtain the target data corresponding to the data query instruction; The target data is output.

7. The method according to claim 1, characterized in that The method further comprises: If a user question and answer instruction is detected, determining first user intention information based on the user question and answer instruction; Determining k fifth largest models from the model library for generating user reply content; wherein k is an integer greater than or equal to 1; Using the k fifth largest models, generating reply content corresponding to the first user intent information; Output the reply content.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: Displaying a suspicious transaction set; wherein the suspicious transaction set includes one or more currently identified suspicious transactions; Get user input information; obtaining second user intention information based on the user input information; Based on the second user intention information, a to-be-executed instruction is generated; wherein the to-be-executed instruction is at least one of the following instructions: a transaction analysis instruction, a report analysis instruction, a report review instruction, a data query instruction, and a user question and answer instruction.

9. The method according to any one of claims 1 to 7, characterized in that The method further comprises: If it is detected that a target model in the model library needs to be updated, a historical sample data set corresponding to the target model in the sample pool is obtained; wherein the target model is any large model in the model library; The target model is trained using the historical sample data set to obtain an updated target model.

10. A suspicious transaction processing device, characterized in that: The device comprises: an acquisition unit, a determination unit and an analysis unit; wherein: The acquisition unit is configured to acquire a preset monitoring indicator corresponding to a target suspicious transaction upon detecting a transaction analysis instruction for performing a suspicious analysis on the target suspicious transaction; The acquisition unit is further configured to acquire transaction indicator data corresponding to the target suspicious transaction; The acquisition unit is further configured to acquire historical analysis experience data matching the target suspicious transaction; The determining unit is used to determine m first large models for performing suspicious information analysis from the model library; wherein m is an integer greater than or equal to 1; The analysis unit is configured to use the m first large models to perform suspicious information analysis on the target suspicious transaction based on the preset monitoring indicators, the transaction indicator data, and the historical analysis experience data, to obtain a target analysis result; wherein the target analysis result is used to at least indicate the presence of suspicious information in the target suspicious transaction.

Images