Risk identification method and device, electronic equipment and computer program product

Abstract

The invention discloses a risk identification method and device, electronic equipment and a computer program product. Relates to the field of financial science and technology, and the method comprises the steps: obtaining a financial account of a user, extracting M financial records of the user in a preset time period according to the financial account, processing the M financial records, and obtaining M financial behavior data; a behavior recognition model is obtained, the M financial behavior data are input into the behavior recognition model, a risk recognition result is output, the behavior recognition model is obtained by training a radial basis network through a financial data set, and the risk recognition result is used for indicating whether a risk record exists in the financial account or not; if the risk identification result indicates that the financial account has the risk record, risk prompt information is generated, and the risk prompt information is used for prompting the user that the risk behavior exists. According to the method and the device, the technical problem of low recognition accuracy when risk behavior recognition is carried out on the user in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and specifically, to a risk identification method, device, electronic device, and computer program product. Background Art

[0002] The complexity of the current socioeconomic environment and the trend of globalization have accelerated the innovation and diversification of unusual financial methods, making abnormal financial activities increasingly complex and covert, posing a significant threat to the stability of the financial system. Against the backdrop of explosive growth in transaction data and increasing real-time requirements, financial institutions must enhance their ability to identify high-risk and suspicious transactions, such as high-frequency transfers and abnormal cross-regional fund flows.

[0003] However, traditional rule engine systems rely on "IF-THEN" logic chains and trigger alarms through preset static thresholds (such as single-day transfers exceeding a preset amount). However, fixed rules cannot effectively identify the threshold splitting strategies adopted by actors to evade monitoring. Moreover, the rule-based system can only identify known abnormal financial behavior patterns, with low coverage, and cannot cope with complex behaviors such as abnormal financial behaviors of new virtual assets. In addition, the update cycle of the rule engine is long and it cannot adapt to new abnormal financial behavior tools in a timely manner. Large institutions need to maintain hundreds of rules for cross-validation, which greatly increases operating costs and false alarm rates.

[0004] In addition, machine learning algorithms rely on artificial feature engineering, but these algorithms have difficulty capturing the nonlinear correlation of multi-layer nested funds, and artificial feature design is difficult to fully cover, and it is easy to ignore the temporal correlation of transaction data; deep learning architectures face high demands on computing resources in anti-abnormal financial behavior applications, and the "black box" characteristics of deep learning models reduce their interpretability, making it difficult to meet algorithmic audits under regulatory requirements. For low-frequency but high-risk event samples, the learning effect of deep learning models is often unsatisfactory.

[0005] Furthermore, graph analysis techniques, such as community discovery and node centrality analysis, analyze the topological structure of transaction networks to identify potential anomalous financial behavior. However, these methods are typically based on static graph assumptions and are unable to capture the spatiotemporal evolution of capital flows in real time. This is particularly true for very large graphs (e.g., those with over a billion nodes), which suffer from long computational latency and fall far short of the requirements of real-time payment scenarios. Furthermore, graph analysis tends to overlook account attribute characteristics, resulting in a high false positive rate.

[0006] Regarding the technical problem of low recognition accuracy when identifying risky behaviors of users in related technologies, no effective solution has been proposed so far. Summary of the Invention

[0007] The main purpose of the present application is to provide a risk identification method and device, electronic equipment and computer program product, to solve the technical problem of low identification accuracy in related art when identifying risk behavior of a user.

[0008] To achieve the above purpose, according to one aspect of the present application, a risk identification method is provided. The method comprises: obtaining a user's financial account, extracting M financial records of the user in a preset time period according to the financial account, processing the M financial records to obtain M financial behavior data, wherein M is a positive integer; obtaining a behavior identification model, inputting the M financial behavior data into the behavior identification model, and outputting a risk identification result, wherein the behavior identification model is trained by a radial basis network based on a financial data set, the financial data set includes a plurality of historical financial behavior data and a plurality of historical risk identification results, and the risk identification result is used to indicate whether the financial account has a risk record; if the risk identification result indicates that the financial account has a risk record, generating a risk prompt information, wherein the risk prompt information is used to prompt the user to have a risk behavior.

[0009] Further, the behavior identification model is trained in the following way: obtaining N financial accounts and Y historical financial records of each financial account in a historical time period, obtaining N groups of historical financial records, wherein each financial account corresponds to a historical risk identification result, each historical financial record is associated with a financial category, and N and Y are positive integers; the financial category associated with each historical financial record is processed to obtain N groups of historical financial behavior data, and N groups of historical financial behavior data and N historical risk identification results are combined to obtain a financial data set; obtaining a radial basis network, adjusting the parameters of the radial basis network using the financial data set, and obtaining the behavior identification model.

[0010] Further, processing the M financial records to obtain M financial behavior data comprises: preprocessing the M financial records to obtain M initial processing records; obtaining the financial categories of the M initial processing records and the coding rules of each financial category, performing numerical coding processing on the M initial processing records according to the coding rules of each financial category to obtain M initial processing data; and performing feature conversion processing on the M initial processing data to obtain M financial behavior data, wherein the feature conversion processing at least includes feature dimension reduction processing and normalization processing.

[0011] Further, the radial basis network comprises a hidden layer and an output layer, and the behavior recognition model is obtained by adjusting parameters of the radial basis network by using the financial data set, and the adjusting parameters of the radial basis network by using the financial data set comprises: extracting P historical financial behavior data from the financial data set by the hidden layer by using a clustering algorithm, and determining each historical financial behavior data as a clustering center to obtain P initial clustering centers, wherein P is a positive integer; determining a cluster according to each initial clustering center to obtain P clusters, and determining a clustering center of each cluster as a basis function center of the hidden layer to obtain P basis function centers; determining a radial basis width of the radial basis network according to the P basis function centers to obtain a radial basis width value; processing N sets of historical financial behavior data by the output layer to output N preset result parameters, and determining a weight value of the output layer according to the radial basis width value, the N preset result parameters and N historical risk recognition results, wherein each preset result parameter is a numerical representation of each preset risk recognition result output by the output layer; and constructing the behavior recognition model by the P basis function centers and the weight value of the output layer.

[0012] Further, the determining the P clusters according to each initial clustering center comprises: respectively calculating the Euclidean distances from historical financial behavior data other than the P historical financial behavior data to each initial clustering center, and distributing the historical financial behavior data other than the P historical financial behavior data to the clusters corresponding to the P initial clustering centers according to each Euclidean distance to obtain P initial clusters; calculating the mean values of the P initial clusters to obtain P cluster mean values, and updating the clustering centers of each initial cluster according to each cluster mean value to obtain P updated clustering centers; generating P updated clusters based on the P updated clustering centers, and determining whether the P updated clusters satisfy a convergence condition, wherein the convergence condition at least comprises one of the following: reaching a preset iteration number, stopping distributing data to each cluster, and a moving distance of the clustering center of each cluster being less than a preset threshold; in a case where the P updated clusters do not satisfy the convergence condition, iteratively processing the P updated clusters until the P iterated clusters satisfy the convergence condition, and determining the P iterated clusters as the P clusters.

[0013] Further, the determining the radial basis width of the radial basis network according to the P basis function centers to obtain the radial basis width value comprises: obtaining two basis function centers farthest from each other from the P basis function centers to obtain a first basis function center and a second basis function center; calculating a difference value of the first basis function center and the second basis function center to obtain a center distance, and calculating a ratio of the center distance to P to obtain the radial basis width value.

[0014] Further, the output layer processes the N sets of historical financial behavior data to output N preset result parameters, and determines the weight of the output layer according to the radial basis width value, the N preset result parameters and N historical risk identification results, including: for a financial account, the output layer recursively processes a set of historical financial behavior data corresponding to the financial account and the radial basis width to obtain an output vector; an initial weight of the output layer is obtained, and a product of the output vector and the initial weight is calculated to obtain a preset result parameter of the financial account; a numerical representation corresponding to a historical risk identification result corresponding to each financial account is obtained to obtain N historical result parameters, and it is determined whether there is an error between the preset result parameter corresponding to each financial account and the corresponding historical result parameter; if there is an error between the preset result parameter and the historical result parameter of T financial accounts in the N financial accounts, an error variance matrix is constructed according to the preset result parameter and the historical result parameter of the T financial accounts, wherein T is a positive integer; a smoothing factor is obtained, and a forgetting factor is calculated based on the smoothing factor, and the initial weight is updated using the error variance matrix and the forgetting factor to obtain the weight of the output layer.

[0015] To achieve the above object, according to another aspect of the present application, a risk identification device is provided. The device comprises: a first obtaining unit configured to obtain a financial account of a user, extract M financial records of the user within a preset time period according to the financial account, process the M financial records to obtain M financial behavior data, wherein M is a positive integer; a second obtaining unit configured to obtain a behavior identification model, input the M financial behavior data into the behavior identification model, and output a risk identification result, wherein the behavior identification model is trained by a radial basis network based on a financial data set, the financial data set comprises a plurality of historical financial behavior data and a plurality of historical risk identification results, and the risk identification result is used to indicate whether the financial account has a risk record; and a generating unit configured to generate a risk prompt information if the risk identification result indicates that the financial account has a risk record, wherein the risk prompt information is used to prompt the user to have a risk behavior.

[0016] According to another aspect of the embodiment of the present application, a computer readable storage medium is also provided, which comprises a stored executable program, wherein the computer readable storage medium controls the device where the computer readable storage medium is located to execute any one of the above risk identification methods when the executable program is running.

[0017] According to another aspect of the embodiment of the present application, an electronic device is also provided, which comprises one or more processors and a memory, the memory stores an executable program, and the processor is configured to run the program, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above risk identification methods.

[0018] According to another aspect of the embodiments of the present application, there is also provided a computer program product comprising a computer program which, when executed by a processor, implements any of the above-mentioned risk identification methods.

[0019] In the embodiments of the present application, the risk identification method is adopted, the financial account of the user is acquired, M financial records of the user in a preset time period are extracted according to the financial account, the M financial records are processed to obtain M financial behavior data, wherein M is a positive integer; a behavior identification model is acquired, the M financial behavior data are input into the behavior identification model, and a risk identification result is output, wherein the behavior identification model is obtained by training a radial basis network by using a financial data set, the financial data set comprises a plurality of historical financial behavior data and a plurality of historical risk identification results, and the risk identification result is used to indicate whether the financial account has a risk record; if the risk identification result indicates that the financial account has a risk record, a risk prompt information is generated, wherein the risk prompt information is used to prompt the user to have a risk behavior, and the technical problem of low identification accuracy in the related art when the user is identified to have a risk behavior is solved, the financial behavior data of the user in the preset time period are extracted according to the financial account, the financial behavior data are input into the behavior identification model, the risk identification result is output, whether the user has a risk behavior is determined according to the risk identification result, and the technical effects of reducing the false positive rate and the false negative rate of the financial records associated with the user and improving the identification efficiency and the accuracy are achieved. BRIEF DESCRIPTION OF DRAWINGS

[0020] The accompanying drawings, which form a part of the present application, are intended to provide further understanding of the present application, and are used to interpret the illustrative embodiments of the present application and their descriptions, and do not constitute improper limitations to the present application. In the drawings:

[0021] Figure 1 It is a hardware structure block diagram of a computer terminal (or a mobile device) for implementing the risk identification method;

[0022] Figure 2 It is a flowchart of the risk identification method according to the embodiments of the present application;

[0023] Figure 3 It is a schematic diagram of the optional risk identification method according to the embodiments of the present application;

[0024] Figure 4 It is a schematic diagram of the risk identification device according to the embodiments of the present application;

[0025] Figure 5 It is a structure block diagram of an electronic device according to the embodiments of the present application. DETAILED DESCRIPTION

[0026] In order to better understand the present application by those skilled in the art, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0027] It should be noted that the terms "first", "second" and the like in the description and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0028] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, analyzed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties. For example, an interface is provided between the system and the relevant user or institution. Before obtaining the relevant information, the interface needs to send a request to the aforementioned user or institution, and after receiving the consent information feedback from the aforementioned user or institution, the relevant information is obtained.

[0029] It should be noted that the information collected in the present application is information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with relevant laws, regulations and standards in relevant regions, necessary security measures are taken, do not violate public order and good custom, and provide corresponding operation portal for users to choose authorized use or refuse to use.

[0030] Embodiment 1

[0031] According to the embodiments of the present application, a method for identifying risks is also provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order from here.

[0032] The method provided by the embodiment one of the application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 is a hardware structure block diagram of a computer terminal (or a mobile device) for implementing a risk identification method, as shown in Figure 1 The computer terminal 10 (or a mobile device) can include one or more processors 102 (the processor 102 can include but is not limited to a microcontroller unit MCU or a programmable logic device FPGA and the like processing device), a memory 104 for storing data, and a transmission device 106 for communication function, as shown in Figure 1 In addition, a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which can be included as one of the ports in the bus), a network interface, a keyboard, a cursor control device, a power supply and / or a camera can also be included. Those skilled in the art can understand that Figure 1 The structure shown is only schematic, which does not limit the structure of the above-mentioned electronic device. For example, the computer terminal 10 can include more or less components than those shown in Figure 1 or have a different configuration from that shown in Figure 1 .

[0033] It should be noted that the one or more processors 102 and / or other data processing circuits described above can be generally referred to as "data processing circuits" herein. The data processing circuit can be embodied in whole or in part as software, hardware, firmware or any other combination. In addition, the data processing circuit can be a single independent processing module, or any one of the other elements combined into the computer terminal 10 (or a mobile device) in whole or in part. As referred to in the embodiments of the application, the data processing circuit serves as a processor control (for example, the selection of a variable resistance terminal path connected with the interface).

[0034] The memory 104 can be used to store software programs of application software and modules, such as program instructions / data storage devices corresponding to the risk identification method in the embodiments of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implements the risk identification method described above. The memory 104 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include a memory remotely arranged with respect to the processor 102, which can be connected to the computer terminal 10 through a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0035] The transmission device 106 is used to receive or send data via a network. Specific examples of the above-mentioned network can include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC) and a network interface, which can be connected to other network devices through a base station so as to be able to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.

[0036] The display can be, for example, a touch screen type liquid crystal display (Liquid Crystal Display, LCD), which can enable a user to interact with the user interface of the computer terminal 10 (or mobile device).

[0037] Under the above-mentioned operating environment, the present application provides a risk identification method as shown in Figure 2 Figure 2 is a flowchart of the risk identification method provided according to the embodiments of the present application, as shown in Figure 2

[0038] In step S201, a financial account of a user is obtained, M financial records of the user in a preset time period are extracted according to the financial account, and the M financial records are processed to obtain M financial behavior data, wherein M is a positive integer.

[0039] Specifically, the financial account refers to the account information of the user collected by the data system of the access financial institution. In order to capture the latest development of the transaction mode, a plurality of financial records in a preset time period can be obtained through the above-mentioned financial account, so as to accurately capture abnormal activities that may occur recently.

[0040] ​​Further, after obtaining the financial records, preprocessing can be performed to convert the original financial records into highly structured financial behavior data, thereby obtaining corresponding financial behavior data. The preprocessing method can be to delete data containing missing values, or to fill in missing data by mean, median, or interpolation method; to identify outliers by box plot and 3σ principle, and to delete or correct (such as truncation or replacement with boundary value) according to the scene; to perform one-hot encoding or numerical mapping; to reduce redundant features and reduce computational complexity by correlation analysis, principal component analysis, or the like.

[0041] It should be noted that the financial records can be determined by the following formula: where i and j represent different financial accounts, and when the financial records of the financial account i are needed, D i (t0) represents the existing account balance of the financial account i, and the amount of fund flow between the financial account i and the financial account j at time t is represents the sum of fund flow data between the financial account i and the financial account j from t0 to t, i∈{i0,i1,…,i n}=I, I represents a set of account numbers of transactions occurring within t-t0, j∈{j0,j1,…,j n}=J, J represents a set of account numbers of all transactions within t-t0.

[0042] In step S202, a behavior recognition model is obtained, and M financial behavior data are input into the behavior recognition model to output a risk recognition result, wherein the behavior recognition model is trained by a financial data set on a radial basis network, the financial data set includes a plurality of historical financial behavior data and a plurality of historical risk recognition results, and the risk recognition result is used to indicate whether a financial account has a risk record.

[0043] Specifically, the behavior recognition model refers to a radial basis function (RBF, Radial Basis Function) neural network model (hereinafter referred to as RBF neural network model) constructed by learning patterns and trends in historical financial data sets, which can identify abnormal or suspicious behavior in financial transactions. After obtaining a plurality of financial behavior data, these data can be input into the behavior recognition model. The RBF neural network model receives the financial behavior data, analyzes and judges the transaction behavior of each financial account through the patterns and rules learned inside, and finally outputs an identification result indicating whether there is a risk record, i.e., obtains a risk recognition result. The risk recognition result can be a binary classification output (such as "risk exists" or "no risk"), or a continuous risk score indicating the degree to which the transaction behavior of each financial account may involve abnormal transaction activities.

[0044] It should be noted that the training of the behavior recognition model is based on a financial data set containing a plurality of historical financial behavior data and corresponding historical risk identification results, and the financial data set is processed by a response time load balancing algorithm (RLB, Response Time Load Balancing), the historical financial behavior data represents the record of past transactions, covering various features of normal transactions and suspicious transactions, and the historical risk identification result is a label of whether the transaction is a risk behavior, which can be labeled by a financial institution or using other auxiliary models.

[0045] In step S203, if the risk identification result indicates that the financial account has a risk record, a risk prompt information is generated, wherein the risk prompt information is used to prompt the user that there is a risk behavior.

[0046] Specifically, after obtaining the risk identification result, first, it can be judged based on the result whether the current transaction data has a risk record, that is, whether the financial account has a risk record. If the model determines that the behavior pattern of certain financial behavior data is consistent with the risk behavior characteristics, the risk identification result indicates that the financial account has a risk record, and the risk prompt information needs to be generated to warn the user that the account may have a risk behavior, helping the user and the financial institution to understand which transaction is considered as a risk behavior.

[0047] The risk identification method provided by the embodiment of the present application comprises the following steps: obtaining a financial account of a user; extracting M financial records of the user in a preset time period according to the financial account; processing the M financial records to obtain M financial behavior data, wherein M is a positive integer; obtaining a behavior recognition model; inputting the M financial behavior data into the behavior recognition model to output a risk identification result, wherein the behavior recognition model is obtained by training a radial basis network based on a financial data set, the financial data set comprises a plurality of historical financial behavior data and a plurality of historical risk identification results, and the risk identification result is used to indicate whether the financial account has a risk record; and if the risk identification result indicates that the financial account has a risk record, generating a risk prompt information, wherein the risk prompt information is used to prompt the user that there is a risk behavior. The technical problem of low recognition accuracy in related art is solved by extracting the financial behavior data of the user in the preset time period according to the financial account, inputting the financial behavior data into the behavior recognition model, outputting the risk identification result, determining whether the user has a risk behavior according to the risk identification result, thereby reducing the false positive rate and the false negative rate of the financial records associated with the user, and improving the recognition efficiency and accuracy.

[0048] Optionally, in the risk identification method provided in the embodiments of the present application, the behavior identification model is obtained by training in the following manner: N financial accounts are obtained, and Y historical financial records of each financial account in a historical time period are obtained, to obtain N groups of historical financial records, wherein each financial account corresponds to a historical risk identification result, each historical financial record is associated with a financial category, and N and Y are positive integers; the financial category associated with each historical financial record is used to process the N groups of historical financial records to obtain N groups of historical financial behavior data, and the N groups of historical financial behavior data and the N historical risk identification results are combined to obtain a financial data set; a radial basis network is obtained, and the radial basis network is parameter adjusted using the financial data set to obtain the behavior identification model.

[0049] Specifically, in order to improve the identification accuracy, the behavior identification model needs to be trained. First, the historical financial records of each financial account in a historical time period can be obtained, wherein each historical financial record can include specific transaction information such as transaction amount, time, type, etc., and the financial category corresponding to each historical financial record is the classification of the transaction nature, such as regular consumption, salary payment, large amount transfer, etc. By associating each historical financial record with a financial category, it is helpful for the model to understand the characteristics of different types of transactions, and then to learn how to distinguish between normal behavior and potential risk activities.

[0050] Further, for each account (i.e., each group of historical financial records), first, key financial behavior features can be extracted according to its transaction type and financial category, such as transaction frequency, time interval, counterparty account features, distribution of transaction amount, etc. Unstructured transaction records are converted into structured historical financial behavior data, thereby greatly simplifying the complexity of the data and making it more suitable for the input requirements of machine learning models. Then the historical financial behavior data and the corresponding historical risk identification results are combined to obtain a financial data set.

[0051] Further, the RBF neural network model is trained using the financial data set constructed above to optimize its parameter configuration, that is, by adjusting the center point, width and output layer weight of the network, the model is better fitted to the features representing normal and suspicious transaction behavior in the data set.

[0052] The embodiments of the present application train the radial basis network using the financial data set, thereby constructing a neural network model capable of automatically identifying risk behaviors. By learning from historical data, the model not only captures known risk patterns, but also gradually adapts to new risk means, improving the accuracy and timeliness of identification, and being able to more effectively cope with dynamic changes in financial transactions.

[0053] Optionally, in the risk identification method provided in the embodiments of the present application, the M financial records are processed to obtain M financial behavior data, including: preprocessing the M financial records to obtain M initial processing records; obtaining the financial categories of the M initial processing records and the coding rules of each financial category, and performing numerical coding processing on the M initial processing records through the coding rules of each financial category to obtain M initial processing data; and performing feature conversion processing on the M initial processing data to obtain M financial behavior data, wherein the feature conversion processing at least includes feature dimension reduction processing and normalization processing.

[0054] Specifically, when processing the financial records obtained based on the financial accounts, firstly, the original financial transaction data can be preliminarily cleaned and arranged, for example, removing noise, filling missing values, correcting abnormal values, and ensuring that the data meets the requirements of subsequent processing, to obtain a plurality of initial processing records. Then, after determining the financial category to which each transaction record belongs and the coding rule of each financial category, the qualitative initial processing records can be converted into quantitative numerical representation by applying these coding rules, that is, the initial processing records are converted into numerical data, enhancing the machine readability of the data, wherein the coding rule can be One-Hot Encoding or Label Encoding, for example, using Label Encoding to convert the financial category into an integer form, or using One-Hot Encoding to convert the category into a multi-dimensional binary vector.

[0055] Further, the initial processing data is processed by principal component analysis or other methods, that is, feature dimension reduction and normalization are performed on the initial processing data, so as to reduce the data dimension, remove redundant features, reduce the model complexity, and improve the training efficiency. Then, the data after feature conversion is normalized, for example, by Z-Score standardization or Min-Max normalization, the data is scaled to a specific range, the dimension influence is eliminated, the model is not skewed when processing due to different dimensions of features, and the generalization ability of the model is enhanced, wherein the Z-Score standardization method can be calculated by the following formula: wherein μ is the mean of the data sample, and σ is the standard deviation; and the Min-Max normalization is:

[0056] The embodiments convert the original financial records into structured and standardized financial behavior data through preprocessing, numerical coding and feature conversion, optimize the structure of the data, make the data more suitable for neural network analysis, greatly improve the quality of the data and the training efficiency of the model, and thus construct an efficient and accurate anti-risk behavior identification model.

[0057] Optionally, in the risk identification method provided in the embodiments of the present application, the radial basis network includes a hidden layer and an output layer, and the radial basis network is parameter adjusted by using a financial data set to obtain a behavior identification model, which includes: extracting P historical financial behavior data from the financial data set by the hidden layer using a clustering algorithm, and determining each historical financial behavior data as a clustering center to obtain P initial clustering centers, wherein P is a positive integer; determining a cluster according to each initial clustering center to obtain P clusters, and determining the clustering center of each cluster as a basis function center of the hidden layer to obtain P basis function centers; determining a radial basis width of the radial basis network according to the P basis function centers to obtain a radial basis width value; processing N sets of historical financial behavior data by the output layer to output N preset result parameters, and determining the weight of the output layer according to the radial basis width value, the N preset result parameters and N historical risk identification results, wherein each preset result parameter refers to a numerical representation of each preset risk identification result output by the output layer; and constructing the behavior identification model by the P basis function centers and the weight of the output layer.

[0058] Specifically, when training the neural network composed of radial basis functions (i.e., radial basis network) by using a financial data set, since the radial basis network is composed of a hidden layer and an output layer, the hidden layer is responsible for mapping the input data to a high-dimensional space of multiple nonlinear basis functions, and the output layer performs weighted summation according to the output of the hidden layer to predict the risk level of the transaction behavior. The learning algorithm phase of the radial basis network needs to determine the hidden layer parameters (basis function center, radial basis width value) and the output layer weight (i.e., the weight of the output layer) in steps. First, the hidden layer can extract multiple historical financial behavior data from the financial data set by using a clustering algorithm, and determine each historical financial behavior data as a clustering center to obtain multiple initial clustering centers. These historical financial behavior data can be selected from the financial data set by applying a clustering algorithm (such as K-means (K-Means Clustering Algorithm) algorithm), and can represent multiple typical transaction patterns in the data space. By determining these clustering centers as the basis function centers of the hidden layer in the RBF neural network model, the model constructs its decision boundary around these center points, and further enables the model to identify and distinguish key patterns in the data set, especially those transaction features related to risk.

[0059] Further, the radial basis width refers to the "influence range" around each basis function center, which determines how the model distinguishes data close to different center points. Each initial cluster center can be determined by the above method, and the cluster center of each cluster is determined as the basis function center of the hidden layer. Then, the radial basis width of the radial basis network is determined according to the basis function center, and the radial basis width value is obtained. That is, the determination of the radial basis width value can be based on the distance between the basis function centers, to ensure that each basis function can appropriately cover the spatial range of the transaction pattern it represents, while avoiding overfitting or underfitting.

[0060] Then, the output layer generates a plurality of preset result parameters by calculating each set of input historical financial behavior data and the hidden layer basis function center, and determines the weight of the output layer according to the radial basis width value, each preset result parameter and each historical risk identification result. The preset result parameter is a numerical representation of the risk score or classification label expected to be output by the output layer. By minimizing the difference between the preset result parameter and the historical risk identification result (such as using the RLB algorithm), the weight of the output layer can be adjusted to optimize the prediction accuracy of the model. Finally, the calculated basis function center and the weight of the output layer are integrated into the RBF neural network model, making it a model that can automatically identify and classify financial transaction risks. The behavior recognition model not only can handle non-linear data relationships, but also has strong generalization ability and can make accurate risk assessments on unseen data.

[0061] The embodiment adjusts the parameters of the radial basis network, so that the behavior recognition model constructed by the radial basis network can accurately capture complex behavior patterns in financial transactions, ensuring that the model can distinguish different types of transaction behavior and automatically adjust its decision strategy according to the training data, reducing the false positive rate and improving the accuracy of suspicious transaction identification, providing strong technical support for the work of financial institutions.

[0062] Optionally, in the risk identification method provided in the embodiments of the present application, the P clusters are obtained by calculating the Euclidean distance of each historical financial behavior data other than the P historical financial behavior data to each initial clustering center, and distributing the P historical financial behavior data other than the P historical financial behavior data to the cluster corresponding to each initial clustering center according to each Euclidean distance, to obtain P initial clusters; the mean value of each initial cluster is calculated to obtain P cluster mean values, and the clustering center of each initial cluster is updated according to each cluster mean value to obtain P updated clustering centers; P updated clusters are generated based on the P updated clustering centers, and it is determined whether the P updated clusters satisfy a convergence condition, wherein the convergence condition at least includes one of the following: a preset iteration number is reached, data is stopped from being distributed to each cluster, and the moving distance of the clustering center of each cluster is less than a preset threshold; in the case that the P updated clusters do not satisfy the convergence condition, the P updated clusters are iterated until P iterated clusters satisfy the convergence condition, and the P iterated clusters are determined as the P clusters.

[0063] Specifically, before determining the basis function centers of the hidden layer based on the initial clustering centers, a plurality of clusters need to be determined. First, the Euclidean distance of each historical financial behavior data other than the P historical financial behavior data to each initial clustering center is calculated, that is, the Euclidean distance of all other financial behavior data samples in the remaining training data set to the selected initial clustering centers is calculated, so as to measure the similarity or distance between each sample data and each initial clustering center. After calculating the Euclidean distance between all data and each initial clustering center, these historical financial behavior data can be distributed to the cluster corresponding to each initial clustering center according to each Euclidean distance, that is, according to the minimum distance principle, each historical financial behavior data is distributed to the cluster where the nearest clustering center is located, to form a plurality of initial clusters.

[0064] Further, the mean value of all data points in each cluster is calculated to update the position of the clustering center, that is, the clustering center of each initial cluster is updated according to the mean value of each cluster to obtain a plurality of updated clustering centers, so as to more accurately reflect the center point of the sample data in the cluster, which is helpful for the optimization of the clustering center, so that it can better capture the characteristics of the data in the cluster, thereby improving the accuracy and efficiency of data distribution in the subsequent clustering process. Then, each updated cluster is generated based on each updated clustering center, that is, all data points are re-clustered and distributed using the updated clustering center to form a new cluster, wherein the updated clustering center can be calculated by the following formula: wherein S k is the sample set of the kth cluster.

[0065] Further, by constantly adjusting the cluster centers and reassigning the data points, and judging whether each update process meets the convergence condition, for example, if the number of iterations of the algorithm reaches the preset maximum value, it indicates that the convergence condition is met; in a certain iteration, the situation of data points being assigned to each cluster no longer changes, and the data points have been stably classified into the most suitable cluster, which indicates that the convergence condition is met; if the moving distance of the cluster center is less than a set threshold, it means that the change of the center position is very small, which can be considered as convergence. After any one of the above convergence conditions is met, the iteration process can be ended, and then the stable cluster is obtained.

[0066] The embodiment reduces the differences between the data points in the cluster by constantly optimizing the positions of the cluster centers until they can stably represent the respective clusters, and maximizes the differences between different clusters, realizes dynamic and accurate positioning of the cluster centers through the K-means algorithm, improves the recognition ability and generalization performance of the model, so that the optimized center points can more accurately map complex transaction patterns and abnormal behaviors, thereby more effectively detecting potential risk activities in the model reasoning stage. Not only does the embodiment systematically improve the training efficiency of the RBF neural network model, but also enhances the learning ability of the model for low-frequency high-risk events. The model can better adapt to the nonlinear characteristics and dynamic changes of the financial transaction data, and finally achieves the purpose of reducing the false positive rate and improving the detection accuracy.

[0067] Optionally, in the risk identification method provided in the embodiment of the application, the radial basis width of the radial basis network is determined according to the P basis function centers, and the radial basis width value is obtained by: obtaining the first basis function center and the second basis function center from the two farthest basis function centers in the P basis function centers; calculating the difference between the first basis function center and the second basis function center to obtain a center distance, and calculating the ratio of the center distance to P to obtain the radial basis width value.

[0068] Specifically, when calculating the radial basis width value, since the hidden layer is composed of multiple basis functions, each basis function has a center point for measuring the distance between the input data and the center point. At this time, first, the two farthest points can be found from all selected basis function center points to obtain the first basis function center and the second basis function center. Then, the difference between the first basis function center and the second basis function center is calculated to obtain a center distance d max . Then, the radial basis function value is calculated by the following formula: wherein M is the total number of selected basis function centers. It should be noted that the radial basis width value can affect the shape of the basis function and the fitting ability of the data, and the size of the width value is related to the interaction range between data points, a larger width means a wider scope of the basis function, and a smaller width means a more concentrated range of influence. By calculating the width value, each basis function can cover a certain range of data while avoiding overfitting or underfitting, providing a good balance point for effective classification of data.

[0069] The embodiment calculates the distance between the basis function centers and determines the appropriate radial basis width value in combination with the center number, so that the model can maintain a low computational complexity while maintaining high classification accuracy and robustness, effectively capturing subtle changes and patterns in transaction data, and improving the generalization ability of the model in practical applications.

[0070] Optionally, in the risk identification method provided by the embodiment of the application, the N sets of historical financial behavior data are processed by the output layer to output N preset result parameters, and the weight value of the output layer is determined according to the radial basis width value, the N preset result parameters and N historical risk identification results, comprising: for a financial account, the output layer recursively processes a set of historical financial behavior data corresponding to the financial account and the radial basis width to obtain an output vector; the initial weight value of the output layer is obtained, and the product of the output vector and the initial weight value is calculated to obtain a preset result parameter of the financial account; the numerical representation corresponding to the historical risk identification result of each financial account is obtained to obtain N historical result parameters, and it is judged whether there is an error between the preset result parameter corresponding to each financial account and the corresponding historical result parameter; if there is an error between the preset result parameter and the historical result parameter of T financial accounts in the N financial accounts, an error variance matrix is constructed according to the preset result parameter and the historical result parameter of the T financial accounts, wherein T is a positive integer; a smoothing factor is obtained, and a forgetting factor is calculated based on the smoothing factor, and the initial weight value is updated using the error variance matrix and the forgetting factor to obtain the weight value of the output layer.

[0071] Specifically, when training the weight value of the output layer, the input financial behavior data is first calculated by the output layer multiple times to obtain an output vector representing the risk assessment of the account transaction, which can be obtained by the following formula: wherein σ is the radial basis function value, l l (k) represents the input financial behavior data, is expressed as the l-th basis function. The calculation of the output vector is based on the basis function center and width parameters of the hidden layer, by calculating the distance between the input data and the center point, and then adjusting its weight contribution in the output layer according to the similarity measure of the Gaussian function. Then the output vector is used to calculate the prediction result of the output layer, that is, the preset result parameter, which can be calculated by the following formula: where w j represents the initial weight of the output layer, and the preset result parameter is the predicted risk value calculated by the model according to the initial weight and the input data, which can reflect the preliminary judgment of the model on the financial account transaction behavior

[0072] Further, the actual output is Then the error is That is, after obtaining the numerical representation of the actual historical risk identification result corresponding to each financial account, that is, obtaining the corresponding historical result parameter, it is judged whether there is an error between each preset result parameter and the corresponding historical result parameter. If there is an error between the preset result parameters and the historical result parameters of the T financial accounts, an error variance matrix can be constructed according to the preset result parameters and the historical result parameters of the T financial accounts, and then a forgetting factor λ(k) is calculated according to the smoothing factor τ0: where λ(k)(0<λ(k)<1), the smoothing factor is used to adjust the sensitivity of the model to new data, and the forgetting factor controls the memory degree of the model to old data, gradually reduces the influence of old data in weight adjustment, and ensures that the model can better adapt to the changes of the current financial environment and risk means. Through the joint use of the error variance matrix and the forgetting factor, the model can dynamically adjust the weight of the output layer, enhance the identification ability of the financial account transaction risk, reduce false positives and false negatives, and improve the overall monitoring effect, that is, the initial weight is updated by the error variance matrix and the forgetting factor through the following formula to obtain the weight of the output layer:

[0073]

[0074] The embodiment recursively processes historical financial behavior data, compares preset result parameters with historical risk identification results, constructs an error variance matrix, and dynamically adjusts the weight of the output layer, thereby continuously optimizing the identification accuracy of the neural network model, so that the model can learn and adapt to the complex and changeable financial environment in a more intelligent and flexible way, significantly improve the monitoring efficiency, and reduce the cost.

[0075] The embodiment of the present application also provides a risk identification method, Figure 3 is a schematic diagram of an optional risk identification method according to the embodiment of the present application, as Figure 3 shown, the method comprises:

[0076] Firstly, all the financial transaction records associated with risky behavior in the past year are extracted from the trading system, as well as normal transaction data, forming a large database containing tens of millions of records. Then the original transaction data collected is preprocessed, including missing value filling, outlier detection and correction. For example, the missing transaction amount data is filled using the median, and the abnormal records in the transaction time are identified and corrected through the box plot.

[0077] Further, qualitative attributes such as transaction type and account nature are numerically encoded, such as using one-hot encoding to convert transaction type into a numerical vector. At the same time, through correlation analysis, redundant features are removed to reduce data dimension, such as identifying and deleting transaction frequency features highly correlated with transaction amount. At the same time, the Z-Score standardization method is used to eliminate the dimension difference of the feature quantity, so that the weight of each feature in the RBF neural network model is equal, avoiding the biasing influence of high numerical features on model training.

[0078] Further, the RBF network structure is set up and the learning algorithm is constructed, that is, a clustering algorithm is used to select multiple representative samples as initial cluster centers from the standardized training data set. After selecting the initial cluster centers, the average distance between these centers is calculated and scaled to obtain the radial basis width value. Then the initial weight of the output layer is trained using the RLB algorithm, that is, the data is processed using the recursive least squares method, and then the output layer obtains the preset result parameters according to the processed data, which are compared with the historical risk identification results to judge the error. According to the error result, an error variance matrix is constructed, and the initial weight is iteratively updated through a dynamically adjusted forgetting factor until the model converges, obtaining the optimal output layer weight, and then obtaining the trained RBF neural network model.

[0079] After obtaining the above neural network model, the RBF neural network model can be used for reasoning. First, the real-time received financial transaction data is preprocessed in the same way as in the parameter preprocessing stage, including cleaning, encoding and standardization, to ensure that the input data format is consistent with the model training. The preprocessed real-time transaction data is sent to the trained RBF neural network model, and the model evaluates the risk of each transaction based on the basis function center and radial basis width value of the hidden layer, as well as the optimal weight of the output layer. According to the risk identification result output by the model, suspicious transaction behavior is identified. For transaction records marked as suspicious, an alarm can be produced and the transaction can be terminated. For transaction records marked as not suspicious, normal transaction can continue.

[0080] It should be noted that the transaction records marked as suspicious are used for subsequent model training, that is, the newly collected transaction data is preprocessed and feature converted, and used as case data for continuous training of the model, and the RBF neural network model is continuously optimized through parameter learning.

[0081] The embodiment can improve the identification accuracy of risk behaviors and reduce the false positive rate by periodic model optimization and case learning. Due to the efficient computing characteristics, the RBF neural network model can realize real-time monitoring and provide instant response to high-frequency trading, abnormal fund flow and other scenarios.

[0082] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here.

[0083] Embodiment 2

[0084] The embodiment of the present application also provides a risk identification device. It should be noted that the risk identification device of the embodiment of the present application can be used to execute the risk identification method provided by the embodiment of the present application. The risk identification device provided by the embodiment of the present application is introduced as follows.

[0085] According to the embodiment of the present application, a device for implementing the risk identification method is also provided, Figure 4 is a schematic diagram of the risk identification device provided by the embodiment of the present application, as Figure 4 shown, the device comprises a first acquisition unit 40, a second acquisition unit 41 and a generation unit 42.

[0086] The first acquisition unit 40 is configured to acquire a financial account of a user, extract M financial records of the user in a preset time period according to the financial account, process the M financial records, and obtain M financial behavior data, wherein M is a positive integer.

[0087] The second acquisition unit 41 is configured to acquire a behavior identification model, input the M financial behavior data into the behavior identification model, and output a risk identification result, wherein the behavior identification model is trained by a radial basis network according to a financial data set, the financial data set comprises a plurality of historical financial behavior data and a plurality of historical risk identification results, and the risk identification result is used to indicate whether the financial account has a risk record.

[0088] The generation unit 42 is configured to generate a risk prompt information if the risk identification result indicates that the financial account has a risk record, wherein the risk prompt information is used to prompt the user to have a risk behavior.

[0089] The risk identification device provided in the embodiments of the present application comprises a first obtaining unit 40 configured to obtain a financial account of a user, extract M financial records of the user in a preset time period according to the financial account, process the M financial records, and obtain M financial behavior data, wherein M is a positive integer; a second obtaining unit 41 configured to obtain a behavior identification model, input the M financial behavior data into the behavior identification model, and output a risk identification result, wherein the behavior identification model is obtained by training a radial basis network by using a financial data set, the financial data set comprises a plurality of historical financial behavior data and a plurality of historical risk identification results, and the risk identification result is used to indicate whether the financial account has a risk record; and a generating unit 42 configured to generate a risk prompt information if the risk identification result indicates that the financial account has a risk record, wherein the risk prompt information is used to prompt the user to have a risk behavior. The technical problem of low identification accuracy in the related art is solved, the financial behavior data of the user in the preset time period is extracted according to the financial account, the financial behavior data is input into the behavior identification model, the risk identification result is output, it is determined whether the user has a risk behavior according to the risk identification result, and the technical effects of reducing the false positive rate and the false negative rate of the financial records associated with the user and improving the identification efficiency and the accuracy are achieved.

[0090] Optionally, in the risk identification device provided in the embodiments of the present application, the second obtaining unit 41 comprises: a first obtaining module configured to obtain N financial accounts and obtain Y historical financial records of each financial account in a historical time period, to obtain N groups of historical financial records, wherein each financial account corresponds to a historical risk identification result, each historical financial record is associated with a financial category, and N and Y are positive integers; a first processing module configured to process N groups of historical financial records according to the financial category associated with each historical financial record, to obtain N groups of historical financial behavior data, and combine the N groups of historical financial behavior data and N historical risk identification results to obtain a financial data set; and a second obtaining module configured to obtain a radial basis network, and adjust parameters of the radial basis network by using the financial data set to obtain a behavior identification model.

[0091] Optionally, in the risk identification device provided in the embodiments of the present application, the first obtaining unit 40 comprises: a second processing module configured to pre-process the M financial records to obtain M initial processing records; a third obtaining module configured to obtain a financial category of the M initial processing records and an encoding rule of each financial category, perform numerical encoding processing on the M initial processing records by using the encoding rule of each financial category to obtain M initial processing data; and a third processing module configured to perform feature conversion processing on the M initial processing data to obtain the M financial behavior data, wherein the feature conversion processing at least comprises feature dimension reduction processing and normalization processing.

[0092] Optionally, in the risk identification device provided by the embodiment of the present application, the second acquisition unit 41 comprises: an extraction module, configured to extract P pieces of historical financial behavior data from the financial data set by the hidden layer using a clustering algorithm, and determine each piece of historical financial behavior data as a clustering center to obtain P initial clustering centers, wherein P is a positive integer; a first determination module, configured to determine a cluster according to each initial clustering center to obtain P clusters, and determine the clustering center of each cluster as a basis function center of the hidden layer to obtain P basis function centers; a second determination module, configured to determine a radial basis width of the radial basis network according to the P basis function centers to obtain a radial basis width value; a fourth processing module, configured to process N groups of historical financial behavior data by the output layer to output N preset result parameters, and determine the weight of the output layer according to the radial basis width value, the N preset result parameters and N historical risk identification results, wherein each preset result parameter refers to a numerical representation of each preset risk identification result output by the output layer; and a first construction module, configured to construct the behavior identification model by the P basis function centers and the weight of the output layer.

[0093] Optionally, in the risk identification device provided by the embodiment of the present application, the second acquisition unit 41 comprises: a first calculation module, configured to calculate the Euclidean distance from the historical financial behavior data other than the P pieces of historical financial behavior data to each initial clustering center respectively, and allocate the historical financial behavior data other than the P pieces of historical financial behavior data to the clusters corresponding to the P initial clustering centers according to each Euclidean distance to obtain P initial clusters; a second calculation module, configured to calculate the mean value of each initial cluster to obtain P cluster mean values, and update the clustering center of each initial cluster according to each cluster mean value to obtain P updated clustering centers; a generation module, configured to generate P updated clusters based on the P updated clustering centers, and determine whether the P updated clusters satisfy a convergence condition, wherein the convergence condition at least comprises one of the following: reaching a preset iteration number, stopping data allocation to each cluster and the moving distance of the clustering center of each cluster being less than a preset threshold; and an iteration module, configured to iterate the P updated clusters until the P iterated clusters satisfy the convergence condition in the case that the P updated clusters do not satisfy the convergence condition, and determine the P iterated clusters as the P clusters.

[0094] Optionally, in the risk identification device provided by the embodiment of the present application, the second acquisition unit 41 comprises: a fourth acquisition module, configured to acquire two basis function centers farthest from each other from the P basis function centers to obtain a first basis function center and a second basis function center; and a third calculation module, configured to calculate the difference between the first basis function center and the second basis function center to obtain a center distance, and calculate the ratio of the center distance to P to obtain the radial basis width value.

[0095] Optionally, in the risk identification apparatus provided by the embodiment of the present application, the second acquisition unit 41 comprises: a fifth processing module, configured to, for a financial account, perform recursive processing on a set of historical financial behavior data corresponding to the financial account and the radial basis width by the output layer to obtain an output vector; a fifth acquisition module, configured to acquire an initial weight value of the output layer, and calculate a product of the output vector and the initial weight value to obtain a preset result parameter of the financial account; a sixth acquisition module, configured to acquire a numerical representation corresponding to a historical risk identification result corresponding to each financial account to obtain N historical result parameters, and determine whether there is an error between the preset result parameter corresponding to each financial account and the corresponding historical result parameter; a second construction module, configured to, if there is an error between the preset result parameter and the historical result parameter of T financial accounts in the N financial accounts, construct an error variance matrix according to the preset result parameter and the historical result parameter of the T financial accounts, wherein T is a positive integer; a seventh acquisition module, configured to acquire a smoothing factor, calculate a forgetting factor based on the smoothing factor, and update the initial weight value by using the error variance matrix and the forgetting factor to obtain the weight value of the output layer.

[0096] It should be noted that the first acquisition unit 40, the second acquisition unit 41 and the generation unit 42 correspond to steps S201 to S203 in Embodiment 1, and have the same instances and application scenarios as those realized by the corresponding steps, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware components or software components stored in the memory (for example, the memory 104) and processed by one or more processors (for example, the processors 102a, 102b, …, 102n), and the above units can also be run in the computer terminal 10 provided in Embodiment 1 as a part of the apparatus.

[0097] Embodiment 3

[0098] The embodiment of the present application can provide a computer terminal, which can be any one of the computer terminal devices in the computer terminal group. Optionally, in the embodiment, the above computer terminal can also be replaced by a mobile terminal or an electronic device or the like terminal device.

[0099] Optionally, in the embodiment, the above computer terminal can be located in at least one of the network devices in the computer network.

[0100] In the embodiment, the computer terminal can execute program codes of the following steps in the risk identification method: obtaining a financial account of a user, extracting M financial records of the user in a preset time period according to the financial account, processing the M financial records to obtain M financial behavior data, wherein M is a positive integer; obtaining a behavior identification model, inputting the M financial behavior data into the behavior identification model, and outputting a risk identification result, wherein the behavior identification model is obtained by training a radial basis network by using a financial data set, the financial data set includes a plurality of historical financial behavior data and a plurality of historical risk identification results, and the risk identification result is used to indicate whether the financial account has a risk record; and if the risk identification result indicates that the financial account has a risk record, generating a risk prompt information, wherein the risk prompt information is used to prompt the user to have a risk behavior.

[0101] Optionally, the computer terminal can execute program codes of the following steps in the risk identification method: obtaining N financial accounts and obtaining Y historical financial records of each financial account in a historical time period to obtain N groups of historical financial records, wherein each financial account corresponds to a historical risk identification result, each historical financial record is associated with a financial category, and N and Y are positive integers; processing the N groups of historical financial records according to the financial category associated with each historical financial record to obtain N groups of historical financial behavior data, and combining the N groups of historical financial behavior data and the N historical risk identification results to obtain a financial data set; obtaining a radial basis network, and adjusting parameters of the radial basis network by using the financial data set to obtain a behavior identification model.

[0102] Optionally, the computer terminal can execute program codes of the following steps in the risk identification method: preprocessing M financial records to obtain M initial processing records; obtaining a financial category of the M initial processing records and an encoding rule of each financial category, performing numerical encoding processing on the M initial processing records by using the encoding rule of each financial category to obtain M initial processing data; and performing feature conversion processing on the M initial processing data to obtain M financial behavior data, wherein the feature conversion processing at least includes feature dimension reduction processing and normalization processing.

[0103] Optionally, the computer terminal can execute program codes of the following steps in the risk identification method: extracting P pieces of historical financial behavior data from the financial data set by the hidden layer using a clustering algorithm, and determining each piece of historical financial behavior data as a clustering center to obtain P initial clustering centers, wherein P is a positive integer; determining a cluster according to each initial clustering center to obtain P clusters, and determining the clustering center of each cluster as a basis function center of the hidden layer to obtain P basis function centers; determining a radial basis width of the radial basis network according to the P basis function centers to obtain a radial basis width value; processing N groups of historical financial behavior data by the output layer to output N preset result parameters, and determining a weight value of the output layer according to the radial basis width value, the N preset result parameters and N historical risk identification results, wherein each preset result parameter refers to a numerical representation of each preset risk identification result output by the output layer; and constructing a behavior identification model through the P basis function centers and the weight value of the output layer.

[0104] Optionally, the computer terminal can execute program codes of the following steps in the risk identification method: calculating the Euclidean distance of historical financial behavior data other than the P pieces of historical financial behavior data to each initial clustering center respectively, and distributing the historical financial behavior data other than the P pieces of historical financial behavior data to the clusters corresponding to the P initial clustering centers according to each Euclidean distance to obtain P initial clusters; calculating the mean value of each initial cluster to obtain P cluster mean values, and updating the clustering center of each initial cluster according to each cluster mean value to obtain P updated clustering centers; generating P updated clusters based on the P updated clustering centers, and determining whether the P updated clusters satisfy a convergence condition, wherein the convergence condition at least includes one of the following: reaching a preset iteration number, stopping data distribution to each cluster, and the moving distance of the clustering center of each cluster being less than a preset threshold; in the case that the P updated clusters do not satisfy the convergence condition, iterating the P updated clusters until the P iterated clusters satisfy the convergence condition, and determining the P iterated clusters as the P clusters.

[0105] Optionally, the computer terminal can execute program codes of the following steps in the risk identification method: obtaining two basis function centers farthest from each other from the P basis function centers to obtain a first basis function center and a second basis function center; calculating the difference value of the first basis function center and the second basis function center to obtain a center distance, and calculating the ratio of the center distance to P to obtain a radial basis width value.

[0106] Optionally, the computer terminal may execute the program code of the following steps in the risk identification method: for a financial account, the output layer recursively processes a set of historical financial behavior data and radial basis width corresponding to the financial account to obtain an output vector; obtains initial weights of the output layer, calculates the product of the output vector and the initial weights, and obtains preset result parameters of the financial account; obtains a numerical representation corresponding to the historical risk identification results corresponding to each financial account to obtain N historical result parameters, and determines whether there is an error between the preset result parameters and the corresponding historical result parameters corresponding to each financial account; if there is an error between the preset result parameters and the historical result parameters of T financial accounts among the N financial accounts, constructs an error variance matrix based on the preset result parameters and the historical result parameters of the T financial accounts, where T is a positive integer; obtains a smoothing factor, calculates a forgetting factor based on the smoothing factor, and uses the error variance matrix and the forgetting factor to update the initial weights to obtain weights of the output layer.

[0107] Optionally, Figure 5 This is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 Only one is shown) processor 502, memory 504, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0108] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the risk identification method and device in the embodiments of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned risk identification method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely located relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0109] The processor may call the information and application programs stored in the memory through the transmission device to execute the above steps in the above risk identification method.

[0110] The embodiment of the application provides a risk identification scheme. The financial account of a user is acquired, M financial records of the user in a preset time period are extracted according to the financial account, the M financial records are processed, and M financial behavior data are obtained, wherein M is a positive integer; a behavior identification model is acquired, the M financial behavior data are input into the behavior identification model, and a risk identification result is output, wherein the behavior identification model is obtained by training a radial basis network by using a financial data set, the financial data set includes a plurality of historical financial behavior data and a plurality of historical risk identification results, and the risk identification result is used for indicating whether the financial account has a risk record; if the risk identification result indicates that the financial account has a risk record, risk prompt information is generated, wherein the risk prompt information is used for prompting that the user has a risk behavior, the technical problem of low identification accuracy in the related art is solved, the financial behavior data of the user in the preset time period are extracted according to the financial account, the financial behavior data are input into the behavior identification model, the risk identification result is output, whether the user has a risk behavior is determined according to the risk identification result, and therefore the technical effects of reducing the false positive rate and the false negative rate of the financial record associated with the user are achieved, and the identification efficiency and the accuracy are improved.

[0111] Those skilled in the art can understand that Figure 5 The structure shown is only schematic, and the electronic device can also be a smart phone, a tablet computer, a palm computer, a Mobile Internet Device (MID), a PAD, or the like. Figure 5 It does not limit the structure of the electronic device. For example, the electronic device can include more or fewer components (such as a network interface, a display device, etc.) than those shown in the figure, or have a different configuration from that shown in the figure. Figure 5 It does not limit the structure of the electronic device. For example, the electronic device can include more or fewer components (such as a network interface, a display device, etc.) than those shown in the figure, or have a different configuration from that shown in the figure. Figure 5 It does not limit the structure of the electronic device. For example, the electronic device can include more or fewer components (such as a network interface, a display device, etc.) than those shown in the figure, or have a different configuration from that shown in the figure.

[0112] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by programs instructing the related hardware of the terminal device, and the programs can be stored in a computer readable storage medium, which can include a flash disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, etc.

[0113] Embodiment 4

[0114] The embodiment of the application further provides a storage medium. Optionally, in the embodiment, the storage medium can be used to save the program code executed by the risk identification method provided in the embodiment one.

[0115] Optionally, in the embodiment, the storage medium can be located in any one of the computer terminals in the computer terminal group in the computer network, or in any one of the mobile terminals in the mobile terminal group.

[0116] Optionally, in the embodiment, the storage medium is configured to store program code for performing the following steps: obtaining a financial account of a user, extracting M financial records of the user in a preset time period according to the financial account, processing the M financial records to obtain M financial behavior data, wherein M is a positive integer; obtaining a behavior recognition model, inputting the M financial behavior data into the behavior recognition model, and outputting a risk recognition result, wherein the behavior recognition model is trained by a financial data set on a radial basis network, the financial data set includes a plurality of historical financial behavior data and a plurality of historical risk recognition results, and the risk recognition result is used to indicate whether the financial account has a risk record; and if the risk recognition result indicates that the financial account has a risk record, generating a risk prompt information, wherein the risk prompt information is used to prompt the user to have a risk behavior.

[0117] The application further provides a computer program product, which, when executed on a data processing device, is adapted to perform the steps of the risk identification method.

[0118] The above-mentioned sequence numbers of the embodiments of the application are only for description, and do not represent advantages or disadvantages of the embodiments.

[0119] In the above-mentioned embodiments of the application, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0120] In the several embodiments of the application, it should be understood that the disclosed technology can be implemented in other ways. Of course, the above-mentioned device embodiments are only schematic. For example, the division of the units is only a logical function division, and there can be another division manner in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between the units can be indirect couplings or communication connections through some interfaces, and can be electrical or other forms.

[0121] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they can be located in one place, or distributed on a plurality of network units. According to actual needs, some or all of the units can be selected to achieve the purpose of the embodiment.

[0122] In addition, each function unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software function unit.

[0123] When the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application, essentially or in the form of a contribution to the prior art, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in each embodiment of the present application. The foregoing storage medium includes various media that can store program codes, such as a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, etc.

[0124] The above is only the preferred embodiment of the present application, and it should be pointed out that, for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. A risk identification method, characterized in that: include: Obtaining a financial account of a user, extracting M financial records of the user within a preset time period based on the financial account, processing the M financial records to obtain M financial behavior data, where M is a positive integer; Obtaining a behavior recognition model, inputting the M financial behavior data into the behavior recognition model, and outputting a risk identification result, wherein the behavior recognition model is obtained by training a radial basis function network using a financial dataset, the financial dataset including a plurality of historical financial behavior data and a plurality of historical risk identification results, the risk identification result being used to indicate whether the financial account has a risk record; If the risk identification result indicates that the financial account has a risk record, risk warning information is generated, wherein the risk warning information is used to remind the user that risky behavior has occurred.

2. The method according to claim 1, characterized in that The behavior recognition model is trained in the following way: Obtain N financial accounts and obtain Y historical financial records for each financial account in a historical time period to obtain N groups of historical financial records, where each financial account corresponds to a historical risk identification result, and each historical financial record is associated with a financial category, and N and Y are positive integers; Processing the N groups of historical financial records according to the financial category associated with each historical financial record to obtain N groups of historical financial behavior data, and combining the N groups of historical financial behavior data with N historical risk identification results to obtain the financial data set; A radial basis function network is obtained, and parameters of the radial basis function network are adjusted using the financial data set to obtain the behavior recognition model.

3. The method according to claim 1, characterized in that The M financial records are processed to obtain M financial behavior data including: Preprocessing the M financial records to obtain M initial processing records; Obtaining the financial categories of the M initial processing records and the coding rules for each financial category, and performing numerical coding processing on the M initial processing records according to the coding rules for each financial category to obtain M initial processing data; Perform feature conversion processing on the M initially processed data to obtain the M financial behavior data, wherein the feature conversion processing at least includes: feature dimensionality reduction processing and normalization processing.

4. The method according to claim 2, characterized in that The radial basis function network includes a hidden layer and an output layer. The parameters of the radial basis function network are adjusted using the financial data set to obtain the behavior recognition model, which includes: The hidden layer extracts P historical financial behavior data from the financial data set using a clustering algorithm, and determines each historical financial behavior data as a cluster center to obtain P initial cluster centers, where P is a positive integer; Determine a cluster according to each initial cluster center to obtain P clusters, and determine the cluster center of each cluster as the basis function center of the hidden layer to obtain P basis function centers; Determine the radial basis width of the radial basis network according to the P basis function centers to obtain a radial basis width value; The output layer processes the N sets of historical financial behavior data, outputs N preset result parameters, and determines a weight of the output layer based on the radial basis width value, the N preset result parameters, and the N historical risk identification results, wherein each preset result parameter refers to a numerical representation corresponding to each preset risk identification result output by the output layer; The behavior recognition model is constructed by constructing the P basis function centers and the weights of the output layer.

5. The method according to claim 4, characterized in that According to each initial cluster center, clusters are determined, and P clusters are obtained, including: Calculating the Euclidean distances of the historical financial behavior data other than the P historical financial behavior data to each initial cluster center, and assigning the historical financial behavior data other than the P historical financial behavior data to clusters corresponding to the P initial cluster centers according to each Euclidean distance, to obtain P initial clusters; Calculate the mean of each initial cluster to obtain P cluster means, and update the cluster center of each initial cluster according to each cluster mean to obtain P updated cluster centers; generating P updated clusters based on the P updated cluster centers, and determining whether the P updated clusters meet a convergence condition, wherein the convergence condition includes at least one of: reaching a preset number of iterations, stopping allocating data to each cluster, and a moving distance of the cluster center of each cluster being less than a preset threshold; If the P updated clusters do not satisfy the convergence condition, the P updated clusters are iterated until the P iterated clusters satisfy the convergence condition, and the P iterated clusters are determined as the P clusters.

6. The method according to claim 4, characterized in that Determining the radial basis width of the radial basis network according to the P basis function centers, and obtaining the radial basis width value includes: Obtaining two basis function centers that are farthest apart from each other from the P basis function centers to obtain a first basis function center and a second basis function center; The difference between the center of the first basis function and the center of the second basis function is calculated to obtain the center distance, and the ratio of the center distance to P is calculated to obtain the radial basis width value.

7. The method according to claim 4, characterized in that The output layer processes the N groups of historical financial behavior data, outputs N preset result parameters, and determines the weight of the output layer according to the radial basis width value, the N preset result parameters, and the N historical risk identification results, including: For a financial account, the output layer recursively processes a set of historical financial behavior data corresponding to the financial account and the radial basis width to obtain an output vector; Obtaining an initial weight value of the output layer, calculating the product of the output vector and the initial weight value, and obtaining a preset result parameter of the financial account; Obtaining a numerical representation of the historical risk identification result corresponding to each financial account, obtaining N historical result parameters, and determining whether there is an error between the preset result parameter corresponding to each financial account and the corresponding historical result parameter; If there are errors between the preset result parameters and the historical result parameters of T financial accounts among the N financial accounts, construct an error variance matrix based on the preset result parameters and the historical result parameters of the T financial accounts, where T is a positive integer; A smoothing factor is obtained, and a forgetting factor is calculated based on the smoothing factor. The initial weights are updated using the error variance matrix and the forgetting factor to obtain the weights of the output layer.

8. A risk identification device, characterized in that: include: A first acquisition unit is configured to acquire a financial account of a user, extract M financial records of the user within a preset time period based on the financial account, and process the M financial records to obtain M financial behavior data, where M is a positive integer; a second acquisition unit, configured to acquire a behavior recognition model, input the M financial behavior data into the behavior recognition model, and output a risk identification result, wherein the behavior recognition model is obtained by training a radial basis function network using a financial dataset, the financial dataset including a plurality of historical financial behavior data and a plurality of historical risk identification results, the risk identification result being used to indicate whether the financial account has a risk record; A generating unit is configured to generate risk warning information if the risk identification result indicates that the financial account has a risk record, wherein the risk warning information is used to prompt the user that risky behavior has occurred.

9. An electronic device, characterized in that: include: a memory storing an executable program; A processor, configured to run the program, wherein the program, when running, executes the risk identification method described in any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the steps of the risk identification method according to any one of claims 1 to 7 are implemented.

Images