Transaction interception rule determination method and device, program product and electronic equipment

Abstract

The invention discloses a transaction interception rule determination method and device, a program product and electronic equipment, and relates to the field of financial science and technology, and the method comprises the steps: generating a knowledge graph based on multi-source heterogeneous data, the multi-source heterogeneous data at least comprises financial transaction records with transaction risks in a financial institution, user credit scores provided by a third-party institution and a preset list, and the knowledge graph at least comprises an entity layer, a relation layer, a feature layer and a time sequence layer; generating a first interception rule according to a target sub-graph in the knowledge graph; the first interception rule is tested, the first interception rule passing the test is used as a target interception rule, and the target interception rule is used for carrying out risk decision making on financial transactions initiated by users of the financial institution in real time. According to the method and the device, the technical problem of low accuracy of intercepting financial transactions with transaction risks according to expert experience in the prior art is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of financial technology, in particular, to a transaction interception rule determination method and device, a program product and an electronic device. BACKGROUND

[0002] In the prior art, professional personnel of a financial institution analyze discovered user risk transactions to obtain high-risk transaction characteristics, and design interception rules for the risk transaction characteristics based on expert experience. Then, an operation and maintenance personnel configures the interception rules on a management page of a decision engine, and then the decision engine is put online to a production environment, and the rules are run by the decision engine to filter and risk intercept a large number of user transactions of the financial institution.

[0003] However, the prior art relies on manual experience to configure static rules, but manual experience is difficult to exhaust all risk scenarios, thereby causing the problem of insufficient coverage of different risk scenarios by the decision engine in the prior art, and the static rules configured manually are difficult to cope with new financial transaction risks, have rule lag, and thereby cause the technical problem of low accuracy of the interception rules generated according to expert experience in risk interception of financial transactions with transaction risks.

[0004] At present, no effective solution has been proposed for the above problems. SUMMARY

[0005] The present application provides a transaction interception rule determination method, device, program product and electronic device to at least solve the technical problem of low accuracy of interception of financial transactions with transaction risks in the prior art according to expert experience.

[0006] According to one aspect of the present application, a transaction interception rule determination method is provided, comprising: generating a knowledge graph based on multi-source heterogeneous data, wherein the multi-source heterogeneous data at least includes financial transaction records with transaction risks in a financial institution, user credit scores provided by a third party institution and a preset list, and the knowledge graph at least includes an entity layer, a relationship layer, a feature layer and a time sequence layer; generating a first interception rule according to a target subgraph in the knowledge graph, wherein the target subgraph is a subgraph in the knowledge graph with an occurrence frequency greater than or equal to a preset frequency, and the first interception rule is used to intercept financial transactions with transaction behavior characteristics corresponding to the target subgraph; testing the first interception rule, and taking the first interception rule that passes the test as a target interception rule, wherein the target interception rule is used to make real-time risk decisions on financial transactions initiated by users of the financial institution.

[0007] Optionally, the method further comprises: creating L entities based on the financial transaction records in the multi-source heterogeneous data, and taking the L entities as an entity layer, where L is a positive integer, and the L entities are used to represent transaction accounts, transaction devices, and transaction geographic locations involved in the financial transaction records; determining all edges between the L entities based on transaction fund flow information, transaction device sharing information, and transaction geographic location association information involved in the financial transaction records, and determining a relationship layer according to all edges between the L entities; determining attributes of each entity and attributes of each edge based on user credit scores and a preset list in the multi-source heterogeneous data, and determining a feature layer according to the attributes of each entity and the attributes of each edge, where the attributes are used to represent transaction types of corresponding financial transactions; performing time series analysis on attribute features of each entity and attribute features of each edge in the feature layer, and taking attribute change sequences obtained by the analysis as a time series layer; and generating the knowledge graph according to the entity layer, the relationship layer, the feature layer, and the time series layer.

[0008] Optionally, the method further comprises: obtaining M subgraphs corresponding to the knowledge graph, where M is a positive integer, and each of the M subgraphs is used to represent a transaction behavior of a financial transaction with transaction risk; obtaining a frequency of occurrence of each subgraph in the knowledge graph, and taking a subgraph with a frequency of occurrence greater than or equal to a preset frequency as a target subgraph; determining transaction behavior features corresponding to the target subgraph according to attributes of nodes and attributes of edges included in the target subgraph; and generating a first interception rule according to the transaction behavior features corresponding to the target subgraph.

[0009] Optionally, the method further comprises: determining an operation label according to the transaction behavior features corresponding to the target subgraph, where the operation label is used to represent an operation action type of a financial transaction with the transaction behavior features corresponding to the target subgraph; and performing feature coding on the transaction behavior features corresponding to the target subgraph and the operation label corresponding to the target subgraph to obtain the first interception rule, where the feature coding is used to convert the transaction behavior features and the operation label into a format recognizable by a risk decision engine of a financial institution.

[0010] Optionally, the method further comprises: taking financial transaction records in a historical time period in the financial institution as test data; performing offline testing on the first interception rule based on the test data to obtain an offline testing probability, where the offline testing probability is used to represent a correctness rate of transaction risk interception on the test data by the first interception rule.

[0011] Optionally, the method further comprises: transmitting the first interception rule to a shadow engine, wherein the shadow engine is a copy of the risk decision engine of the financial institution; inputting the test data into the shadow engine to obtain a first probability, wherein the first probability represents a correctness rate of the shadow engine in intercepting the test data after the first interception rule is added; inputting the test data into the risk decision engine of the financial institution to obtain a second probability, wherein the second probability represents a correctness rate of the risk decision engine in intercepting the test data before the first interception rule is added; and determining that the first interception rule passes the test when the offline test probability is greater than or equal to a preset probability and / or the first probability is greater than or equal to the second probability.

[0012] Optionally, the method further comprises: transmitting the target interception rule to the risk decision engine of the financial institution.

[0013] According to another aspect of the present application, a method for determining a transaction interception rule is also provided. The method comprises: generating a knowledge graph based on multi-source heterogeneous data, wherein the multi-source heterogeneous data comprises at least financial transaction records with transaction risks in a financial institution, user credit scores provided by a third party institution, and a preset blacklist, and the knowledge graph comprises at least an entity layer, a relationship layer, a feature layer, and a time sequence layer; generating a first interception rule according to a target subgraph in the knowledge graph, wherein the target subgraph is a subgraph in the knowledge graph with an occurrence frequency greater than or equal to a preset frequency, and the first interception rule is used to intercept financial transactions with transaction behavior characteristics corresponding to the target subgraph; and testing the first interception rule, and taking the first interception rule that passes the test as a target interception rule, wherein the target interception rule is used to make real-time risk decisions on financial transactions initiated by users of the financial institution.

[0014] According to another aspect of the present application, a computer program product is also provided, wherein the computer program product stores a computer program, and when the computer program runs, controls the computer program product to execute the method for determining a transaction interception rule according to any one of the above.

[0015] According to another aspect of the present application, an electronic device is also provided, wherein the electronic device comprises one or more processors and a memory, and the memory is used to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method for determining a transaction interception rule according to any one of the above.

[0016] In the present application, the target knowledge graph is constructed based on multi-source heterogeneous data, the user transaction data in the preset database of the financial institution, the user credit score data obtained from the third party institution and the preset list data are integrated, different financial transaction modes are dynamically represented through the knowledge graph, the purpose of automatically generating the first interception rule based on the target subgraph in the knowledge graph is achieved, then the first interception rule is tested, the first interception rule passing the test is taken as the target interception rule, the purpose of making transaction risk decision based on the target interception rule passing the test is achieved, the technical effect of improving the interception accuracy of risk transaction is achieved, and the technical problem of low accuracy of intercepting the financial transaction with transaction risk according to the expert experience in the prior art is solved. BRIEF DESCRIPTION OF DRAWINGS

[0017] The drawings described herein are used to provide further understanding of the present application, and form a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application, and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a flowchart of an optional transaction interception rule determination method according to an embodiment of the present application;

[0019] Figure 2 is a flowchart of an optional knowledge graph-based interception rule automatic generation method according to an embodiment of the present application;

[0020] Figure 3 is a schematic diagram of an optional rule automatic production line according to an embodiment of the present application;

[0021] Figure 4 is a schematic diagram of an optional transaction interception rule determination device according to an embodiment of the present application;

[0022] Figure 5 is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0024] It should be noted that the terms "first", "second", and the like in the description and claims of the application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0025] It should also be noted that the relevant information (including but not limited to information for display and analyzed information) and data (including but not limited to financial transaction records with transaction risk in financial institutions, user credit score data provided by third party institutions, and preset list data) involved in the present application are information and data authorized by the user or fully authorized by the parties. For example, an interface is provided between the system and the relevant user or institution. Before obtaining the relevant information, the interface needs to send a request to the aforementioned user or institution, and after receiving the consent information feedback from the aforementioned user or institution, the relevant information is obtained.

[0026] In addition, the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant information and data involved in the present application comply with the relevant laws, regulations and standards of the relevant region, and necessary security measures are taken, which do not violate public order and good customs. In addition, the present application provides a corresponding operation portal for users to choose to authorize or refuse authorization. If the user chooses to refuse authorization, the corresponding expert decision-making process is entered.

[0027] In an optional embodiment, a method for manually putting the generated interception rule online or offline in the decision engine is provided, the method comprising:

[0028] The operation and maintenance personnel of the financial institution analyze the high-risk transaction characteristics based on the discovered risk transactions, and design the corresponding interception rule based on the transaction characteristics. The interception rule is configured in the management end page of the decision engine by manual method. After the interception rule is tested and verified, the interception rule is put online to the production environment.

[0029] If the hit frequency of a certain interception rule in the decision engine decreases, or it is detected that the transaction hit by the decision engine does not have high risk, the interception rule is manually put offline to reduce the performance burden of the decision engine and the false interception of normal transactions.

[0030] However, the method in the above embodiment has the following disadvantages:

[0031] (1) Insufficient coverage: traditional risk control systems rely on manual experience to configure static rules, but manual experience is difficult to exhaust all risk scenarios.

[0032] (2) Rule lag: manually configured static rules are difficult to cope with new fraud risks and lag behind the evolution of new fraud methods.

[0033] (3) High maintenance cost: the rule base has high maintenance cost and requires continuous investment of manpower to analyze risk data.

[0034] (4) Lack of linkage: existing knowledge graph technology is mainly used for post-risk analysis and has not realized real-time linkage with the decision engine.

[0035] To solve the above problems, the present application provides a method for determining transaction interception rules, which solves the technical problems of the prior art that over-reliance on manual experience to configure static rules, rule update lagging behind the evolution speed of fraud methods, high maintenance cost of rule base, and knowledge graph technology failing to realize real-time linkage with the decision engine. The present application can reduce dependence on manual experience, and the flexibility of the graph database used by the knowledge graph can support various structured new risk transaction data. Furthermore, the present application can generate interception rules based on the latest risk transaction data and make the latest interception rules effective in real time in the decision engine, which can more effectively control transaction risks and reduce the maintenance cost of the rule base.

[0036] According to an embodiment of the present application, an embodiment of a method for determining transaction interception rules is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0037] The professional terms involved in the present application are explained as follows:

[0038] Decision engine: a system that automatically performs risk interception based on preset rules or models, relying on manual configuration or dynamically generated rules.

[0039] Knowledge graph: a system architecture that integrates multi-source heterogeneous data (industry business data + external data), stores, calculates and analyzes through a graph database, and constructs a visual relationship network.

[0040] Graph database: a database that stores entities (nodes) and relationships (edges) in a graph structure, supporting efficient query of associated networks.

[0041] Frequent subgraph mining algorithm: identify high-frequency appearing subgraph patterns (e.g., dense transfer clusters) from the knowledge graph to discover potential risky behaviors.

[0042] Interception rule: define a set of matching conditions for a feature based on its data characteristics.

[0043] The present application provides a transaction interception rule determination system (referred to as determination system) for executing the transaction interception rule determination method in the present application, Figure 1 is an optional flowchart of the transaction interception rule determination method according to an embodiment of the present application, as Figure 1 shown, the method comprises the following steps:

[0044] Step S101, generating a knowledge graph based on multi-source heterogeneous data, wherein the multi-source heterogeneous data at least includes financial transaction records with transaction risk in the financial institution, user credit scores provided by the third party institution and the preset list, and the knowledge graph at least includes entity layer, relationship layer, feature layer and time sequence layer.

[0045] Optionally, the source of multi-source heterogeneous data includes at least two parts: one is the preset database inside the financial institution, which is used to store financial transaction records with preset risk labels; the other is the user credit score and the preset list provided by the third party institution, wherein the third party institution is an institution that establishes a cooperative relationship with the financial institution, and the third party institution can obtain the credit score of the user according to the credit history record, the repayment record, the total amount of borrowing, the type and number of credit accounts, the length of credit history and credit activity comprehensive analysis after receiving the authorization information of the user, and the third party institution stores the identification of the user whose credit score is less than or equal to the preset score through the preset list, so as to help the financial institution further understand the credit risk status of the user from the third party perspective.

[0046] Optionally, the knowledge graph is a graph structure database used to express entities and their connections, and the knowledge graph in the present application integrates the information extracted from multi-source heterogeneous data, forming a four-layer architecture of entity layer, relationship layer, feature layer and time sequence layer.

[0047] Optionally, the entity layer includes transaction account, transaction device and transaction geographic location information and other entity information, and the entity layer is the basic constituent unit of the knowledge graph.

[0048] Optionally, the relationship layer includes transaction fund flow information, transaction device sharing information and transaction geographic location association information, etc., which describes the connection relationship between entities.

[0049] Optionally, the feature layer is used to give the entity risk features, such as abnormal pattern labels.

[0050] Optionally, a time sequence layer is configured to record the change trajectory of the transaction behavior, and the time sequence layer is capable of capturing the transaction mode of the financial transaction evolving over time.

[0051] In the step S101, the determination system can construct a more comprehensive and intuitive risk transaction relationship network by converting the multi-source heterogeneous data into the format of the knowledge graph, which not only contains basic entity information such as accounts, devices and locations, but also reflects dynamic characteristics such as time sequence changes of transactions and fund flow patterns, thereby providing a rich and correlated data basis for subsequent risk analysis and rule generation.

[0052] In step S102, a first interception rule is generated according to a target subgraph in the knowledge graph, wherein the target subgraph is a subgraph in the knowledge graph with an occurrence frequency greater than or equal to a preset frequency, and the first interception rule is used to intercept financial transactions with transaction behavior characteristics corresponding to the target subgraph.

[0053] Optionally, in the knowledge graph, the target subgraph refers to a graph structure pattern with an occurrence frequency reaching or exceeding a preset frequency, which can represent the transaction characteristics of financial transactions with transaction risks.

[0054] In the step S102, the determination system mines frequent transaction patterns, i.e., target subgraphs, in the knowledge graph through an automated algorithm, and then automatically generates interception rules. This process enables financial institutions to quickly respond to new risks without relying on manual configuration, thereby improving the efficiency and relevance of rule generation, enabling the generation of corresponding interception rules when new fraud methods appear, and enhancing the ability to resist unknown risks.

[0055] In step S103, the first interception rule is tested, and the first interception rule that passes the test is used as a target interception rule, wherein the target interception rule is used for real-time risk decision-making on financial transactions initiated by users of the financial institution.

[0056] Optionally, the determination system performs a series of evaluations and verifications on the first interception rule before it is formally applied to the production environment, thereby ensuring the effectiveness and accuracy of the first interception rule that passes the test.

[0057] In the step S103, even if the first interception rule is automatically generated based on the latest data, it still needs to go through a strict testing process to verify its performance and avoid false positives or missing real risks for normal transactions. The test includes offline historical data backtracking verification and real-time shadow system comparison to evaluate the accuracy and stability of the first interception rule. Only when the interception rule successfully passes the test and proves that it can effectively identify risky transactions without increasing the false positive rate, it becomes the target interception rule and is put online to the decision engine, thereby realizing real-time transaction monitoring and risk interception.

[0058] In the present application, the target knowledge graph is constructed based on multi-source heterogeneous data. By integrating the user transaction data in the preset database of the financial institution, the user credit score data provided by the third party institution and the preset list data, different financial transaction modes are dynamically represented through the knowledge graph, the purpose of automatically generating the first interception rule based on the target subgraph in the knowledge graph is realized, then the first interception rule is tested, the first interception rule that passes the test is taken as the target interception rule, so as to realize the purpose of making transaction risk decision based on the target interception rule that passes the test, realize the technical effect of improving the interception accuracy of risk transaction, and solve the technical problem of low accuracy of intercepting financial transactions with transaction risk according to expert experience in the prior art.

[0059] In an optional embodiment, the determination system first creates L entities based on the financial transaction records in the multi-source heterogeneous data, and takes the L entities as an entity layer, wherein L is a positive integer, and the L entities are used to represent the transaction accounts, transaction devices and transaction geographic locations involved in the financial transaction records. Then, the determination system determines all edges between the L entities based on the transaction fund flow information, transaction device sharing information and transaction geographic location association information involved in the financial transaction records, and determines a relationship layer according to all edges between the L entities. Then, the determination system determines the attributes of each entity and the attributes of each edge based on the user credit score and the preset list in the multi-source heterogeneous data, and determines a feature layer according to the attributes of each entity and the attributes of each edge. The attributes are used to represent the transaction type of the corresponding financial transaction. Then, the determination system performs time sequence analysis on the attribute features of each entity and the attribute features of each edge in the feature layer, and takes the attribute change sequence obtained by the analysis as a time sequence layer. Finally, the determination system generates a knowledge graph according to the entity layer, the relationship layer, the feature layer and the time sequence layer.

[0060] Optionally, the determination system abstracts the parties involved in the transaction records (accounts, devices, locations) into L nodes (i.e. L entities) in the knowledge graph, which not only ensures the diversity and comprehensiveness of the entities in the knowledge graph, but also lays a data foundation for subsequent construction of edge relationships and transaction feature analysis.

[0061] Optionally, the edge is the connection between entities in the graph database, and the edge records the relationship type and strength between entities, such as transaction amount, device usage time and other attribute information.

[0062] Optionally, by determining the edges between entities, the determination system establishes a network of associations between entities, further enriching the structure of the knowledge graph. The construction of the relationship layer enables the system to identify and analyze the interactions between entities, such as the rapid flow of funds, frequent switching of equipment, or abnormal changes in geographic location. These relationship patterns are crucial for identifying risky transactions.

[0063] Optionally, the addition of the feature layer enhances the description ability and analysis accuracy of the knowledge graph. By attaching attribute information such as user credit scores to entities and edges, the determination system can identify potential risks based on a more comprehensive information set. In other words, by combining user credit scores and transaction patterns, the determination system can more accurately assess suspicious behavior of accounts.

[0064] Optionally, the time series layer is a graph layer in the knowledge graph used to record the changes of entity and relationship attributes over time. By analyzing the sequence of attribute changes, the system can capture the dynamic evolution of transaction behavior. The construction of the time series layer enables the determination system to identify changes in transaction patterns over time, such as sudden changes in account behavior or rapid movements of device locations.

[0065] In an optional embodiment, the determination system first obtains M subgraphs corresponding to the knowledge graph, where M is a positive integer, and each of the M subgraphs represents a transaction behavior of a financial transaction with transaction risk. Then, the determination system obtains the occurrence frequency of each subgraph in the knowledge graph, and takes the subgraph with an occurrence frequency greater than or equal to a preset frequency as a target subgraph. Next, the determination system determines the transaction behavior features corresponding to the target subgraph based on the attributes of the nodes and edges included in the target subgraph. Finally, the determination system generates a first interception rule based on the transaction behavior features corresponding to the target subgraph.

[0066] Optionally, the determination system can perform frequent subgraph mining on the knowledge graph through a preset algorithm, thereby determining M subgraphs corresponding to the knowledge graph. The preset algorithm can be set as the Apriori algorithm (a priori algorithm), the FSG (Frequent Subgraph Generation) algorithm, the gSpan algorithm (a frequent subgraph mining algorithm in large graphs), or the Gaston algorithm (a fast frequent subgraph mining algorithm in large graph databases). The M subgraphs cover different types of transaction behavior patterns from simple to complex, providing diverse pattern samples for subsequent analysis and rule generation.

[0067] Optionally, the occurrence frequency, i.e., the number of times a subgraph appears in the knowledge graph, reflects the universality and importance of the transaction pattern corresponding to the subgraph in actual transaction data.

[0068] Optionally, the determination system filters sub-graphs by setting frequency conditions, ensuring that the focus of subsequent analysis and rule generation is concentrated on those frequently occurring, high-representative risk transaction patterns, not only improving the efficiency of analysis, but also ensuring that the generated first interception rules have stronger pertinence and practicality.

[0069] Optionally, the attributes of the nodes are the characteristic descriptions of the entities in the knowledge graph, including account, device, and geographic location information, as well as corresponding credit scores, behavior habits, etc.; the attributes of the edges are the characteristic descriptions of the relationships between entities, such as the amount of fund transfer, the duration of device sharing, etc.

[0070] Optionally, the determination system extracts risk transaction pattern characteristics for describing potential risk transaction behaviors through comprehensive analysis of node and edge attributes.

[0071] Optionally, the above steps identify features closely related to risk transactions through in-depth analysis of the target sub-graph, and determine the system to define risk transaction features more accurately by comprehensively considering the strength and type of entity attributes and inter-entity relationships, thereby providing a solid data foundation for the subsequent generation of first interception rules.

[0072] Optionally, after the determination system identifies specific transaction risk behavior characteristics based on the target sub-graph, the determination system can automatically design and generate preliminary first interception rules according to these characteristics. The generation of first interception rules is a key step to convert analysis results into practical applications, aiming to automatically identify and prevent potential high-risk transactions by matching features in real-time transaction data, thereby reducing financial losses and risk exposure. This rule generation method not only reduces dependence on human labor, improves decision-making efficiency, but also dynamically adapts to changing transaction risk environment, enhancing the flexibility and responsiveness of the financial institution's risk control system.

[0073] In an optional embodiment, the determination system first determines the operation label according to the transaction behavior characteristics corresponding to the target sub-graph, wherein the operation label is used to represent the operation action type of the financial transaction with the transaction behavior characteristics corresponding to the target sub-graph. Then, the determination system encodes the transaction behavior characteristics corresponding to the target sub-graph and the operation label corresponding to the target sub-graph to obtain the first interception rule, wherein the feature encoding is used to convert the transaction behavior characteristics and the operation label into a format that can be recognized by the risk decision engine of the financial institution.

[0074] Optionally, the transaction behavior characteristics are extracted from the target sub-graph and can represent specific attributes of risk transaction characteristics, including but not limited to account activity frequency, transaction amount distribution, device location change, etc.

[0075] Optionally, the operation label is defined based on the transaction behavior characteristics, and is used to guide the financial institution to respond to the transaction hitting a specific rule. For example, the operation label can be set as a "first-level warning" label, a "second-level interception" label, or a "comprehensive freezing" label, where different operation labels correspond to different operation action types, so that the decision engine of the financial institution can take corresponding risk control measures according to the operation label.

[0076] Optionally, the determination system provides the financial institution with a clear risk control measure by combining the analyzed transaction behavior characteristics with the corresponding operation label, that is, when a transaction that meets the transaction pattern corresponding to a specific target subgraph is identified, the financial institution can clearly take what kind of operation action type to handle the risk transaction. The determination of the operation label is the key to transforming risk identification into a clear risk management strategy, thereby achieving the purpose of automated risk control.

[0077] Optionally, the feature encoding is a code that can be understood by the risk decision engine of the financial institution. The encoding process involves data standardization, format adjustment, and semantic conversion, etc., so as to ensure that the decision engine can correctly parse and apply the transaction behavior characteristics corresponding to the target subgraph and the operation label corresponding to the target subgraph, etc.

[0078] Optionally, the determination system converts the transaction behavior characteristics and the operation label into a format recognizable by the computer (i.e., the risk decision engine) through feature encoding, so that the first interception rule can be automatically identified and executed by the risk decision engine of the financial institution. This step ensures that the automated process of rule generation can seamlessly integrate into the existing risk management system of the financial institution, thereby improving the efficiency of the execution of the interception rule, so that the financial institution can take action quickly after discovering new risk transaction patterns, thereby reducing user losses caused by risk transactions.

[0079] In an optional embodiment, the determination system first takes the financial transaction records in the financial institution in a historical time period as test data, and then the determination system performs offline testing on the first interception rule based on the test data to obtain an offline testing probability, where the offline testing probability is used to represent the correctness of the transaction risk interception of the test data by the first interception rule.

[0080] Optionally, the financial transaction records in the historical time period are selected from the transaction data in a specific historical time period in the preset database of the financial institution, which includes known normal transaction records and risk transaction records, and is used to test the performance of the first interception rule offline.

[0081] Optionally, the offline test refers to a test of the first interception rule outside the actual production environment, through the offline test, the system determines the accuracy of the first interception rule in identifying risky transactions, the offline test probability reflects the degree of coincidence between the identification result of the rule when applied to historical data and the actual situation, a high offline test probability means that the rule performs well in identifying risky transactions, and a low probability prompts the system to determine that the first interception rule needs to be adjusted to improve its accuracy.

[0082] Optionally, through the above steps, the system can obtain preliminary test results of the performance of the first interception rule, providing a test basis for its online to the decision engine and application to real-time transactions. The offline test of the rule not only verifies its theoretical feasibility, but also detects the hit rate on actual data, ensuring that the generated interception rule can effectively identify and intercept risky transactions before formal deployment, thereby ensuring the security of financial transactions processed by the financial institution.

[0083] In an optional embodiment, the determination system first transmits the first interception rule to the shadow engine, wherein the shadow engine is a copy of the risk decision engine of the financial institution, then the determination system inputs the test data into the shadow engine to obtain the first probability, wherein the first probability represents the accuracy of the shadow engine in intercepting transaction risks of the test data after adding the first interception rule, then the determination system inputs the test data into the risk decision engine of the financial institution to obtain the second probability, wherein the second probability represents the accuracy of the risk decision engine in intercepting transaction risks of the test data before adding the first interception rule.

[0084] Optionally, the determination system deploys the shadow engine to achieve the purpose of testing the first interception rule in a test environment isolated from the production environment, thereby avoiding the impact of the test process of the first interception rule on the actual production environment of the financial institution, i.e., avoiding the impact of the interception errors introduced by the newly generated first interception rule on the actual risk management effect of the financial institution on user financial transactions.

[0085] Optionally, the first probability refers to the accuracy of the shadow engine in intercepting transaction risks of the test data after adding the first interception rule, i.e., the proportion of actual risky transactions that are correctly identified and intercepted, the determination system can evaluate the actual effect of the first interception rule in the simulation environment by inputting the test data into the shadow engine, i.e., the accuracy and reliability of the first interception rule in identifying risky transactions.

[0086] Optionally, the second probability refers to the accuracy of the financial institution risk decision engine in transaction risk interception of the same test data without joining the first interception rule, which reflects the risk identification performance of the current system without the intervention of new rules. This step provides the baseline performance of the risk decision engine for comparison with the performance of the shadow engine after joining the first interception rule to evaluate whether the newly generated first interception rule has truly improved the accuracy of risk identification.

[0087] Optionally, in the case that the offline test probability is greater than or equal to a preset probability, and / or the first probability is greater than or equal to the second probability, the system determines that the first interception rule passes the test.

[0088] Optionally, the offline test probability refers to the accuracy of the first interception rule in identifying and intercepting risky transactions from the test data in the offline test phase.

[0089] Optionally, the first probability and the second probability respectively represent the performance of the shadow engine after joining the new rule and the performance of the original decision engine. By comparing the first probability with the second probability, the determination system can directly compare the ability of the system to identify risky transactions before and after the introduction of the rule.

[0090] Optionally, through the above steps, the determination system can ensure that the newly added rule improves the risk management capability while not reducing the stability and efficiency of the existing system, providing a rigorous test process and standard for the smooth online and application of the new rule.

[0091] In an optional embodiment, after testing the first interception rule, the determination system transmits the target interception rule to the risk decision engine of the financial institution.

[0092] Optionally, by transmitting the target interception rule to the risk decision engine, the financial institution can not only improve the accuracy and comprehensiveness of risk identification by using the latest transaction behavior patterns, but also reduce the dependence on manual analysis, thereby achieving the technical effects of improving the efficiency and real-time of risk control decisions.

[0093] In the present application, the target knowledge graph is constructed based on multi-source heterogeneous data. By integrating user transaction data in the preset database of the financial institution, user credit score data provided by the third party institution and preset list data, different financial transaction modes are dynamically represented through the knowledge graph, the purpose of automatically generating the first interception rule based on the target subgraph in the knowledge graph is achieved, then the first interception rule is tested, the first interception rule that passes the test is taken as the target interception rule, thereby achieving the purpose of transaction risk decision-making based on the target interception rule that passes the test, realizing the technical effect of improving the interception accuracy of risk transactions, and further solving the technical problem of low accuracy of intercepting financial transactions with transaction risks according to expert experience in the prior art.

[0094] In an optional embodiment, a knowledge graph-based interception rule automatic generation method is also provided, Figure 2 is a flowchart of an optional knowledge graph-based interception rule automatic generation method according to an embodiment of the present application, as Figure 2 shown, the method comprises the following steps:

[0095] (1) Real-time data acquisition:

[0096] The transaction system of the financial institution realizes real-time stream processing of data by establishing a dynamic data pipeline between the data source such as the preset database, and the structure field of the dynamic data pipeline is exemplified as follows:

[0097] {

[0098] "transaction_id":"TX20231102****",

[0099] "user_id":"U123***",

[0100] "device_fingerprint":"DFP89K**",

[0101] "geo_location":"39.9042,***.4074",

[0102] "behavior_sequence":[

[0103] 1*1,

[0104] 2*5,

[0105] 3*8]

[0106] }

[0107] (2) Knowledge graph construction:

[0108] Based on the large amount of real-time risk transaction data obtained in step (1), a relationship network of risk transactions is constructed using a graph database, and a graph neural network is used for dynamic relationship mining.

[0109] (3) Rule generation:

[0110] Based on the knowledge graph, an automatic rule production line is realized, Figure 3 An optional schematic diagram of an automatic rule production line according to an embodiment of the present application is shown in FIG. 1, which includes the following steps: Figure 3

[0111] First, the knowledge graph is checked for high-frequency subgraphs, then the mode features of the high-frequency subgraphs are extracted, and finally, the logic of the rules is modeled based on the extracted transaction mode features. For example, the generated rule logic is as follows:

[0112] if (the same device changes 3 accounts within 24 hours)

[0113] and (the transaction amount conforms to the Fibonacci sequence distribution)

[0114] and (the positioning mutation distance > 100 km):

[0115] Trigger secondary interception;

[0116] (4) Rule optimization:

[0117] Before the rules generated on the decision engine go online, a double-channel evaluation mechanism needs to be established to verify the effectiveness of the rules, wherein the double-channel evaluation mechanism includes: offline testing, which is used to verify the effectiveness of the rules using historical data; and shadow system testing, which is used to compare the differences in interception between new and old rules in real time.

[0118] (5) Rule execution:

[0119] After the rules are verified, the rules are automatically synchronized to the decision engine and automatically go online, filter real-time transactions, and intercept abnormal transactions that hit the rules.

[0120] In an optional embodiment, an application scenario of the present application is as follows:

[0121] (1) The preset database stores multiple cross-border telecom fraud transaction records, in which the user transfers money to the same account in a foreign country in multiple times within a short period of time;

[0122] (2) The knowledge graph is updated in real time based on the multiple cross-border telecom fraud transaction records stored in the preset database;

[0123] ​(3) According to the latest data of the knowledge graph, an interception rule is generated: "the same receiving account receives more than 5 different accounts remittances within 2 hours, and the initiating device has a positioning mutation";

[0124] (4) The interception rule is verified and automatically put online in the decision engine;

[0125] (5) The decision engine detects in real time that 10 accounts remit to the same overseas account through 5 devices within 2 hours, hits the rule and intercepts the remittance transaction.

[0126] (6) After-the-fact verification confirms that the transaction is an overseas telecom fraud.

[0127] From the above, the technical effects brought by the technical scheme of the application are as follows:

[0128] (1) Reduce the dependence of decision engine rule design and configuration on manpower, reduce maintenance cost, and do not need to spend a lot of cost to train and maintain a large-scale risk control team.

[0129] (2) Improve the timeliness of the interception rule, generate the interception rule based on the latest risk transaction data and put it online to the decision engine in real time, and effectively cope with new fraud methods.

[0130] (3) Improve the accuracy of the rule, which can cover more risk scenarios than manual analysis.

[0131] According to another aspect of the embodiments of the application, a transaction interception rule determination device is also provided, Figure 4 is a schematic diagram of an optional transaction interception rule determination device according to an embodiment of the application, as Figure 4 shown, the transaction interception rule determination device comprises a first generation unit 401, a second generation unit 402 and a first determination unit 403.

[0132] Optionally, the first generation unit is configured to generate a knowledge graph based on multi-source heterogeneous data, wherein the multi-source heterogeneous data at least includes financial transaction records with transaction risks in a financial institution, user credit scores provided by a third party institution and a preset list, and the knowledge graph at least includes an entity layer, a relationship layer, a feature layer and a time sequence layer; the second generation unit is configured to generate a first interception rule according to a target subgraph in the knowledge graph, wherein the target subgraph is a subgraph in the knowledge graph with an occurrence frequency greater than or equal to a preset frequency, and the first interception rule is used to intercept a financial transaction with a transaction behavior feature corresponding to the target subgraph; and the first determination unit is configured to test the first interception rule, and the first interception rule that passes the test is used as a target interception rule, wherein the target interception rule is used to make real-time risk decisions on financial transactions initiated by users of the financial institution.

[0133] In an optional embodiment, the first generating unit comprises a first creating subunit, a first determining subunit, a second determining subunit, a time sequence analysis subunit, and a first generating subunit.

[0134] Optionally, the first creating subunit is configured to create L entities based on the financial transaction records in the multi-source heterogeneous data, and take the L entities as an entity layer, where L is a positive integer, and the L entities are used to represent transaction accounts, transaction devices, and transaction geographic locations involved in the financial transaction records; the first determining subunit is configured to determine all edges between the L entities based on transaction fund flow information, transaction device sharing information, and transaction geographic location association information involved in the financial transaction records, and determine a relationship layer according to the all edges between the L entities; the second determining subunit is configured to determine attributes of each entity and attributes of each edge based on user credit scores and a preset list in the multi-source heterogeneous data, and determine a feature layer according to the attributes of each entity and the attributes of each edge, where the attributes are used to represent transaction types of corresponding financial transactions; the time sequence analysis subunit is configured to perform time sequence analysis on attribute features of each entity and attribute features of each edge in the feature layer, and take attribute change sequences obtained by the analysis as a time sequence layer; and the first generating subunit is configured to generate the knowledge graph according to the entity layer, the relationship layer, the feature layer, and the time sequence layer.

[0135] In an optional embodiment, the second generating unit comprises a first obtaining subunit, a second obtaining subunit, a third determining subunit, and a second generating subunit.

[0136] Optionally, the first obtaining subunit is configured to obtain M subgraphs corresponding to the knowledge graph, where M is a positive integer, and each of the M subgraphs is used to represent a transaction behavior of a financial transaction with a transaction risk; the second obtaining subunit is configured to obtain occurrence frequencies of each subgraph in the knowledge graph, and take a subgraph with an occurrence frequency greater than or equal to a preset frequency as a target subgraph; the third determining subunit is configured to determine transaction behavior features corresponding to the target subgraph according to attributes of nodes and attributes of edges included in the target subgraph; and the second generating subunit is configured to generate a first interception rule according to the transaction behavior features corresponding to the target subgraph.

[0137] In an optional embodiment, the second generating subunit comprises a first determining module and a feature encoding module.

[0138] Optionally, the first determining module is configured to determine an operation label according to the transaction behavior feature corresponding to the target subgraph, where the operation label is used to represent an operation action type of a financial transaction having the transaction behavior feature corresponding to the target subgraph; and the feature encoding module is configured to perform feature encoding on the transaction behavior feature corresponding to the target subgraph and the operation label corresponding to the target subgraph to obtain the first interception rule, where the feature encoding is used to convert the transaction behavior feature and the operation label into a format recognizable by a risk decision engine of the financial institution.

[0139] In an optional embodiment, the first determining unit comprises a fourth determining subunit and an offline testing subunit.

[0140] Optionally, the fourth determining subunit is configured to take financial transaction records in a historical time period in the financial institution as test data; and the offline testing subunit is configured to perform offline testing on the first interception rule based on the test data to obtain an offline testing probability, where the offline testing probability is used to represent a correctness rate of transaction risk interception on the test data by the first interception rule.

[0141] In an optional embodiment, the first determining unit further comprises a transmission subunit, a first input subunit, a second input subunit, and a fifth determining subunit.

[0142] Optionally, the transmission subunit is configured to transmit the first interception rule to a shadow engine, where the shadow engine is a copy of the risk decision engine of the financial institution; the first input subunit is configured to input the test data to the shadow engine to obtain a first probability, where the first probability is used to represent a correctness rate of transaction risk interception on the test data by the shadow engine after the first interception rule is added; the second input subunit is configured to input the test data to the risk decision engine of the financial institution to obtain a second probability, where the second probability is used to represent a correctness rate of transaction risk interception on the test data by the risk decision engine before the first interception rule is added; and the fifth determining subunit is configured to determine that the first interception rule passes the test in a case where the offline testing probability is greater than or equal to a preset probability, and / or, the first probability is greater than or equal to the second probability.

[0143] In an optional embodiment, the transaction interception rule determination apparatus further comprises a transmission unit.

[0144] Optionally, the transmission unit is configured to transmit the target interception rule to the risk decision engine of the financial institution.

[0145] In the present application, a method of constructing a target knowledge graph based on multi-source heterogeneous data is adopted. By integrating user transaction data in the preset database of financial institutions, user credit score data provided by third-party institutions and preset list data, different financial transaction patterns are dynamically represented through the knowledge graph, and the purpose of automatically generating the first interception rule based on the target subgraph in the knowledge graph is achieved. Afterwards, the present application tests the first interception rule and uses the first interception rule that passes the test as the target interception rule, thereby achieving the purpose of making transaction risk decisions based on the target interception rule that passes the test, and achieving the technical effect of improving the interception accuracy of risky transactions, thereby solving the technical problem of low accuracy in intercepting financial transactions with transaction risks based on expert experience in the existing technology.

[0146] According to another aspect of an embodiment of the present application, a computer program product is further provided, the computer program product including a stored computer program, wherein when the computer program is running, the computer program product is controlled to execute any one of the above-mentioned transaction interception rule determination methods.

[0147] According to another aspect of an embodiment of the present application, an electronic device is also provided, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any of the above-mentioned transaction interception rule determination methods by executing the executable instructions.

[0148] Optionally, Figure 5 This is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 Only one is shown) processor 502, memory 504, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0149] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: including: generating a knowledge graph based on multi-source heterogeneous data, wherein the multi-source heterogeneous data at least includes financial transaction records with transaction risks in financial institutions, user credit scores and preset lists provided by third-party institutions, and the knowledge graph at least includes an entity layer, a relationship layer, a feature layer, and a time series layer; generating a first interception rule based on a target subgraph in the knowledge graph, wherein the target subgraph is a subgraph in the knowledge graph whose appearance frequency is greater than or equal to a preset frequency, and the first interception rule is used to intercept financial transactions with transaction behavior characteristics corresponding to the target subgraph; testing the first interception rule, and using the first interception rule that passes the test as the target interception rule, wherein the target interception rule is used to make real-time risk decisions on financial transactions initiated by users of financial institutions.

[0150] The processor can call information and application programs stored in the memory through the transmission device to perform the following steps: creating L entities based on the financial transaction records in the multi-source heterogeneous data, and taking the L entities as an entity layer, wherein L is a positive integer, and the L entities are used to represent transaction accounts, transaction devices and transaction geographic locations involved in the financial transaction records; determining all edges between the L entities based on transaction fund flow information, transaction device sharing information and transaction geographic location association information involved in the financial transaction records, and determining a relationship layer according to all edges between the L entities; determining the attributes of each entity and the attributes of each edge based on user credit scores and preset lists in the multi-source heterogeneous data, and determining a feature layer according to the attributes of each entity and the attributes of each edge, wherein the attributes are used to represent the transaction types of the corresponding financial transactions; performing time series analysis on the attribute features of each entity and the attribute features of each edge in the feature layer, and taking the attribute change sequence obtained by the analysis as a time series layer; and generating a knowledge graph according to the entity layer, the relationship layer, the feature layer and the time series layer.

[0151] The processor can call information and application programs stored in the memory through the transmission device to perform the following steps: obtaining M subgraphs corresponding to the knowledge graph, wherein M is a positive integer, and each subgraph in the M subgraphs is used to represent a transaction behavior of a financial transaction with transaction risk; obtaining the occurrence frequency of each subgraph in the knowledge graph, and taking a subgraph with an occurrence frequency greater than or equal to a preset frequency as a target subgraph; determining transaction behavior features corresponding to the target subgraph according to the attributes of the nodes and the attributes of the edges included in the target subgraph; and generating a first interception rule according to the transaction behavior features corresponding to the target subgraph.

[0152] The processor can call information and application programs stored in the memory through the transmission device to perform the following steps: determining an operation label according to the transaction behavior features corresponding to the target subgraph, wherein the operation label is used to represent an operation action type of a financial transaction with the transaction behavior features corresponding to the target subgraph; and performing feature coding on the transaction behavior features corresponding to the target subgraph and the operation label corresponding to the target subgraph to obtain the first interception rule, wherein the feature coding is used to convert the transaction behavior features and the operation label into a format that can be recognized by a risk decision engine of a financial institution.

[0153] The processor can call information and application programs stored in the memory through the transmission device to perform the following steps: taking financial transaction records in a historical time period in the financial institution as test data; performing offline testing on the first interception rule based on the test data to obtain an offline testing probability, wherein the offline testing probability is used to represent the correctness rate of transaction risk interception on the test data by the first interception rule.

[0154] The processor can call information and application programs stored in the memory through the transmission device to perform the following steps: transmitting the first interception rule to a shadow engine, wherein the shadow engine is a copy of a risk decision engine of the financial institution; inputting the test data into the shadow engine to obtain a first probability, wherein the first probability is used to represent the accuracy of the shadow engine in performing transaction risk interception on the test data after adding the first interception rule; inputting the test data into the risk decision engine of the financial institution to obtain a second probability, wherein the second probability is used to represent the accuracy of the risk decision engine in performing transaction risk interception on the test data before adding the first interception rule; and determining that the first interception rule passes the test in a case where the offline test probability is greater than or equal to a preset probability, and / or the first probability is greater than or equal to the second probability.

[0155] The processor can call information and application programs stored in the memory through the transmission device to perform the following steps: transmitting the target interception rule to the risk decision engine of the financial institution.

[0156] By adopting the technical scheme of the method for determining a transaction interception rule provided in the embodiments of the present application, in the present application, the target knowledge graph is constructed based on multi-source heterogeneous data, the user transaction data in the preset database of the financial institution, the user credit score data provided by the third party institution, and the preset list data are integrated, different financial transaction modes are dynamically represented through the knowledge graph, the purpose of automatically generating the first interception rule based on the target subgraph in the knowledge graph is achieved, then, the first interception rule is tested, the first interception rule that passes the test is taken as the target interception rule, the purpose of making the transaction risk decision based on the target interception rule that passes the test is achieved, the technical effect of improving the interception accuracy of the risk transaction is achieved, and the technical problem of low accuracy of intercepting the financial transaction with transaction risk according to the expert experience in the prior art is solved.

[0157] Those skilled in the art can understand that, Figure 5 The structure shown is only schematic, and the electronic device can also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a palm computer, a Mobile Internet Device (MID), a PAD, or the like. Figure 5 It does not limit the structure of the electronic device. For example, the electronic device can include more or fewer components (such as a network interface, a display device, etc.) than Figure 5 those shown in the figures, or have a different configuration from Figure 5 those shown in the figures.

[0158] Those skilled in the art can understand that all or part of the steps in the above-mentioned various methods of the embodiments can be instructed by programs to terminal device related hardware, and the programs can be stored in a computer readable storage medium, which can include a flash disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0159] The serial numbers of the embodiments of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments.

[0160] In the above-described embodiments of the present application, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0161] In the several embodiments provided by the present application, it should be understood that the disclosed technology can be implemented in other ways. Of course, the embodiment described above is only illustrative, and the division of units is only a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, unit or module, and can be electrical or other forms.

[0162] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the embodiment scheme.

[0163] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0164] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0165] The above is only the preferred embodiment of the present application, and it should be pointed out that for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which should be considered as the protection scope of the present application.

Claims

1. A method for determining transaction interception rules, characterized in that: include: Generate a knowledge graph based on multi-source heterogeneous data, wherein the multi-source heterogeneous data includes at least financial transaction records with transaction risks in financial institutions, user credit scores and preset lists provided by third-party institutions, and the knowledge graph includes at least an entity layer, a relationship layer, a feature layer, and a time series layer; Generating a first interception rule based on a target subgraph in the knowledge graph, wherein the target subgraph is a subgraph in the knowledge graph that appears at a frequency greater than or equal to a preset frequency, and the first interception rule is used to intercept financial transactions having transaction behavior characteristics corresponding to the target subgraph; The first interception rule is tested, and the first interception rule that passes the test is used as a target interception rule, wherein the target interception rule is used to make real-time risk decisions on financial transactions initiated by users of the financial institution.

2. The method for determining transaction interception rules according to claim 1, characterized in that: Generate knowledge graphs based on multi-source heterogeneous data, including: Creating L entities based on the financial transaction records in the multi-source heterogeneous data, and using the L entities as the entity layer, where L is a positive integer, and the L entities are used to represent the transaction accounts, transaction devices, and transaction geographic locations involved in the financial transaction records; Determining all edges between the L entities based on the transaction fund flow information, transaction device sharing information, and transaction geographic location association information involved in the financial transaction record, and determining the relationship layer based on all edges between the L entities; Determining attributes of each entity and each edge based on user credit scores and a preset list in the multi-source heterogeneous data, and determining the feature layer based on the attributes of each entity and each edge, wherein the attributes are used to characterize the transaction type of the corresponding financial transaction; Performing time series analysis on the attribute features of each entity and each edge in the feature layer, and using the attribute change sequence obtained from the analysis as the time series layer; The knowledge graph is generated based on the entity layer, the relationship layer, the feature layer and the time series layer.

3. The method for determining transaction interception rules according to claim 1, characterized in that: Generating a first interception rule according to the target subgraph in the knowledge graph includes: Obtaining M subgraphs corresponding to the knowledge graph, where M is a positive integer, and each of the M subgraphs is used to represent a transaction behavior of a financial transaction with transaction risk; Obtaining the occurrence frequency of each subgraph in the knowledge graph, and taking the subgraph whose occurrence frequency is greater than or equal to the preset frequency as the target subgraph; Determining transaction behavior characteristics corresponding to the target subgraph based on attributes of nodes and edges included in the target subgraph; The first interception rule is generated according to the transaction behavior characteristics corresponding to the target subgraph.

4. The method for determining transaction interception rules according to claim 3, characterized in that: Generating the first interception rule according to the transaction behavior characteristics corresponding to the target subgraph includes: Determining an operation label based on the transaction behavior characteristics corresponding to the target subgraph, wherein the operation label is used to represent the type of operation action on the financial transaction having the transaction behavior characteristics corresponding to the target subgraph; The transaction behavior features corresponding to the target subgraph and the operation labels corresponding to the target subgraph are feature-encoded to obtain the first interception rule, wherein the feature coding is used to convert the transaction behavior features and the operation labels into a format that can be recognized by the risk decision engine of the financial institution.

5. The method for determining transaction interception rules according to claim 1, characterized in that: Testing the first interception rule includes: Using financial transaction records within a historical period in the financial institution as test data; An offline test is performed on the first interception rule based on the test data to obtain an offline test probability, wherein the offline test probability is used to represent the accuracy rate of transaction risk interception of the test data using the first interception rule.

6. The method for determining transaction interception rules according to claim 5, characterized in that: After performing offline testing on the first interception rule based on the test data, the method for determining the transaction interception rule further includes: transmitting the first interception rule to a shadow engine, wherein the shadow engine is a copy of the risk decision engine of the financial institution; Inputting the test data into a shadow engine to obtain a first probability, wherein the first probability is used to represent the accuracy of the shadow engine's transaction risk interception of the test data after adding the first interception rule; Inputting the test data into the risk decision engine of the financial institution to obtain a second probability, wherein the second probability is used to represent the accuracy rate of transaction risk interception performed by the risk decision engine on the test data before the first interception rule is added; When the offline test probability is greater than or equal to a preset probability, and / or the first probability is greater than or equal to the second probability, it is determined that the first interception rule test has passed.

7. The method for determining transaction interception rules according to claim 1, characterized in that: After testing the first interception rule, the method for determining the transaction interception rule further includes: The target interception rules are transmitted to the risk decision engine of the financial institution.

8. A device for determining transaction interception rules, characterized in that: include: a first generating unit, configured to generate a knowledge graph based on multi-source heterogeneous data, wherein the multi-source heterogeneous data includes at least financial transaction records with transaction risks in financial institutions, user credit scores and preset lists provided by third-party institutions, and the knowledge graph includes at least an entity layer, a relationship layer, a feature layer, and a time series layer; a second generating unit, configured to generate a first interception rule based on a target subgraph in the knowledge graph, wherein the target subgraph is a subgraph in the knowledge graph whose appearance frequency is greater than or equal to a preset frequency, and the first interception rule is configured to intercept financial transactions having transaction behavior characteristics corresponding to the target subgraph; The first determination unit is configured to test the first interception rule and use the first interception rule that passes the test as a target interception rule, wherein the target interception rule is used to make real-time risk decisions on financial transactions initiated by users of the financial institution.

9. A computer program product, characterized in that The computer program product includes a computer program, wherein when the computer program is run, the computer program product is controlled to execute the method for determining transaction interception rules according to any one of claims 1 to 7.

10. An electronic device, characterized in that: The invention comprises one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for determining transaction interception rules according to any one of claims 1 to 7.

Images