Risk event detection method and device, electronic equipment and program product

Abstract

The invention discloses a risk event detection method and device, electronic equipment and a program product, and relates to the technical field of artificial intelligence, and the detection method comprises the steps: obtaining transaction data of a target transaction event, carrying out the preprocessing of the transaction data, and obtaining the processed data; performing feature extraction on the processed data to obtain a target feature vector; fusing the first target feature vector and the second target feature vector to obtain a target fusion feature; and inputting the target fusion feature into a preset risk decision model to obtain a risk type of the target transaction event and a detection value of the target transaction event, and determining the target transaction event as a risk event when the detection value is greater than a preset threshold. According to the invention, the technical problem of low accuracy of transaction event detection in the prior art is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, in particular to a risk event detection method and device, electronic equipment and program product. BACKGROUND

[0002] Currently, the risk monitoring model of a financial institution is an expert rule model constructed according to structured transaction information data, the system of the financial institution and the experience of professional personnel. With the rapid development of artificial intelligence and machine learning technology, models based on XGBOOST (eXtreme Gradient Boosting, a distributed gradient boosting decision tree algorithm), decision tree and other machine learning and multi-layer neural network and other deep learning learn the relationship between risk and features by feature construction on transaction data, and then predict risk events.

[0003] However, the business handling and supervision of the financial institution are constantly innovating with the development of technology, for example, remote authorization, automatic printing, remote business handling, etc. The diversified development of the business also generates data in different forms, data structures and media. The current risk monitoring model mainly uses structured transaction data to discover risks, identify risks and warn risks, lacks the use of non-transaction detail data (such as audio data, video data of business handling, video data of monitoring video, and certificate image data) of the financial institution, and also lacks the use of risk screening personnel's analysis and evaluation opinions on the optimization of the model, resulting in the inability to effectively detect risk events.

[0004] At present, there is no effective solution to the above problems. SUMMARY

[0005] The embodiments of the present application provide a risk event detection method and device, electronic equipment and program product, to at least solve the technical problem of low accuracy in detecting transaction events in related technologies.

[0006] According to an aspect of an embodiment of the present application, a risk event detection method is provided, including: obtaining transaction data of a target transaction event, and preprocessing the transaction data to obtain processed data; performing feature extraction on the processed data to obtain a target feature vector, wherein the target feature vector at least includes a first target feature vector of structured data and a second target feature vector of unstructured data; fusing the first target feature vector and the second target feature vector to obtain a target fusion feature; inputting the target fusion feature into a preset risk decision model to obtain a risk type of the target transaction event and a detection value of the target transaction event, and determining the target transaction event as a risk event in a case where the detection value is greater than a preset threshold.

[0007] Further, before inputting the target fusion feature into the preset risk decision model to obtain the risk type of the target transaction event and the detection value of the target transaction event, the method further includes: collecting a plurality of historical transaction data sets of historical transaction events, wherein the historical transaction data sets at least include: structured data and unstructured data; and preprocessing the structured data and the unstructured data in each historical transaction data set to obtain a processed historical transaction data set.

[0008] Further, each historical transaction data in the processed historical transaction data set corresponds to a timestamp, and after preprocessing the structured data and the unstructured data in each historical transaction data set to obtain the processed historical transaction data set, the method further includes: performing feature extraction on each historical transaction data in the processed historical transaction data set to obtain a feature vector; for each historical transaction data set, adding each feature vector to a feature vector set based on the timestamp, and determining a fusion feature based on the feature vector set; and training a preset initial risk decision model using all fusion features to obtain the preset risk decision model.

[0009] Further, the unstructured data at least includes: video data, audio data, image data, and text data, and the step of performing feature extraction on each historical transaction data in the processed historical transaction data set to obtain a feature vector includes: performing feature extraction on the structured data using a preset feature extractor to obtain a feature vector of the structured data; and performing feature extraction on each preset data in the unstructured data to obtain a feature vector of each preset data, wherein the preset data is video data, audio data, image data, or text data.

[0010] Further, the step of performing feature extraction on each preset data in the unstructured data to obtain a feature vector of each preset data includes: performing feature extraction on the video data to obtain a video feature vector of the video data; performing feature extraction on the audio data to obtain an audio feature vector of the audio data; performing feature extraction on the image data to obtain an image feature vector of the image data; and performing feature extraction on the text data to obtain a text feature vector of the text data.

[0011] Further, the step of adding each feature vector to a feature vector set based on the timestamp and determining a fusion feature based on the feature vector set includes: for each feature vector set, sorting all feature vectors based on the timestamp to obtain a target feature vector set; and for each target feature vector set, splicing all feature vectors in the target feature vector set to obtain a fusion feature.

[0012] Further, after inputting the target fusion feature into the preset risk decision model to obtain the risk type of the target transaction event and the detection value of the target transaction event, the method further includes: obtaining a risk evaluation result of the target transaction event; and retraining the preset risk decision model based on the risk evaluation result to obtain a target risk decision model.

[0013] According to another aspect of the embodiments of the present application, a risk event detection device is also provided, which includes: a processing unit configured to obtain transaction data of a target transaction event and pre-process the transaction data to obtain processed data; an extraction unit configured to extract features from the processed data to obtain a target feature vector, wherein the target feature vector includes at least a first target feature vector of structured data and a second target feature vector of unstructured data; a fusion unit configured to fuse the first target feature vector and the second target feature vector to obtain a target fusion feature; and a determination unit configured to input the target fusion feature into a preset risk decision model to obtain a risk type of the target transaction event and a detection value of the target transaction event, and determine the target transaction event as a risk event if the detection value is greater than a preset threshold.

[0014] Further, the risk event detection device includes: a first acquisition module configured to acquire a plurality of historical transaction data sets of historical transaction events before inputting the target fusion feature into the preset risk decision model to obtain the risk type of the target transaction event and the detection value of the target transaction event, wherein each historical transaction data set includes at least structured data and unstructured data; and a first processing module configured to pre-process the structured data and the unstructured data in each historical transaction data set to obtain a processed historical transaction data set.

[0015] Further, each historical transaction data in the processed historical transaction data set corresponds to a timestamp, and the risk event detection device further includes: a first extraction module configured to extract features from each historical transaction data in the processed historical transaction data set to obtain a feature vector after pre-processing the structured data and the unstructured data in each historical transaction data set to obtain the processed historical transaction data set; a first determination module configured to add each feature vector to a feature vector set based on the timestamp for each historical transaction data set, and determine a fusion feature based on the feature vector set; and a first training module configured to train a preset initial risk decision model using all fusion features to obtain a preset risk decision model.

[0016] Further, the unstructured data at least includes: video data, audio data, image data, and text data; the first extraction module includes: a first extraction submodule, configured to extract features of the structured data by using a preset feature extractor to obtain a feature vector of the structured data; and a second extraction submodule, configured to extract features of each preset data in the unstructured data respectively to obtain a feature vector of each preset data, wherein the preset data is video data, audio data, image data, or text data.

[0017] Further, the second extraction submodule includes: a third extraction submodule, configured to extract features of the video data to obtain a video feature vector of the video data; a fourth extraction submodule, configured to extract features of the audio data to obtain an audio feature vector of the audio data; a fifth extraction submodule, configured to extract features of the image data to obtain an image feature vector of the image data; and a sixth extraction submodule, configured to extract features of the text data to obtain a text feature vector of the text data.

[0018] Further, the first determination module includes: a first sorting module, configured to sort all feature vectors based on a time stamp to obtain a target feature vector set for each feature vector set; and a first splicing module, configured to splice all feature vectors in the target feature vector set to obtain a fusion feature for each target feature vector set.

[0019] Further, the risk event detection apparatus further includes: a first acquisition module, configured to acquire a risk assessment result of the target transaction event after inputting the target fusion feature into the preset risk decision model to obtain a risk type of the target transaction event and a detection value of the target transaction event; and a second training module, configured to retrain the preset risk decision model based on the risk assessment result to obtain a target risk decision model.

[0020] According to another aspect of the embodiments of the present application, a computer program product is provided, including a non-volatile computer readable storage medium, the non-volatile computer readable storage medium storing a computer program, the computer program being executed by a processor to implement any of the above risk event detection methods.

[0021] According to another aspect of the embodiments of the present application, an electronic device is provided, including one or more processors and a memory, the memory being configured to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any of the above risk event detection methods.

[0022] In the present application, the transaction data of the target transaction event is acquired, and the transaction data is preprocessed to obtain processed data, the processed data is feature extracted to obtain a target feature vector, the first target feature vector and the second target feature vector are fused to obtain a target fusion feature, the target fusion feature is input into a preset risk decision model to obtain a risk type of the target transaction event and a detection value of the target transaction event, and in a case where the detection value is greater than a preset threshold, the target transaction event is determined as a risk event, thereby solving the technical problem of low accuracy in detecting transaction events in the related art.

[0023] In the present application, the transaction data of the target transaction event is acquired, and the transaction data is preprocessed to obtain processed data, the processed data is feature extracted to obtain a target feature vector, the first target feature vector and the second target feature vector are fused to obtain a target fusion feature, the target fusion feature is input into a preset risk decision model to obtain a risk type of the target transaction event and a detection value of the target transaction event, and in a case where the detection value is greater than a preset threshold, the target transaction event is determined as a risk event, thereby solving the technical problem of low accuracy in detecting transaction events in the related art. BRIEF DESCRIPTION OF DRAWINGS

[0024] The accompanying drawings, which are included to provide a further understanding of the present application, form a part of the present application and illustrate the illustrative embodiments of the present application and together with the description serve to explain the present application. In the drawings:

[0025] Figure 1 A hardware structure block diagram of a computer terminal (or a mobile device) for implementing the detection method of the risk event is shown;

[0026] Figure 2 is a flowchart of the detection method of the risk event according to Embodiment 1 of the present application;

[0027] Figure 3 is a flowchart of an optional detection method of the risk event according to the present application;

[0028] Figure 4 is a structure diagram of an optional multi-source data fusion risk identification system according to the present application;

[0029] Figure 5 is a schematic diagram of an optional detection device of the risk event according to the present application;

[0030] Figure 6 is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the personnel in the technical field better understand the present application scheme, the technical scheme in the embodiment of the present application will be described clearly and completely in the following combined with the drawings in the embodiment of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by the person skilled in the art without creative labor should belong to the scope of protection of the present application.

[0032] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0033] It should be noted that the information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) collected and related by the present application are all information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards in relevant regions, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal. For example, the system and related users or agencies are provided with an interface, and before obtaining the relevant information, the interface needs to send a request to the aforementioned user or agency, and after receiving the consent information feedback from the aforementioned user or agency, the relevant information is obtained.

[0034] In the present invention, unlike a single data source and expert rule model, various forms of structured data (such as transaction details, business information, etc.) and unstructured data (audio, video, voucher information, etc. during the processing) and risk event verification and assessment data of financial institutions during business processing are integrated, and transaction feature data is processed from them. Feature extraction is performed through different risk identification expert sub-models respectively, and the extraction results of each risk identification expert sub-model are integrated and input into the pre-trained model for prediction to obtain risk events and issue early warnings. At the same time, the assessment conclusions of the risk events after review by professional risk monitoring personnel such as joint investigation, appeal, assessment, and quality monitoring are analyzed and identified, so as to achieve targeted adjustment of the feature weights of the model and further achieve continuous self-optimization of the model.

[0035] The present invention will be described in detail below with reference to various embodiments.

[0036] Example 1

[0037] According to an embodiment of the present application, an embodiment of a method for detecting a risk event is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0038] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a risk event detection method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more ( Figure 1 102a, 102b, ..., 102n are used to illustrate) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera, wherein the network interface may be connected to a wired and / or wireless network. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components than shown, or with Figure 1different configurations are shown.

[0039] It should be noted that the one or more processors 102 and / or other data processing circuitry described above can be generally referred to herein as "data processing circuitry". The data processing circuitry can be embodied in whole or in part as software, hardware, firmware, or any combination thereof. In addition, the data processing circuitry can be a single standalone processing module, or incorporated in whole or in part within any of the other elements of the computer terminal 10 (or mobile device). As referred to in embodiments of the present application, the data processing circuitry functions as a processor to control, for example, the selection of the variable resistance terminal path connected to the interface.

[0040] The memory 104 can be used to store software programs of application software and modules, such as program instructions / data storage means corresponding to the risk event detection method in embodiments of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, i.e. implements the risk event detection method described above. The memory 104 can include a high-speed random access memory, and can further include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include a memory remotely arranged with respect to the processor 102, which can be connected to the computer terminal 10 through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0041] The transmission device 106 is used to receive or send data via a network. Specific examples of the network can include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet in a wireless manner.

[0042] The display can be, for example, a touch screen type liquid crystal display (LCD), which can enable a user to interact with the user interface of the computer terminal 10 (or mobile device).

[0043] In the above operating environment, the present application provides a risk event detection method as shown in Figure 2 Figure 2 is a flowchart of the risk event detection method according to Embodiment 1 of the present application, as shown in Figure 2 ​​

[0044] Step S201, obtaining transaction data of a target transaction event, and preprocessing the transaction data to obtain processed data.

[0045] In the embodiment of the present application, by obtaining the transaction data (including structured transaction details and business information, and unstructured audio, video, image and natural language description, etc.) of the target transaction event (such as a transfer transaction or a loan application), and preprocessing the transaction data (such as null value filling, normalization, standardization, etc., and for unstructured data, video data frame extraction, audio data sampling, etc. can also be included), the processed data is obtained.

[0046] Step S202, performing feature extraction on the processed data to obtain a target feature vector, wherein the target feature vector at least includes a first target feature vector of structured data and a second target feature vector of unstructured data.

[0047] In the embodiment of the present application, key features can be extracted from the preprocessed data, and different feature extractors (such as deep learning network, image recognition technology, natural language processing technology, etc.) are used to extract features for different types (such as video, image, audio, text, etc.) of transaction data to obtain a target feature vector, wherein the target feature vector at least includes a first target feature vector and a second target feature vector, the first target feature vector refers to the feature vector of structured data, and the second target feature vector refers to the feature vector of unstructured data.

[0048] Optionally, not all customers have both structured and unstructured data, for example, in the case of only collecting unstructured data of a customer, a classifier can be added after the feature extractor to output a classification result (i.e. identify a risk event), different classifiers can be set for different feature extractors, and different weights can be set for different classification results to obtain a final classification result.

[0049] Step S203, fusing the first target feature vector and the second target feature vector to obtain a target fusion feature.

[0050] In the embodiment of the present application, feature alignment (such as timestamp alignment) can be used to match information from different sources on the time axis, and then the feature vector of structured data and the feature vector of unstructured data are combined by time sequence splicing or weighted average fusion method to obtain the target fusion feature, which increases the understanding ability of the model to complex business scenarios and helps to improve the accuracy of risk identification.

[0051] In step S204, the target fusion feature is input into a preset risk decision model to obtain a risk type of the target transaction event and a detection value of the target transaction event, and in a case where the detection value is greater than a preset threshold, the target transaction event is determined as a risk event.

[0052] In the embodiment of the application, the target fusion feature is input into a preset risk decision model (such as a Transformer (a deep learning model based on a multi-head attention mechanism)) to obtain a risk type (such as a business handling compliance risk, a customer information security risk, a rule violation customer operation risk, etc.) of the target transaction event and a detection value of the target transaction event, and when the detection value exceeds a preset threshold (a value greater than or equal to 0 and less than or equal to 1 set in advance, which can be set by the user), it can be determined that the target transaction event is at risk.

[0053] Figure 3 is an optional flowchart for detecting a risk event according to an embodiment of the application, as shown in Figure 3 Data input (different types of data (such as unstructured data, structured data) can be input) is performed first, different types of data are preprocessed to obtain processed data, and the processed data is placed in mutually disjoint feature extractors for feature extraction to obtain feature vectors. Then, according to the time stamp, the different types of data are aligned and fused to obtain fusion features, and the fusion features are input into a preset risk decision model for risk decision.

[0054] In summary, by fusing the rich multi-source data in the financial institution, including structured transaction details and business information, unstructured audio, video, image and natural language description, the correlation between different data types is mined. First, for structured and unstructured data, deep learning technology is used for preprocessing and feature extraction to generate first and second target feature vectors. Then, through feature alignment and hybrid fusion strategy, these feature vectors are integrated into comprehensive target fusion features. After that, the target fusion features are input into a preset risk decision model to output the risk type and detection value of the transaction event. When the detection value exceeds the preset threshold, the transaction event can be accurately determined as a risk event, greatly improving the risk early warning and identification capability of the financial institution in business handling, customer safety and operation compliance, realizing the intelligentization and comprehensiveness of risk monitoring, and further solving the technical problem of low accuracy in detecting transaction events in related technologies.

[0055] In order to accurately obtain the processed historical transaction data set, in the risk event detection method provided in Embodiment 1 of the present application, a plurality of historical transaction data sets of historical transaction events are collected, wherein the historical transaction data set at least includes structured data and unstructured data; the structured data and the unstructured data in each historical transaction data set are preprocessed to obtain a processed historical transaction data set.

[0056] In the embodiment of the present application, a plurality of historical transaction data sets of historical transaction events are collected (including structured data (transaction details, etc.) and unstructured data (audio and video, certificate image, complaint materials, etc.)), and the structured data and the unstructured data in each historical transaction data set are preprocessed to obtain a processed historical transaction data set. For example, the input audio data is filtered by a filter to filter noise and unified sampling rate, the video data is fixed at a number of image frames per second by frame extraction, and the video resolution is unified, the textual description data is processed by a pre-trained bert (Bidirectional Encoder Representations from Transformers, a language model) model to abstract summary information, the description of the risk event is realized, the structured transaction data is processed by null padding, normalization, standardization, etc., and the discrete category data is encoded in one-hot (used to convert discrete category data into binary form) form, etc.

[0057] Each historical transaction data in the processed historical transaction data set corresponds to a timestamp. In order to accurately obtain the preset risk decision model, in the risk event detection method provided in Embodiment 1 of the present application, feature extraction is performed on each historical transaction data in the processed historical transaction data set to obtain a feature vector; for each historical transaction data set, each feature vector is added to a feature vector set based on the timestamp, and a fusion feature is determined based on the feature vector set; all fusion features are used to train a preset initial risk decision model to obtain a preset risk decision model.

[0058] In the embodiment of the present application, feature extraction is performed on each historical transaction data in the processed historical transaction data set to obtain a feature vector (for example, for structured data, statistical and mathematical modeling methods are used to extract features, for unstructured data such as audio and video and images, deep learning models are used to extract features, and natural language descriptions are converted into semantic feature vectors by natural language processing technology).

[0059] In the embodiment of the present application, each historical transaction data in the processed historical transaction data set corresponds to a timestamp, which is used to accurately locate the time point at which each transaction data occurs. For each historical transaction data set, all extracted feature vectors can be integrated into a feature vector set according to the timestamp, and the fusion features can be determined according to the feature vector set, and all fusion features can be used to train the preset initial risk decision model to obtain the preset risk decision model. By embedding the timestamp in the historical transaction data, the time attribute of the data is ensured, and then the fusion features that can be used for model training are converted through feature extraction and integration, and finally an optimized preset risk decision model is obtained through iterative training.

[0060] The unstructured data at least includes video data, audio data, image data and text data. In the risk event detection method provided in Embodiment 1 of the present application, a preset feature extractor is used to extract features of the structured data to obtain feature vectors of the structured data; and each preset data in the unstructured data is subjected to feature extraction respectively to obtain feature vectors of each preset data, wherein the preset data is video data, audio data, image data or text data.

[0061] Optionally, the unstructured data at least includes video data, audio data, image data and text data.

[0062] In the embodiment of the present application, the feature extraction target is to convert data information into feature vectors, which is a format that can be understood and processed by a machine learning algorithm. For structured data, a preset feature extractor can be used to extract features of the structured data to obtain feature vectors of the structured data. The preset feature extractor can be an algorithm or model customized according to specific needs of financial institutions, including but not limited to statistical analysis, logistic regression, decision tree or XGBoost, etc. For each preset data (video, audio, image, text), different deep learning models (such as convolutional neural network, recurrent neural network, natural language processing, etc.) can be used for feature extraction to obtain feature vectors of each preset data.

[0063] In order to improve the accuracy of the obtained feature vectors, in the risk event detection method provided in Embodiment 1 of the present application, the video data is subjected to feature extraction to obtain video feature vectors of the video data; the audio data is subjected to feature extraction to obtain audio feature vectors of the audio data; the image data is subjected to feature extraction to obtain image feature vectors of the image data; and the text data is subjected to feature extraction to obtain text feature vectors of the text data.

[0064] In the embodiments of the present application, the video data can identify the behavior patterns and abnormal actions in the video by using the convolutional neural network, output the video risk behavior feature vector, the audio data can analyze the dialogue content by using the recurrent neural network or the specific speech recognition model, identify the potential violation operation, output the audio risk behavior feature vector, the image data (such as the certificate image) can use the image recognition technology such as the optical character recognition and the deep learning model to extract the key information such as the signature, the seal, the text and the like, output the risk feature vector in the image, the text data (such as the statement material, the evaluation conclusion) can use the natural language processing technology to extract the semantic features, output the text feature vector describing the risk event, the video features reveal the behavior patterns of the operators, the audio features capture the abnormal signals in the communication, the image features verify the validity of the transaction credentials, and the text features provide the semantic understanding of the business background and the evaluation conclusion, and by fusing the above-mentioned unstructured features and the structured features, it is ensured that the model can understand the transaction scene from multiple angles and multiple levels, and the comprehensiveness and the accuracy of the risk identification are improved.

[0065] In order to accurately obtain the fusion feature, in the risk event detection method provided in Embodiment 1 of the present application, for each feature vector set, all the feature vectors are sorted based on the time stamp to obtain a target feature vector set; for each target feature vector set, all the feature vectors in the target feature vector set are spliced to obtain a fusion feature.

[0066] In the embodiments of the present application, for each feature vector set, all the feature vectors therein can be sorted according to the time stamp, the time stamp is a key attribute attached to each transaction event feature vector in the feature extraction stage, which ensures that the feature vectors of the video, audio, image and text data can be accurately corresponded to the specific transaction time point in chronological order, so that the features of various sources can be aligned in the time dimension, for example, the feature vectors in the feature vector set are sorted in ascending or descending order of the time stamp to generate a target feature vector set. This set ensures the time consistency of all the feature vectors in each feature vector set, and lays a foundation for the fusion of cross-type data.

[0067] In the embodiments of the present application, for each target feature vector set, all the feature vectors therein can be spliced to generate a fusion feature, for example, the feature vectors in the target feature vector set are linked together in a predetermined order (such as the order of the feature vectors of the structured data, the video feature vectors, the audio feature vectors, the image feature vectors and the text feature vectors) to obtain the fusion feature.

[0068] Figure 4 is a structural diagram of an optional multi-source data fusion risk identification system according to the embodiments of the present application, such as Figure 4As shown, the risk identification system comprises a data processing module, a risk feature identification module, and a risk decision module. The data processing module comprises a structured data processing module, a video data processing module, an audio data processing module, an image data processing module, and a natural language data processing module. The risk feature identification module comprises a transaction risk identification module, a video risk identification module, an audio risk identification module, an image data identification module, and a natural language analysis module.

[0069] As shown, Figure 4 The structured data processing module preprocesses the input and output of structured transaction detail data and business information data. The video data processing module preprocesses the input and output of video files and other data related to business handling. The audio data processing module preprocesses the input and output of audio files and other data related to business handling. The image data processing module preprocesses the input and output of static picture images and other data related to business handling. The natural language data processing module preprocesses the input and output of text description, feedback materials, and evaluation conclusions. The transaction risk identification module uses a deep learning mode to mine risk features from structured transaction data, output risk event features, and risk identification under a single data source. The video risk identification module uses a deep learning mode to extract video data, identify risk behavior features in the video, and output video risk event features and risk identification under a single data source. The audio risk identification module uses a deep learning mode to extract audio data, identify risk behavior features in the audio, and output audio risk event features and risk identification under a single data source. The image data identification module uses image recognition technology to extract text information, expressions, and facial features from static picture images, and output image risk event features and risk identification under a single data source. The natural language analysis module uses a deep learning mode to extract features of descriptive materials related to transaction events and risk events. The risk decision module fuses the received risk event features and outputs the type and probability of risk.

[0070] To accurately obtain a target risk decision model, in the risk event detection method provided in Embodiment 1 of the present application, a risk assessment result for a target transaction event is obtained. Based on the risk assessment result, a preset risk decision model is retrained to obtain a target risk decision model.

[0071] In the embodiment of the present application, after the preliminary prediction of the model, that is, the risk decision model issues a warning for a certain transaction event, further investigation, review and confirmation will be carried out by the risk management personnel or professional team of the financial institution to comprehensively evaluate whether the transaction event exists real operational risk, and finally obtain a risk assessment result, which can be a quantitative score of risk level, a classification result of risk type, etc. If there is a large difference between the risk assessment result and the preliminary prediction result of the model, the risk assessment result together with the related feature vector set can be used as the training data of the model to retrain the preset risk decision model to obtain the target risk decision model, so that the parameters and weights of the model can be adjusted based on the risk assessment result, and the model can be corrected and optimized.

[0072] The risk event detection method provided by the embodiment of the present application can realize comprehensive intelligent identification and self-adaptive optimization of operational risk by fusing multi-source features of structured data and unstructured data. First, feature extraction is performed on structured data, video, audio, image and text data to respectively generate feature vectors of structured data, video feature vectors, audio feature vectors, image feature vectors and text feature vectors, and all feature vectors are sorted and spliced according to time stamps to form fusion features, thereby enriching the information dimension of risk identification. Then, the initial risk decision model is trained by using the fusion features to obtain the preset risk decision model. When the model makes a risk warning for a target transaction event, the risk assessment result of the professional personnel is collected to feedback the model for retraining, thereby continuously improving the identification accuracy and self-learning ability of the model.

[0073] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0074] Embodiment 2

[0075] The embodiment of the present application also provides a risk event detection device. It should be noted that the risk event detection device of the embodiment of the present application can be used to execute the risk event detection method provided by the embodiment of the present application. The risk event detection device provided by the embodiment of the present application is introduced as follows.

[0076] According to the embodiment of the present application, a device for implementing the above-mentioned risk event detection method is also provided. Figure 5 is a schematic diagram of an optional risk event detection device according to the embodiment of the present application, as shown in Figure 5 The risk event detection device can include a processing unit 50, an extraction unit 51, a fusion unit 52 and a determination unit 53.

[0077] The processing unit 50 is configured to acquire transaction data of a target transaction event, and pre-process the transaction data to obtain processed data.

[0078] The extraction unit 51 is configured to extract features from the processed data to obtain a target feature vector, wherein the target feature vector at least includes a first target feature vector of structured data and a second target feature vector of unstructured data.

[0079] The fusion unit 52 is configured to fuse the first target feature vector and the second target feature vector to obtain a target fusion feature.

[0080] The determination unit 53 is configured to input the target fusion feature into a preset risk decision model to obtain a risk type of the target transaction event and a detection value of the target transaction event, and determine the target transaction event as a risk event when the detection value is greater than a preset threshold.

[0081] The risk event detection device provided by the embodiments of the present application can acquire transaction data of a target transaction event through the processing unit 50, pre-process the transaction data to obtain processed data, extract features from the processed data through the extraction unit 51 to obtain a target feature vector, fuse the first target feature vector and the second target feature vector through the fusion unit 52 to obtain a target fusion feature, input the target fusion feature into a preset risk decision model through the determination unit 53 to obtain a risk type of the target transaction event and a detection value of the target transaction event, and determine the target transaction event as a risk event when the detection value is greater than a preset threshold.

[0082] Optionally, the risk event detection device comprises a first acquisition module configured to acquire a historical transaction data set of a plurality of historical transaction events before inputting the target fusion feature into a preset risk decision model to obtain a risk type of the target transaction event and a detection value of the target transaction event, wherein the historical transaction data set at least includes structured data and unstructured data; and a first processing module configured to pre-process the structured data and the unstructured data in each historical transaction data set to obtain a processed historical transaction data set.

[0083] Optionally, each historical transaction data in the set of processed historical transaction data corresponds to a timestamp, and the risk event detection device further comprises: a first extraction module, configured to, after obtaining the set of processed historical transaction data by preprocessing the structured data and the unstructured data in each set of historical transaction data, perform feature extraction on each historical transaction data in the set of processed historical transaction data respectively to obtain a feature vector; a first determination module, configured to, for each set of historical transaction data, add each feature vector to a set of feature vectors based on the timestamp, and determine a fusion feature based on the set of feature vectors; and a first training module, configured to train a preset initial risk decision model using all fusion features to obtain a preset risk decision model.

[0084] Optionally, the unstructured data at least includes: video data, audio data, image data, and text data, and the first extraction module comprises: a first extraction submodule, configured to perform feature extraction on the structured data using a preset feature extractor to obtain a feature vector of the structured data; and a second extraction submodule, configured to perform feature extraction on each preset data in the unstructured data respectively to obtain a feature vector of each preset data, wherein the preset data is video data, audio data, image data, or text data.

[0085] Optionally, the second extraction submodule comprises: a third extraction submodule, configured to perform feature extraction on the video data to obtain a video feature vector of the video data; a fourth extraction submodule, configured to perform feature extraction on the audio data to obtain an audio feature vector of the audio data; a fifth extraction submodule, configured to perform feature extraction on the image data to obtain an image feature vector of the image data; and a sixth extraction submodule, configured to perform feature extraction on the text data to obtain a text feature vector of the text data.

[0086] Optionally, the first determination module comprises: a first sorting module, configured to, for each set of feature vectors, sort all feature vectors based on the timestamp to obtain a target set of feature vectors; and a first splicing module, configured to, for each target set of feature vectors, splice all feature vectors in the target set of feature vectors to obtain a fusion feature.

[0087] Optionally, the risk event detection device further comprises: a first acquisition module, configured to, after inputting the target fusion feature into the preset risk decision model to obtain a risk type of a target transaction event and a detection value of the target transaction event, acquire a risk assessment result of the target transaction event; and a second training module, configured to retrain the preset risk decision model based on the risk assessment result to obtain a target risk decision model.

[0088] The risk event detection apparatus can further include a processor and a memory, and the processing unit 50, the extraction unit 51, the fusion unit 52, and the determination unit 53 are stored in the memory as program units, and the corresponding functions are realized by the processor executing the program units stored in the memory.

[0089] The processor includes a core, and the core calls the corresponding program units in the memory. The core can be one or more, and the target fusion feature is input into the preset risk decision model by adjusting the core parameters to obtain the risk type of the target transaction event and the detection value of the target transaction event. In the case where the detection value is greater than the preset threshold, the target transaction event is determined as a risk event.

[0090] The memory can include a non-permanent memory in a computer readable medium, a random access memory (RAM), and / or a non-volatile memory such as a read-only memory (ROM) or a flash memory (flash RAM), and the memory includes at least one memory chip.

[0091] It should be noted that the processing unit 50, the extraction unit 51, the fusion unit 52, and the determination unit 53 correspond to steps S201 to S204 in Embodiment 1, and the units and the corresponding steps have the same examples and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the units can be hardware components or software components stored in the memory (for example, the memory 104) and processed by one or more processors (for example, the processors 102a, 102b, …, 102n), and the units can also be a part of the apparatus and can run in the computer terminal 10 provided in Embodiment 1.

[0092] Embodiment 3

[0093] Embodiments of the present application can provide a computer terminal, which can be any one of the computer terminal devices in the computer terminal group. Alternatively, in the present embodiment, the computer terminal can be replaced by a mobile terminal or an electronic device or the like.

[0094] Alternatively, in the present embodiment, the computer terminal can be located in at least one of the network devices in the computer network.

[0095] In the embodiment, the computer terminal can execute program codes of the following steps in the risk event detection method: obtaining transaction data of a target transaction event, and preprocessing the transaction data to obtain processed data; performing feature extraction on the processed data to obtain a target feature vector, wherein the target feature vector at least includes a first target feature vector of structured data and a second target feature vector of unstructured data; fusing the first target feature vector and the second target feature vector to obtain a target fusion feature; inputting the target fusion feature into a preset risk decision model to obtain a risk type of the target transaction event and a detection value of the target transaction event, and determining the target transaction event as a risk event when the detection value is greater than a preset threshold.

[0096] Optionally, the computer terminal can execute program codes of the following steps in the risk event detection method: collecting a plurality of historical transaction data sets of historical transaction events, wherein the historical transaction data sets at least include structured data and unstructured data; preprocessing the structured data and the unstructured data in each historical transaction data set to obtain processed historical transaction data sets.

[0097] Optionally, the computer terminal can execute program codes of the following steps in the risk event detection method: performing feature extraction on each historical transaction data in the processed historical transaction data set to obtain a feature vector; for each historical transaction data set, adding each feature vector to a feature vector set based on a timestamp, and determining a fusion feature based on the feature vector set; and training a preset initial risk decision model using all fusion features to obtain a preset risk decision model.

[0098] Optionally, the computer terminal can execute program codes of the following steps in the risk event detection method: performing feature extraction on the structured data using a preset feature extractor to obtain a feature vector of the structured data; and performing feature extraction on each preset data in the unstructured data to obtain a feature vector of each preset data, wherein the preset data is video data, audio data, image data, or text data.

[0099] Optionally, the computer terminal can execute program codes of the following steps in the risk event detection method: performing feature extraction on the video data to obtain a video feature vector of the video data; performing feature extraction on the audio data to obtain an audio feature vector of the audio data; performing feature extraction on the image data to obtain an image feature vector of the image data; and performing feature extraction on the text data to obtain a text feature vector of the text data.

[0100] Optionally, the computer terminal can execute program codes of the following steps in the risk event detection method: for each feature vector set, sorting all feature vectors based on timestamps to obtain a target feature vector set; for each target feature vector set, splicing all feature vectors in the target feature vector set to obtain a fusion feature.

[0101] Optionally, the computer terminal can execute program codes of the following steps in the risk event detection method: obtaining a risk assessment result of a target transaction event; and retraining a preset risk decision model based on the risk assessment result to obtain a target risk decision model.

[0102] Optionally, Figure 6 is a structural block diagram of an electronic device according to an embodiment of the present application. As shown in Figure 6 , the electronic device can include one or more (only one is shown in the figure) processors 602, a memory 604, a storage controller, and a peripheral interface, wherein the peripheral interface is connected with a radio frequency module, an audio module, and a display. Figure 6

[0103] The memory can be used to store software programs and modules, such as program instructions / modules corresponding to the risk event detection method and device in the embodiments of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, implements the risk event detection method described above. The memory can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory can further include a memory remotely arranged with respect to the processor, which can be connected to the terminal through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0104] The processor can call information and application programs stored in the memory through the transmission device to execute the above steps in the risk event detection method.

[0105] By adopting the embodiments of the present application, a scheme for detecting a risk event is provided. The structured data and unstructured data are fused, and their feature vectors are extracted. The fusion feature is obtained through feature alignment and feature splicing. The initial risk decision model is trained by using the fusion feature to obtain a preset risk decision model. The transaction event is detected by using the preset risk decision model to obtain a detection result. The detection result is compared with key information of the expert evaluation conclusion. The obtained model is retrained according to the expert evaluation conclusion to realize self-optimization of the model, thereby solving the technical problem of low accuracy in detecting a transaction event in the related art. ​

[0106] Those skilled in the art can understand that, Figure 6 The structure shown is only schematic, and the electronic device can also be a terminal device such as a smart phone, a tablet computer, a palm computer, a Mobile Internet Device (MID), and the like. Figure 6 It does not limit the structure of the electronic device described above. For example, the electronic device can further include more or less components (such as a network interface, a display device, and the like) than those shown in the figure, or have a different configuration from that shown in the figure. Figure 6 Figure 6

[0107] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the terminal device related hardware through a program, and the program can be stored in a computer readable storage medium, which can include a flash disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and the like.

[0108] Embodiment 4

[0109] The embodiments of the present application also provide a storage medium. Optionally, in the embodiment, the storage medium can be used to save the program code executed by the risk event detection method provided in Embodiment 1.

[0110] Optionally, in the embodiment, the storage medium can be located in any one of the computer terminals in the computer terminal group in the computer network, or in any one of the mobile terminals in the mobile terminal group.

[0111] The present application also provides a computer program product adapted to execute the steps of the risk event detection method when executed on a data processing device.

[0112] The above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0113] In the above embodiments of the present application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0114] ​​In several embodiments provided in the present application, it should be understood that the disclosed technology can be implemented by other ways. Among them, the above-described device embodiments are only schematic, for example, the division of units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, units or modules, and can be electrical or other forms.

[0115] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e. they can be located in one place or distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0116] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present alone, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0117] If the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The aforementioned storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0118] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. A method for detecting risk events, characterized in that: include: Acquiring transaction data of a target transaction event and preprocessing the transaction data to obtain processed data; Performing feature extraction on the processed data to obtain a target feature vector, wherein the target feature vector includes at least: a first target feature vector of the structured data and a second target feature vector of the unstructured data; fusing the first target feature vector and the second target feature vector to obtain a target fusion feature; The target fusion feature is input into a preset risk decision model to obtain the risk type of the target transaction event and the detection value of the target transaction event. When the detection value is greater than a preset threshold, the target transaction event is determined to be a risk event.

2. The method for detecting risk events according to claim 1, characterized in that: Before inputting the target fusion feature into a preset risk decision model to obtain the risk type of the target transaction event and the detection value of the target transaction event, the method includes: Collecting a historical transaction data set of multiple historical transaction events, wherein the historical transaction data set includes at least: structured data and unstructured data; The structured data and the unstructured data in each of the historical transaction data sets are preprocessed to obtain a processed historical transaction data set.

3. The method for detecting risk events according to claim 2, characterized in that: Each historical transaction data in the processed historical transaction data set corresponds to a timestamp. After preprocessing the structured data and the unstructured data in each historical transaction data set to obtain the processed historical transaction data set, the method further includes: Performing feature extraction on each piece of the historical transaction data in the processed historical transaction data set to obtain a feature vector; For each of the historical transaction data sets, adding each of the feature vectors to a feature vector set based on the timestamp, and determining a fusion feature based on the feature vector set; All the fusion features are used to train a preset initial risk decision model to obtain the preset risk decision model.

4. The method for detecting risk events according to claim 3, characterized in that: The unstructured data includes at least video data, audio data, image data, and text data. The step of performing feature extraction on each piece of the processed historical transaction data set to obtain a feature vector includes: Using a preset feature extractor to perform feature extraction on the structured data to obtain a feature vector of the structured data; Feature extraction is performed on each preset data in the unstructured data to obtain a feature vector of each preset data, wherein the preset data is the video data, the audio data, the image data or the text data.

5. The method for detecting risk events according to claim 4, characterized in that: The step of performing feature extraction on each preset data in the unstructured data to obtain a feature vector of each preset data includes: Performing feature extraction on the video data to obtain a video feature vector of the video data; Performing feature extraction on the audio data to obtain an audio feature vector of the audio data; Performing feature extraction on the image data to obtain an image feature vector of the image data; Feature extraction is performed on the text data to obtain a text feature vector of the text data.

6. The method for detecting risk events according to claim 3, characterized in that: The step of adding each of the feature vectors to a feature vector set based on the timestamp, and determining a fusion feature based on the feature vector set includes: For each of the feature vector sets, sorting all the feature vectors based on the timestamp to obtain a target feature vector set; For each target feature vector set, all the feature vectors in the target feature vector set are concatenated to obtain the fused feature.

7. The method for detecting risk events according to claim 1, characterized in that: After inputting the target fusion feature into a preset risk decision model to obtain the risk type of the target transaction event and the detection value of the target transaction event, the method further includes: Obtaining risk assessment results for the target transaction event; Based on the risk assessment results, the preset risk decision model is retrained to obtain a target risk decision model.

8. A risk event detection device, characterized in that: include: a processing unit, configured to obtain transaction data of a target transaction event and pre-process the transaction data to obtain processed data; an extraction unit, configured to perform feature extraction on the processed data to obtain a target feature vector, wherein the target feature vector includes at least: a first target feature vector of the structured data and a second target feature vector of the unstructured data; a fusion unit, configured to fuse the first target feature vector and the second target feature vector to obtain a target fusion feature; A determination unit is used to input the target fusion feature into a preset risk decision model to obtain the risk type of the target transaction event and the detection value of the target transaction event. When the detection value is greater than a preset threshold, the target transaction event is determined to be a risk event.

9. A computer program product, characterized in that The invention comprises a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for detecting a risk event according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: It includes one or more processors and a memory, the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the risk event detection method described in any one of claims 1 to 7.

Images