Resource transfer risk prediction method and device, storage medium and electronic equipment

Abstract

The invention discloses a resource transfer risk prediction method and device, a storage medium and electronic equipment. Relates to the field of cloud computing, and the method comprises the steps: obtaining resource transfer data in real time, combining a time-related initial risk threshold value and a place-related regional transfer style feature, dynamically adjusting initial risk early warning, obtaining a target risk threshold value, and carrying out transfer risk early warning under the condition that the predicted risk threshold value is greater than the target risk threshold value. The timeliness and accuracy of resource transfer risk prediction are improved, the problem of insufficient early warning or excessive early warning caused by improper setting of a fixed threshold value is avoided, efficient early warning of the resource transfer risk is achieved, the risk that resources are transferred due to the fact that a resource transfer medium of a user is not authorized is reduced, and the user experience is improved. The overall efficiency of monitoring the abnormal behavior of the resource transfer medium is improved, and the problems of low timeliness and low precision of a machine learning model in an abnormal behavior monitoring scene of the resource transfer medium caused by improper setting of a dichotomy threshold in related technologies are solved.

Description

Technical Field

[0001] This application relates to the field of cloud computing, and more specifically, to a method and apparatus for predicting resource transfer risks, a storage medium, and an electronic device. Background Technology

[0002] With the development of machine learning, there are already many instances of using machine learning models to monitor abnormal behavior of resource transfer media. Most of these use algorithms such as logistic regression and random forest to perform binary classification of data. However, binary classification supervised learning scenarios often have the problem of not being able to determine the threshold well. Setting the threshold too high will result in the inability to identify some unauthorized resource transfer scenarios, while setting the threshold too low will result in normal resource transfer scenarios being misjudged. In addition, such algorithms are also less timely.

[0003] There is currently no effective solution to the problem that machine learning models have low timeliness and low accuracy in monitoring abnormal behavior of resource transfer media due to improper setting of binary classification thresholds in related technologies. Summary of the Invention

[0004] The main objective of this application is to provide a method, apparatus, storage medium, and electronic device for predicting resource transfer risks, in order to solve the problem that machine learning models have low timeliness and low accuracy in monitoring abnormal behavior of resource transfer media due to improper setting of binary classification thresholds in related technologies.

[0005] To achieve the above objectives, according to one aspect of this application, a method for predicting resource transfer risks is provided. The method includes: acquiring current resource transfer data; inputting the current resource transfer data into a pre-constructed prediction model to obtain a predicted risk value corresponding to the current resource transfer data; the current resource transfer data indicating the current resource transfer time and location, wherein the current resource transfer time is the expected transfer time of the resource to be transferred, and the current resource transfer location is the expected transfer location of the resource to be transferred; determining an initial risk threshold corresponding to the current resource transfer time; determining regional transfer style characteristics corresponding to the current resource transfer location; and adjusting the initial risk threshold according to the regional transfer style characteristics to obtain a target risk threshold corresponding to the current resource transfer data; and issuing a transfer risk warning for the resource to be transferred if the predicted risk value is greater than the target risk threshold.

[0006] To achieve the above objectives, according to another aspect of this application, a resource transfer risk prediction device is provided. The device includes: a first execution unit, configured to acquire current resource transfer data, input the current resource transfer data into a pre-constructed prediction model, and obtain a predicted risk value corresponding to the current resource transfer data; the current resource transfer data indicates the current resource transfer time and the current resource transfer location, wherein the current resource transfer time is the expected transfer time of the resource to be transferred, and the current resource transfer location is the expected transfer location of the resource to be transferred; a second execution unit, configured to determine an initial risk threshold corresponding to the current resource transfer time, determine regional transfer style characteristics corresponding to the current resource transfer location, and adjust the initial risk threshold according to the regional transfer style characteristics to obtain a target risk threshold corresponding to the current resource transfer data; and a third execution unit, configured to provide a transfer risk warning for the resource to be transferred when the predicted risk value is greater than the target risk threshold.

[0007] In this embodiment, by acquiring resource transfer data in real time and combining it with time-related initial risk thresholds and location-related regional transfer style characteristics, the initial risk warning can be dynamically adjusted to obtain the target risk threshold. When the predicted risk threshold is greater than the target risk threshold, a transfer risk warning is issued, which significantly improves the timeliness and accuracy of resource transfer risk prediction. This avoids the problem of insufficient or excessive warnings caused by improper setting of fixed thresholds, reduces misjudgments, and achieves efficient warning of resource transfer risks. It also reduces the risk of unauthorized transfer of resources by users' resource transfer media, improves the overall effectiveness of monitoring abnormal behavior of resource transfer media, and solves the problem of low timeliness and low accuracy of machine learning models in abnormal behavior monitoring scenarios of resource transfer media caused by improper setting of binary classification thresholds in related technologies. Attached Figure Description

[0008] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0009] Figure 1 This is a hardware structure block diagram of a computer terminal for an optional resource transfer risk prediction method provided in an embodiment of this application.

[0010] Figure 2 This is a flowchart illustrating an optional resource transfer risk prediction method provided according to an embodiment of this application.

[0011] Figure 3 This is a schematic diagram of model training for an optional resource transfer risk prediction according to an embodiment of this application.

[0012] Figure 4 This is a model prediction diagram of an optional resource transfer risk prediction method provided according to an embodiment of this application.

[0013] Figure 5 This is a structural block diagram of an optional resource transfer risk prediction device according to an embodiment of this application.

[0014] Figure 6 This is a structural block diagram of an optional electronic device according to an embodiment of this application. Detailed Implementation

[0015] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0016] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0017] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0018] According to an embodiment of this application, an embodiment of a resource transfer risk prediction method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0019] The methods and embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 This is a hardware structure block diagram of a computer terminal for an optional resource transfer risk prediction method provided in an embodiment of this application. For example... Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0020] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0021] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the resource transfer risk prediction method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the resource transfer risk prediction method described above. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some embodiments, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0022] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one embodiment, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another embodiment, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0023] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0024] Under the aforementioned operating environment, this application provides the following: Figure 2 The resource transfer risk prediction method shown. Figure 2 This is a flowchart illustrating an optional resource transfer risk prediction method according to an embodiment of this application. Figure 2 As shown, the process of this method may include steps S202 to S206.

[0025] Step S202: Obtain current resource transfer data and input the current resource transfer data into the pre-built prediction model to obtain the predicted risk value corresponding to the current resource transfer data; the current resource transfer data is used to indicate the current resource transfer time and the current resource transfer location, the current resource transfer time is the expected transfer time of the current resource to be transferred, and the current resource transfer location is the expected transfer location of the current resource to be transferred.

[0026] Step S204: Determine the initial risk threshold corresponding to the current resource transfer time, determine the regional transfer style characteristics corresponding to the current resource transfer location, and adjust the initial risk threshold according to the regional transfer style characteristics to obtain the target risk threshold corresponding to the current resource transfer data.

[0027] Step S206: If the predicted risk value is greater than the target risk threshold, issue a risk warning for the current resources to be transferred.

[0028] The resource transfer risk prediction method in this embodiment can be applied to the field of cloud computing, specifically to the scenario of monitoring abnormal behavior of resource transfer media. Here, the resource transfer media refers to a tool or platform used for resource transfer. The resource transfer media stores resource data, which is a collection of information describing the resource's status and its changes, including but not limited to resource ID, resource holder identity, resource change timestamps, resource location change records, and resource attribute descriptions. Resource data can be transferred from one resource transfer media to another; this transfer process is called resource transfer. In related technologies, methods for monitoring abnormal behavior of resource transfer media mainly rely on users (such as resource owners) taking measures such as issuing alarms after discovering resource loss, and then urgently freezing the resource transfer media to reduce the risk of further resource loss for the user. In real-life scenarios, users often do not discover unauthorized resource transfers in a short period, and there is a time lag between issuing an alarm and freezing the resource transfer media. Malicious attackers may conduct multiple unauthorized resource transfers within this time window, causing significant losses to the user. With the development of machine learning, there are now many instances of using machine learning models to monitor abnormal behavior of resource transfer media. Most of these use algorithms such as logistic regression and random forest to perform binary classification of data.

[0029] However, binary classification supervised learning scenarios often suffer from the problem of not being able to determine the threshold well. Setting the threshold too high will cause some unauthorized resource transfer scenarios to be unidentified, while setting the threshold too low will cause normal resource transfer scenarios to be misjudged. In addition, such algorithms are also less timely. Therefore, there is currently no effective solution to the problem of low timeliness and low accuracy of machine learning models in the abnormal behavior monitoring scenario of resource transfer media caused by improper binary classification threshold setting.

[0030] In this embodiment, by acquiring resource transfer data in real time and combining it with time-related initial risk thresholds and location-related regional transfer style characteristics, the initial risk warning can be dynamically adjusted to obtain the target risk threshold. When the predicted risk threshold is greater than the target risk threshold, a transfer risk warning is issued, which significantly improves the timeliness and accuracy of resource transfer risk prediction. This avoids the problem of insufficient or excessive warnings caused by improper setting of fixed thresholds, reduces misjudgments, and achieves efficient warning of resource transfer risks. It also reduces the risk of unauthorized transfer of resources by users' resource transfer media, improves the overall effectiveness of monitoring abnormal behavior of resource transfer media, and solves the problem of low timeliness and low accuracy of machine learning models in the abnormal behavior monitoring scenario of resource transfer media caused by improper setting of binary classification thresholds in related technologies.

[0031] Current resource transfer data can be data generated when a resource is transferred from one place to another. Current resource transfer data can be used to indicate the current resource transfer time and the current resource transfer location. The current resource transfer time can be the expected transfer time of the resource to be transferred, and the current resource transfer location can be the expected transfer location of the resource to be transferred.

[0032] After acquiring current resource transfer data, the computer equipment inputs this data into a pre-built prediction model. A prediction model is a statistical tool used to analyze historical resource transfer data, identify and quantify potential risks during the resource transfer process, and then predict whether future resource transfers constitute "unauthorized resource transfers." For example, prediction models can be Extreme Learning Machines (ELM), Support Vector Machines (SVM), deep learning models, etc., without specific limitations.

[0033] To address the issues of low timeliness and accuracy in monitoring abnormal behavior of resource transfer media, this embodiment provides a more efficient machine learning model, namely, Extreme Learning Machine (ELM), which has the following advantages: The model is easy to implement, requiring only one hidden layer, and can quickly make specific predictions for new scenarios arising in the monitoring of abnormal behavior of resource transfer media; the model learns quickly, requiring only one forward propagation compared to the gradient descent method of traditional neural networks, without iterative updates to weights, making it more suitable for timely learning scenarios; the model also has relatively higher prediction accuracy than traditional neural networks, avoiding the possibility of misjudging normal resource transfers; due to differences in consumption habits across regions and varying resource transfer situations at different times, resource transfer media data may differ significantly from place to place. Conventional neural network models have poor generalization ability, while ELM simplifies the training process by randomly initializing the weights and biases of the hidden layer, ensuring that each training iteration has a certain degree of variability, thereby improving the model's generalization ability. This allows the model to make predictions faster and better than conventional classification models when faced with new data, and adjust early warning strategies according to different regions and times. The Extreme Learning Machine (ELM) model provided in this embodiment can construct multiple ELM base learners with different features, combine the classification results of each base learner by weighted voting, and finally calculate the weights of the output layer according to methods such as least squares or linear equations. Compared with ordinary neural networks, it has the advantages of simple computation, high efficiency, and faster deriving of optimal solutions.

[0034] Correspondingly, the current resource transfer time corresponds to an initial risk threshold, which is a basic standard used to initially assess the risk of resource transfer, linked to the current resource transfer time. Optionally, the initial risk threshold can be predicted based on the current resource transfer data using a pre-trained model, thereby determining the initial risk threshold corresponding to the current resource transfer time. Alternatively, historical resource transfer data can be collected, and time series analysis methods, such as the Autoregressive Integrated Moving Average (ARIMA) model, seasonal decomposition model, or Long Short-Term Memory (LSTM) network, can be used to capture the trends and periodic patterns of resource transfer data over time. Based on the characteristics of resource transfer data at different time points predicted by the model, the initial risk threshold can be dynamically adjusted to determine the initial risk threshold corresponding to the current resource transfer time.

[0035] The current resource transfer locations correspond to regional transfer style characteristics. These characteristics can be defined as the style of resource transfers within a specific region. These regional transfer style characteristics help risk prediction models more accurately identify abnormal resource transfers, thereby providing timely warnings of potential unauthorized resource transfer activities. For example, regional transfer style characteristics can refer to features such as the average resource transfer rate, frequency of resource transfers, standard deviation of resource transfer amounts, and distribution patterns of resource transfer users (e.g., the density of resource transfer users and the number of resource transfer users within a certain area).

[0036] Computer equipment determines the initial risk value corresponding to the current resource transfer time and the regional transfer style corresponding to the current resource transfer location. It then adjusts the initial risk threshold based on the regional transfer style characteristics to obtain the target risk threshold for the current resource data. The target risk threshold refers to a specific risk judgment standard derived after comprehensive analysis and adjustment based on the initial risk threshold for the current resource transfer time and the regional transfer style characteristics of the current resource transfer location. It is used to determine whether the current resource transfer data has transfer risk. For example, a pre-built model (such as the ARIMA model or Extreme Learning Machine mentioned above) can be used to obtain the regional transfer risk threshold based on the regional transfer style characteristics. The regional transfer risk threshold and the initial risk threshold are then weighted and summed to obtain the final target risk threshold. Alternatively, the regional transfer risk characteristics and the initial risk threshold can be input together into a pre-built model, and the initial risk threshold can be adjusted to obtain the target risk threshold.

[0037] In an optional embodiment, Figure 3 This is a schematic diagram of an optional resource transfer risk prediction model training method provided in an embodiment of this application, such as... Figure 3 As shown, the training of the prediction model includes a data preprocessing module, a data analysis module, a feature ranking module, and a model training module. First, based on historical resource transfer data (such as existing resource transfer data), the historical resource transfer data is preprocessed, transforming various types of historical resource transfer data into structured data. Second, correlation analysis and positive / negative sample analysis are performed on the structured data. Since positive samples of unauthorized resource transfer behavior actually constitute a small portion of the current resource transfer data, oversampling of positive samples is performed subsequently. Features are then ranked by importance again, and irrelevant features are filtered out. Finally, the data is fed into the model for training, and the model is tuned and optimized. In this embodiment, an Extreme Learning Machine (ELM) model is used for training. After training, five-fold cross-validation is used, and the ROC (Receiver Operating Characteristic) curve is used to evaluate the model.

[0038] If the predicted risk value exceeds the target risk threshold, the computer device can provide a risk warning for the currently to-be-transferred resources. In one optional embodiment, Figure 4 This is a model prediction diagram of an optional resource transfer risk prediction method provided in an embodiment of this application, such as... Figure 4 As shown, the system obtains the current resources to be transferred in various locations in real time and sends them to the trained model for timely calculation. The risk thresholds of different current resources to be transferred are dynamically adjusted according to the current time and region. The prediction results are used to determine whether an early warning is needed based on the adjusted thresholds. Early warnings are divided into manual review and timely notification. For resource transfers that are in a low-risk state, the business department conducts a second review. For resource transfers that are in a high-risk state, timely warnings are issued. Early warnings can be combined with intelligent outbound calls.

[0039] Therefore, in this embodiment, to address the issues of low timeliness and accuracy of machine learning models in monitoring abnormal behavior of resource transfer media in related technologies, this embodiment employs an Extreme Learning Machine (ELM) model for monitoring abnormal behavior of resource transfer media. This model rapidly predicts whether the behavior of the resource transfer media is unauthorized based on various characteristics of the media, and combines this with intelligent outbound calling to quickly alert users (such as resource owners), reducing the risk of unauthorized secondary transfer of resource data stored in the user's (such as resource owner's) resource transfer media. The abnormal behavior monitoring scenarios of resource transfer media involve various subcategories, such as high-risk areas, large-scale resource transfers within regions, malicious resource transfers, and resource transfers occurring in different regions within a short period. Given the ease of implementation and superior generalization ability of the ELM model, targeted model training can be implemented for each scenario, improving the hit rate for various subcategories.

[0040] Through the embodiments of this application, resource transfer data is acquired in real time. By combining time-related initial risk thresholds and location-related regional transfer style characteristics, the initial risk warning can be dynamically adjusted to obtain the target risk threshold. When the predicted risk threshold is greater than the target risk threshold, a transfer risk warning is issued, which significantly improves the timeliness and accuracy of resource transfer risk prediction. It avoids the problem of insufficient or excessive warnings caused by improper setting of fixed thresholds, reduces misjudgments, and achieves efficient warning of resource transfer risks. It reduces the risk of unauthorized transfer of resources by users' resource transfer media, improves the overall effectiveness of monitoring abnormal behavior of resource transfer media, and solves the problem of low timeliness and low accuracy of machine learning models in abnormal behavior monitoring scenarios of resource transfer media caused by improper setting of binary classification thresholds in related technologies.

[0041] In some optional embodiments, determining the initial risk threshold corresponding to the current resource transfer time includes:

[0042] 1. Obtain the time-dimensional risk threshold table; the time-dimensional risk threshold table stores the historical risk thresholds corresponding to different time dimensions; the time-dimensional risk threshold table is obtained by quantifying the historical resource transfer data in different time dimensions in the historical resource transfer database.

[0043] Second, take the historical risk thresholds corresponding to the time dimension that match the current resource transfer time from the time dimension risk threshold table as the initial risk thresholds corresponding to the current resource transfer time.

[0044] A time-dimensional risk threshold table can be a table built based on the time characteristics of historical resource transfers. That is, it is created by quantitatively analyzing resource transfer data in a historical resource transfer database. The quantification process may include statistically analyzing resource transfer data at different time points (such as resource transfer volume, resource transfer amount, frequency of abnormal resource transfers, etc.), and calculating the corresponding average risk level or abnormal risk indicator based on this, thus forming the time-dimensional risk threshold table. The time-dimensional risk threshold table can record risk thresholds at different time points or time periods, used for quickly querying and determining the initial risk threshold related to the current resource transfer. Furthermore, the time-dimensional risk threshold table can include historical risk thresholds across different time dimensions (such as hours, days, weeks, holidays, etc.).

[0045] A historical resource transfer database can refer to a database stored in a computer system that records past resource transfers. This database can contain various resource transfer records and is used to analyze and establish a time-based risk threshold table.

[0046] Based on the current resource transfer time, a matching time dimension is searched from the time dimension risk threshold table to obtain the corresponding historical risk threshold. For example, if the current resource transfer time is Friday at 6 PM, "Friday from 5 PM to 7 PM" can be considered the matching time dimension. The historical risk threshold for this time period can be read from the table and used as the initial risk threshold. In this way, a more reasonable initial risk threshold can be set based on historical data for the specific time point of the resource transfer.

[0047] It should be noted that the execution subject that uses the historical risk threshold corresponding to the time dimension that matches the current resource transfer time in the time dimension risk threshold table as the initial risk threshold corresponding to the current resource transfer time can be a computer device or a model. When the execution subject is a model, the time dimension risk threshold table and the historical risk threshold can be input into the model, and the model can use the historical risk threshold corresponding to the time dimension that matches the current resource transfer time in the time dimension risk threshold table as the initial risk threshold corresponding to the current resource transfer time.

[0048] Through this embodiment, the acquisition and application of the time-dimensional risk threshold table enables the rapid determination of an initial risk threshold matching the current resource transfer time. This mechanism ensures that the early warning mechanism can be flexibly adjusted according to the specific characteristics of the resource transfer time, avoiding the problems of delayed or excessive early warnings that may arise from fixed thresholds. This method not only improves the response speed of resource transfer risk prediction but also enhances the accuracy and targeting of early warnings, effectively improving the risk prevention and control capabilities for monitoring abnormal behavior of resource transfer media.

[0049] In some optional embodiments, the method further includes, before determining the initial risk threshold corresponding to the current resource transfer time:

[0050] 1. Obtain the historical resource transfer database; the historical resource transfer database includes historical resource transfer data across different time dimensions.

[0051] Second, filter and separate historical resource transfer data within multiple specified time windows. Based on the historical resource transfer data within each specified time window, calculate the parameter values ​​of multiple first risk quantification indicators within each specified time window, and fuse the parameter values ​​of multiple first risk quantification indicators within each specified time window to obtain the risk threshold corresponding to each specified time window.

[0052] 3. Generate a time-dimensional risk threshold table based on the risk threshold corresponding to each specified time window.

[0053] The aforementioned designated time window can be a specific time period preset based on the time characteristics of resource transfer, used to classify historical resource transfer data and facilitate risk analysis and threshold calculation within a specific time period. Examples include periods before and after holidays, weekends, and other time periods. The first risk quantification indicator can refer to an indicator used to assess resource transfer risk over time. For example, the first risk quantification indicator may include the average resource transfer amount, resource transfer frequency, and resource transfer volatility (such as calculating the standard deviation or variance of the resource transfer amount within each time window as a quantification indicator of resource transfer volatility).

[0054] Optionally, the computer equipment can divide the historical resource transfer data in the historical resource transfer database into multiple preset time windows based on time characteristics. For example, the historical resource transfer data for one year can be classified into time windows such as "lunchtime on weekdays", "weekend evenings", and "one hour before holidays".

[0055] Within the selected time windows, computer equipment further analyzes historical resource transfer data, calculating parameter values ​​for multiple primary risk quantification indicators within each specified time window. These primary risk quantification indicators reflect the risk characteristics of historical resource transfers within a specific time window. By fusing the parameter values ​​of multiple primary risk quantification indicators within each specified time window, a risk threshold corresponding to each specified time window is obtained. For example, a weighted average summation method can be used to obtain the risk threshold for each specified time window.

[0056] Optionally, the risk thresholds corresponding to each specified time window can be compiled into a table, i.e., a time-dimensional risk threshold table can be generated. The time-dimensional risk threshold table maps the time dimension and the risk threshold one by one, which can provide a basis for fast querying in real-time risk assessment.

[0057] In an optional embodiment, resource transfer data is extracted, cleaned, and integrated from a historical resource transfer database. Erroneous or irrelevant records are removed to obtain a clean and complete resource transfer dataset. Each resource transfer record contains information such as transfer time, transfer amount, and transfer location. Resource transfer records within specific time windows are filtered and separated, such as the week before a holiday (T-7 to T-1) and the week after a holiday (T+1 to T+7), as well as resource transfer data on weekend evenings (18:00 to 24:00 on Saturday and Sunday), resulting in three data subsets for each time window. Each subset contains all resource transfer records within the corresponding time period. The average resource transfer amount, resource transfer frequency, and resource transfer volatility are calculated for each specific time window (e.g., the week before and after a holiday, or weekend evenings). (The standard deviation or variance of the resource transfer amount within each time window is calculated as a quantitative indicator of resource transfer volatility). A risk quantification indicator for each time window is calculated using a weighted average or a customized formula. Based on the risk quantification indicator for each time window, a risk threshold is set for each time window, generating a dynamic time-dimensional risk threshold table.

[0058] This embodiment analyzes historical resource transfer data using time windows, calculates parameter values ​​for multiple first-risk quantification indicators for each specified time window, and fuses these parameter values ​​to generate a time-dimensional risk threshold table. This not only improves the accuracy of resource transfer risk prediction but also enhances the system's response speed. It provides a more effective risk warning mechanism for scenarios such as monitoring abnormal behavior of resource transfer media, reduces unnecessary human review costs, and improves resource transfer security and user trust.

[0059] In some optional embodiments, determining the regional transfer style characteristics corresponding to the current resource transfer location includes:

[0060] 1. Obtain the list of regional style features; the list of regional style features stores the historical transfer style features corresponding to different regions; the list of regional style features is obtained by quantifying the historical resource transfer data of different resource transfer regions in the historical resource transfer database.

[0061] Second, the historical transfer style features corresponding to the regions in the regional style feature list that match the current resource transfer location are used as the regional transfer style features corresponding to the current resource transfer location.

[0062] The regional style feature list can be obtained by quantifying historical resource transfer data of different resource transfer regions in the historical resource transfer database. It can help computer equipment quickly identify the transfer style of a specific region, thereby making more accurate decisions in risk warning.

[0063] Computer equipment can extract information from historical resource transfer databases to obtain a list of regional style characteristics. This list records the historical resource transfer style characteristics of different resource transfer regions, including but not limited to average resource transfer amount, resource transfer frequency, and the proportion of high-risk resource transfers.

[0064] Optionally, the computer device can extract historical transfer style features from the regional style feature list that match the current resource transfer location, and use these as regional transfer style features related to the current resource transfer location. When the computer device receives a resource transfer request, it can immediately identify the geographical location where the resource transfer occurred, and then search the regional style feature list to find the historical transfer style features of the region closest to or identical to that location. For example, if the resource transfer occurs in city A, the computer device can search the regional style feature list for relevant data about city A, such as city A's preference for large-scale resource transfers and fluctuations in resource transfers during tourist seasons, to assess whether this resource transfer conforms to the region's resource transfer pattern and whether it may conceal a high risk.

[0065] In an optional embodiment, for the scenario of monitoring abnormal behavior of resource transfer media, when a resource transfer request from city B enters the system of the computer device, the system can quickly obtain the historical resource transfer style characteristics of city B through the regional style characteristic list. Based on the historical resource transfer style characteristics, the system can adjust the initial risk threshold related to city B. If the predicted risk value exceeds the target risk threshold adjusted based on the regional style characteristics of city B, an immediate alarm notification is triggered, including sending a warning SMS to the user (such as a cardholder) and suspending the execution of resource transfer, in order to prevent the unauthorized transfer of resources by the resource transfer media.

[0066] This embodiment obtains a list of regional style features and extracts regional transfer style features related to the current resource transfer location. This allows for dynamic adjustment of risk warning strategies based on the characteristics of different regions, improving the accuracy and timeliness of warnings and avoiding false alarms or missed alarms caused by fixed thresholds. This effectively enhances the monitoring efficiency of abnormal behavior of resource transfer media and provides users with a safer and more reliable resource transfer environment.

[0067] In some optional embodiments, the method further includes, before determining the regional migration style characteristics corresponding to the current resource migration location:

[0068] I. Obtain the historical resource transfer database; the historical resource transfer database includes historical resource transfer data from different resource transfer regions.

[0069] Second, screen and separate historical resource transfer data from multiple resource transfer regions. Based on the historical resource transfer data of each resource transfer region, calculate the parameter values ​​of multiple secondary risk quantification indicators within each resource transfer region. Use the parameter values ​​of multiple secondary risk quantification indicators within each resource transfer region as the historical transfer style characteristics of each resource transfer region.

[0070] Third, generate a list of regional style characteristics based on the historical transfer style characteristics of each resource transfer region.

[0071] Computer equipment can filter and separate historical resource data according to different regions based on historical resource transfer data in the historical resource transfer database.

[0072] Historical resource transfer data for each region can include the average amount of resource transfers, the frequency of resource transfers, the volatility of resource transfers (such as the standard deviation of resource transfer amounts), and the distribution patterns of resource transfer users (such as the density of resource transfer users or the number of resource transfer users in a certain region). The second risk quantification indicator can be an indicator used to assess the regional style of resource transfer risk, and can include the degree of anomaly in the amount of computer equipment resource transfers, the degree of anomaly in the frequency of resource transfers, the volatility of resource transfers, and the distribution patterns of resource transfer users (such as the density of resource transfer users or the number of resource transfer users in a certain region).

[0073] Optionally, assuming that historical resource transfer data includes the average resource transfer amount, resource transfer frequency, resource transfer volatility (such as the standard deviation of resource transfer amount), and distribution pattern of resource transfer users for each region, the second risk quantification indicator includes the degree of abnormality of resource transfer amount, the degree of abnormality of resource transfer frequency, resource transfer volatility, and distribution pattern of resource transfer users. The computer equipment can calculate the standardized deviation of each resource transfer based on the region-specific average resource transfer amount and standard deviation. This standardized deviation is a specified value used to measure the number of times the resource transfer amount of a specific region deviates from the standard deviation of the average of its dataset. Exceeding this threshold is considered abnormal. For example, the standardized deviation can be the Z-score, also known as the standard score or Z-value. It's a statistic used to represent how far a given value is from the mean of its sample set, measured in standard deviations. Resource transfers exceeding the corresponding standardized deviation (e.g., the Z-score) are considered abnormal. The proportion of resource transfers whose absolute standardized deviation (e.g., the Z-score) exceeds a preset standardized deviation (e.g., 3 or 4) is calculated to obtain a quantitative indicator of the degree of abnormality in resource transfer amounts for each region. Computer equipment calculates the quartiles of resource transfer frequencies for each region, namely the first quartile (Q1) and the third quartile (Q3). The interquartile range (IQR) = Q3 - Q1 is used to determine the upper and lower bounds of abnormal resource transfer frequencies, resulting in the lower and upper bounds for resource transfer frequencies for each region. Any resource transfer frequency below the lower bound or above the upper bound is considered abnormal. Then, the proportion of resource transfer frequencies within the abnormal range is calculated to obtain a quantitative indicator of the degree of abnormality in resource transfer frequencies for each region. Computer equipment analyzes the distribution patterns of resource-transferring users, quantifying the concentration or diversity of user distribution through cluster analysis or entropy calculation. This generates quantitative indicators regarding the specificity of resource-transferring user distribution in a given region. For example, a higher entropy value indicates that resource transfers are dispersed among more diverse user types, potentially increasing the risk of unauthorized resource transfers. This yields a quantitative indicator of the anomaly degree of the resource-transferring user distribution pattern. The parameter values ​​of multiple secondary risk quantitative indicators within each resource-transferring region are used as historical transfer style characteristics for that region.

[0074] This embodiment obtains a list of regional style characteristics, which can capture and quantify the historical transfer style characteristics of resource transfer in different regions. This provides data support for dynamically adjusting the risk warning mechanism, significantly improves the pertinence and accuracy of resource transfer risk prediction, and avoids the problem of over- or under-warning that may be caused by applying fixed thresholds in different regions. This enhances the effectiveness of abnormal behavior monitoring of resource transfer media in resource transfer risk control, and provides users with a safer resource transfer environment.

[0075] In some optional embodiments, the initial risk threshold is adjusted based on regional transfer style characteristics to obtain a target risk threshold corresponding to the current resource transfer data, including:

[0076] I. Based on the characteristics of regional transfer styles, determine the regional transfer risk factors corresponding to the current resource transfer location.

[0077] Second, adjust the initial risk threshold according to the regional transfer risk factor to obtain the target risk threshold corresponding to the current resource transfer data.

[0078] Optionally, the computer equipment can perform feature matching on the current resource transfer location based on a list of regional style characteristics, identify the resource transfer style characteristics of that location, assess the degree of deviation between the resource transfer style characteristics of that location and normal resource transfer style characteristics, and calculate a regional transfer risk factor corresponding to that region. The regional transfer risk factor can be a quantitative indicator used to reflect the degree of additional risk when a specific region transfers resources at the current point in time; it can quantify the potential risk level of resource transfer at the current location. For example, the regional transfer risk factor can be a numerical value.

[0079] In this embodiment, the regional transfer risk factor corresponding to the current resource transfer location is determined based on the regional transfer style characteristics. The above-mentioned method for determining the regional transfer factor can be to perform a comprehensive calculation based on the abnormal degree of computer equipment resource transfer amount, abnormal degree of resource transfer frequency, resource transfer volatility and abnormal analysis results of merchant distribution patterns to form the regional transfer risk factor for each region; or it can be to use a machine learning model to predict the potential risks of a region and combine it with the regional transfer style characteristics to obtain the regional transfer risk factor through weighted fusion.

[0080] Optionally, the computer device can combine the acquired regional transfer risk factors with the initial risk threshold and perform a weighted summation to obtain the target risk threshold corresponding to the current resource transfer data.

[0081] In an optional embodiment, the computer device can monitor the timing of resource transfers in real time and use an extreme learning machine model to predict the risk level of the current resource transfer (e.g., resource transfer) based on historical resource transfer data (e.g., existing resource transfer data). This can be divided into two stages. The first stage extracts historical resource transfer data along the time dimension, quantifies the historical resource transfer data across different time dimensions, and adjusts the initial risk thresholds for different resource transfers accordingly. For example, the initial risk threshold for frequent small-amount transfers before and after holidays should be higher than usual. Then, it extracts historical resource transfer data along the regional dimension and dynamically adjusts the initial risk threshold for the current region based on the regional resource transfer style. The second stage extracts the risk characteristics of the current resource transfer, uses the extracted characteristics as input parameters for machine learning, and performs timely calculations and warnings based on the adjusted initial risk thresholds. This is combined with applications such as intelligent outbound calling and EINFO (referring to an electronic platform that collects, processes, and analyzes resource transfer data in real time to assist intelligent outbound calling systems or other early warning mechanisms) for rapid early warning.

[0082] This embodiment transforms the regional transfer style characteristics of the current resource transfer location into a regional transfer risk factor, and adjusts the initial risk threshold based on this factor to obtain a target risk threshold corresponding to the current resource transfer data. This enables the rapid identification and adaptation of potential unauthorized resource transfer risks when faced with resource transfer requests from different regions, effectively improving the pertinence and efficiency of the early warning mechanism and significantly enhancing the ability to detect abnormal resource transfers.

[0083] In some optional embodiments, the regional transfer style characteristics include the average amount of resource transfers and the range of resource transfer frequencies; adjusting the initial risk threshold based on the regional transfer style characteristics to obtain the target risk threshold corresponding to the current resource transfer data includes:

[0084] If the current resource transfer amount is greater than the average resource transfer amount, or if the current resource transfer frequency is not within the range of resource transfer frequencies, the initial risk threshold is reduced to obtain the target risk threshold corresponding to the current resource transfer data.

[0085] Regional transfer style characteristics can include the average amount of resource transfer and the range of resource transfer frequency. The average amount of resource transfer can refer to the average amount calculated based on historical resource transfer data for a region, which is used to reflect the normal level of resource transfer in a region. The range of resource transfer frequency can refer to the reasonable range of the number of times resource transfers occur in a region within a certain period of time (such as daily or weekly), which is used to assess the normality of the resource transfer frequency.

[0086] Computer equipment can acquire and analyze current resource transfer data in real time, checking whether the amount of resource transfer exceeds the average amount or whether the frequency falls outside the range for the region. If the amount is significantly higher than the average or the frequency exceeds the range, potential risk signals are identified. Based on these risk signals, the computer equipment can lower the initial risk threshold and generate a target risk threshold that matches the current resource transfer data. This addresses situations where the amount or frequency of resource transfer is abnormal but may be considered normal at the regional level. By lowering the threshold, potential unauthorized resource transfers can be detected more effectively without affecting normal resource transfers.

[0087] Optionally, for regions with high second risk quantification indicators, the initial risk threshold can be lowered to more sensitively detect potential unauthorized resource transfers; for regions with low second risk quantification indicators, the initial risk threshold can be appropriately increased to reduce false alarms of normal resource transfers, resulting in a dynamic list of regional risk thresholds.

[0088] This embodiment, by adjusting the initial risk threshold based on the average amount and frequency of resource transfers in a specific region, can improve the sensitivity and accuracy of risk warnings. Especially in resource transfer scenarios with high transfer amounts or abnormal transfer frequencies, it can more effectively identify potential unauthorized resource transfers without affecting normal transfers, thereby enhancing the overall risk control and security of resource transfers. Simultaneously, dynamically adjusting the initial risk threshold also helps reduce false alarms, optimize user experience, and ensure the smoothness of resource transfers while protecting user assets.

[0089] According to another aspect of the embodiments of this application, a resource transfer risk prediction apparatus is also provided. This apparatus can be used to implement the resource transfer risk prediction method provided in the above embodiments, and details already described will not be repeated. As used below, the term "unit" can refer to a combination of software and / or hardware that performs a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0090] Figure 5 This is a structural block diagram of an optional resource transfer risk prediction device according to an embodiment of this application, such as... Figure 5 As shown, the resource transfer risk prediction device includes a first execution unit 502, a second execution unit 504, and a third execution unit 506.

[0091] The first execution unit 502 is used to acquire current resource transfer data, input the current resource transfer data into a pre-built prediction model, and obtain the predicted risk value corresponding to the current resource transfer data; the current resource transfer data is used to indicate the current resource transfer time and the current resource transfer location, the current resource transfer time is the expected transfer time of the current resource to be transferred, and the current resource transfer location is the expected transfer location of the current resource to be transferred;

[0092] The second execution unit 504 is used to determine the initial risk threshold corresponding to the current resource transfer time, determine the regional transfer style characteristics corresponding to the current resource transfer location, and adjust the initial risk threshold according to the regional transfer style characteristics to obtain the target risk threshold corresponding to the current resource transfer data.

[0093] The third execution unit 506 is used to provide a risk warning for the transfer of resources to be transferred when the predicted risk value is greater than the target risk threshold.

[0094] It should be noted that the first execution unit 502 in this embodiment can be used to execute the above step S202, the second execution unit 504 in this embodiment can be used to execute the above step S204, and the third execution unit 506 in this embodiment can be used to execute the above step S206.

[0095] Through the embodiments of this application, resource transfer data is acquired in real time. By combining time-related initial risk thresholds and location-related regional transfer style characteristics, the initial risk warning can be dynamically adjusted to obtain the target risk threshold. When the predicted risk threshold is greater than the target risk threshold, a transfer risk warning is issued, which significantly improves the timeliness and accuracy of resource transfer risk prediction. It avoids the problem of insufficient or excessive warnings caused by improper setting of fixed thresholds, reduces misjudgments, and achieves efficient warning of resource transfer risks. It reduces the risk of unauthorized transfer of resources by users' resource transfer media, improves the overall effectiveness of monitoring abnormal behavior of resource transfer media, and solves the problem of low timeliness and low accuracy of machine learning models in abnormal behavior monitoring scenarios of resource transfer media caused by improper setting of binary classification thresholds in related technologies.

[0096] In an exemplary embodiment, the second execution unit 504 is further configured to: obtain a time-dimensional risk threshold table; the time-dimensional risk threshold table stores historical risk thresholds corresponding to different time dimensions; the time-dimensional risk threshold table is obtained by quantifying historical resource transfer data in different time dimensions in the historical resource transfer database; and take the historical risk threshold corresponding to the time dimension that matches the current resource transfer time in the time-dimensional risk threshold table as the initial risk threshold corresponding to the current resource transfer time.

[0097] In an exemplary embodiment, the second execution unit 504 is further configured to: acquire a historical resource transfer database; the historical resource transfer database includes historical resource transfer data in different time dimensions; filter and separate historical resource transfer data within multiple specified time windows; calculate parameter values ​​of multiple first risk quantification indicators within each specified time window based on the historical resource transfer data within each specified time window; perform fusion processing on the parameter values ​​of multiple first risk quantification indicators within each specified time window to obtain a risk threshold corresponding to each specified time window; and generate a time-dimensional risk threshold table based on the risk threshold corresponding to each specified time window.

[0098] In an exemplary embodiment, the second execution unit 504 is further configured to: obtain a regional style feature list; the regional style feature list stores historical transfer style features corresponding to different regions; the regional style feature list is obtained by quantifying historical resource transfer data of different resource transfer regions in the historical resource transfer database; and take the historical transfer style features corresponding to the regions in the regional style feature list that match the current resource transfer location as the regional transfer style features corresponding to the current resource transfer location.

[0099] In an exemplary embodiment, the second execution unit 504 is further configured to: acquire a historical resource transfer database; the historical resource transfer database includes historical resource transfer data from different resource transfer regions; filter and separate historical resource transfer data from multiple resource transfer regions; calculate parameter values ​​of multiple second risk quantification indicators within each resource transfer region based on the historical resource transfer data of each resource transfer region; use the parameter values ​​of multiple second risk quantification indicators within each resource transfer region as historical transfer style characteristics of each resource transfer region; and generate a regional style characteristic list based on the historical transfer style characteristics of each resource transfer region.

[0100] In an exemplary embodiment, the second execution unit 504 is further configured to: determine the regional transfer risk factor corresponding to the current resource transfer location based on the regional transfer style characteristics; and adjust the initial risk threshold based on the regional transfer risk factor to obtain a target risk threshold corresponding to the current resource transfer data.

[0101] In an exemplary embodiment, the regional transfer style characteristics include the average amount of resource transfers and the range of resource transfer frequencies; the second execution unit 504 is further configured to:

[0102] If the current resource transfer amount is greater than the average resource transfer amount, or if the current resource transfer frequency is not within the range of resource transfer frequencies, the initial risk threshold is reduced to obtain the target risk threshold corresponding to the current resource transfer data.

[0103] It should be noted that the above-mentioned units may be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above-mentioned modules may also be part of the device and may run in the computer terminal 10 provided in Embodiment 1.

[0104] Embodiments of this application also provide an electronic device. Figure 6 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 (Only one is shown) processor 602, memory 604, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0105] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0106] The processor can access information and applications stored in memory via a transfer device to perform the following steps:

[0107] 1. Obtain current resource transfer data and input it into a pre-built prediction model to obtain the predicted risk value corresponding to the current resource transfer data. The current resource transfer data is used to indicate the current resource transfer time and the current resource transfer location. The current resource transfer time is the expected transfer time of the current resource to be transferred, and the current resource transfer location is the expected transfer location of the current resource to be transferred.

[0108] Second, determine the initial risk threshold corresponding to the current resource transfer time, determine the regional transfer style characteristics corresponding to the current resource transfer location, and adjust the initial risk threshold according to the regional transfer style characteristics to obtain the target risk threshold corresponding to the current resource transfer data.

[0109] Third, if the predicted risk value is greater than the target risk threshold, issue a risk warning for the current resources to be transferred.

[0110] The processor can also access information and applications stored in memory via a transmission device to perform the following steps:

[0111] 1. Obtain the time-dimensional risk threshold table; the time-dimensional risk threshold table stores the historical risk thresholds corresponding to different time dimensions; the time-dimensional risk threshold table is obtained by quantifying the historical resource transfer data in different time dimensions in the historical resource transfer database.

[0112] Second, take the historical risk thresholds corresponding to the time dimension that match the current resource transfer time from the time dimension risk threshold table as the initial risk thresholds corresponding to the current resource transfer time.

[0113] The processor can also access information and applications stored in memory via a transmission device to perform the following steps:

[0114] 1. Obtain the historical resource transfer database; the historical resource transfer database includes historical resource transfer data across different time dimensions.

[0115] Second, filter and separate historical resource transfer data within multiple specified time windows. Based on the historical resource transfer data within each specified time window, calculate the parameter values ​​of multiple first risk quantification indicators within each specified time window, and fuse the parameter values ​​of multiple first risk quantification indicators within each specified time window to obtain the risk threshold corresponding to each specified time window.

[0116] 3. Generate a time-dimensional risk threshold table based on the risk threshold corresponding to each specified time window.

[0117] The processor can also access information and applications stored in memory via a transmission device to perform the following steps:

[0118] 1. Obtain the list of regional style features; the list of regional style features stores the historical transfer style features corresponding to different regions; the list of regional style features is obtained by quantifying the historical resource transfer data of different resource transfer regions in the historical resource transfer database.

[0119] Second, the historical transfer style features corresponding to the regions in the regional style feature list that match the current resource transfer location are used as the regional transfer style features corresponding to the current resource transfer location.

[0120] The processor can also access information and applications stored in memory via a transmission device to perform the following steps:

[0121] I. Obtain the historical resource transfer database; the historical resource transfer database includes historical resource transfer data from different resource transfer regions.

[0122] Second, screen and separate historical resource transfer data from multiple resource transfer regions. Based on the historical resource transfer data of each resource transfer region, calculate the parameter values ​​of multiple secondary risk quantification indicators within each resource transfer region. Use the parameter values ​​of multiple secondary risk quantification indicators within each resource transfer region as the historical transfer style characteristics of each resource transfer region.

[0123] Third, generate a list of regional style characteristics based on the historical transfer style characteristics of each resource transfer region.

[0124] The processor can also access information and applications stored in memory via a transmission device to perform the following steps:

[0125] I. Based on the characteristics of regional transfer styles, determine the regional transfer risk factors corresponding to the current resource transfer location.

[0126] Second, adjust the initial risk threshold according to the regional transfer risk factor to obtain the target risk threshold corresponding to the current resource transfer data.

[0127] The processor can also access information and applications stored in memory via a transmission device to perform the following steps:

[0128] If the current resource transfer amount is greater than the average resource transfer amount, or if the current resource transfer frequency is not within the range of resource transfer frequencies, the initial risk threshold is reduced to obtain the target risk threshold corresponding to the current resource transfer data.

[0129] By employing the embodiments of this application, resource transfer data is acquired in real time. Combined with time-related initial risk thresholds and location-related regional transfer style characteristics, the initial risk warning can be dynamically adjusted to obtain the target risk threshold. When the predicted risk threshold is greater than the target risk threshold, a transfer risk warning is issued, significantly improving the timeliness and accuracy of resource transfer risk prediction. This avoids the problem of insufficient or excessive warnings caused by improper setting of fixed thresholds, reduces misjudgments, and achieves efficient warning of resource transfer risks. It also reduces the risk of unauthorized transfer of resources by users' resource transfer media, improves the overall effectiveness of monitoring abnormal behavior of resource transfer media, and solves the problem of low timeliness and low accuracy of machine learning models in abnormal behavior monitoring scenarios of resource transfer media caused by improper setting of binary classification thresholds in related technologies.

[0130] Those skilled in the art will understand that Figure 6The structure shown is for illustrative purposes only. Electronic devices can also be smartphones (such as Android phones, iOS phones, etc.), tablets, PDAs, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 6 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 6 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 6 The different configurations shown.

[0131] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0132] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the resource transfer risk prediction method provided in the above embodiments.

[0133] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0134] Embodiments of this application also provide a computer program product, which, when executed on a data processing device, is adapted to perform the steps of a resource transfer risk prediction method.

[0135] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0136] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0137] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0138] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0139] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0140] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for predicting resource transfer risks, characterized in that, include: Obtain current resource transfer data, input the current resource transfer data into a pre-built prediction model, and obtain the predicted risk value corresponding to the current resource transfer data; The current resource transfer data is used to indicate the current resource transfer time and the current resource transfer location. The current resource transfer time is the expected transfer time of the resource to be transferred, and the current resource transfer location is the expected transfer location of the resource to be transferred. Determine the initial risk threshold corresponding to the current resource transfer time, determine the regional transfer style characteristics corresponding to the current resource transfer location, and adjust the initial risk threshold according to the regional transfer style characteristics to obtain the target risk threshold corresponding to the current resource transfer data; If the predicted risk value is greater than the target risk threshold, a transfer risk warning is issued for the currently transferred resource.

2. The method according to claim 1, characterized in that, Determining the initial risk threshold corresponding to the current resource transfer time includes: Obtain a time-dimensional risk threshold table; the time-dimensional risk threshold table stores historical risk thresholds corresponding to different time dimensions; the time-dimensional risk threshold table is obtained by quantifying historical resource transfer data in different time dimensions in the historical resource transfer database; The historical risk thresholds corresponding to the time dimension that match the current resource transfer time in the time dimension risk threshold table are used as the initial risk thresholds corresponding to the current resource transfer time.

3. The method according to claim 2, characterized in that, Before determining the initial risk threshold corresponding to the current resource transfer time, the method further includes: Obtain the historical resource transfer database; the historical resource transfer database includes historical resource transfer data across different time dimensions; Historical resource transfer data within multiple specified time windows are filtered and separated. Based on the historical resource transfer data within each specified time window, the parameter values ​​of multiple first risk quantification indicators within each specified time window are calculated. The parameter values ​​of multiple first risk quantification indicators within each specified time window are then fused to obtain the risk threshold corresponding to each specified time window. The time-dimensional risk threshold table is generated based on the risk threshold corresponding to each specified time window.

4. The method according to claim 1, characterized in that, The determination of the regional transfer style characteristics corresponding to the current resource transfer location includes: Obtain a list of regional style features; the list of regional style features stores historical transfer style features corresponding to different regions; the list of regional style features is obtained by quantifying historical resource transfer data of different resource transfer regions in the historical resource transfer database; The historical transfer style features corresponding to the regions in the regional style feature list that match the current resource transfer location are used as the regional transfer style features corresponding to the current resource transfer location.

5. The method according to claim 4, characterized in that, Before determining the regional migration style characteristics corresponding to the current resource migration location, the method further includes: Obtain the historical resource transfer database; the historical resource transfer database includes historical resource transfer data from different resource transfer regions; Historical resource transfer data from multiple resource transfer regions are filtered and separated. Based on the historical resource transfer data of each of the multiple resource transfer regions, the parameter values ​​of multiple second risk quantification indicators in each resource transfer region are calculated. The parameter values ​​of the multiple second risk quantification indicators in each resource transfer region are used as the historical transfer style characteristics of each resource transfer region. A list of regional style characteristics is generated based on the historical transfer style characteristics of each resource transfer region.

6. The method according to claim 1, characterized in that, The step of adjusting the initial risk threshold according to the regional transfer style characteristics to obtain the target risk threshold corresponding to the current resource transfer data includes: Based on the aforementioned regional transfer style characteristics, determine the regional transfer risk factor corresponding to the current resource transfer location; The initial risk threshold is adjusted based on the regional transfer risk factor to obtain the target risk threshold corresponding to the current resource transfer data.

7. The method according to claim 1, characterized in that, The regional transfer style characteristics include the average amount of resource transfers and the range of resource transfer frequencies; adjusting the initial risk threshold based on the regional transfer style characteristics to obtain the target risk threshold corresponding to the current resource transfer data includes: If the resource transfer amount of the current resource transfer data is greater than the average resource transfer amount, or if the resource transfer frequency of the current resource transfer data is not within the range of the resource transfer frequency, the initial risk threshold is reduced to obtain the target risk threshold corresponding to the current resource transfer data.

8. A resource transfer risk prediction device, characterized in that, include: The first execution unit is used to acquire current resource transfer data, input the current resource transfer data into a pre-built prediction model, and obtain the predicted risk value corresponding to the current resource transfer data. The current resource transfer data is used to indicate the current resource transfer time and the current resource transfer location. The current resource transfer time is the expected transfer time of the resource to be transferred, and the current resource transfer location is the expected transfer location of the resource to be transferred. The second execution unit is used to determine an initial risk threshold corresponding to the current resource transfer time, determine the regional transfer style characteristics corresponding to the current resource transfer location, and adjust the initial risk threshold according to the regional transfer style characteristics to obtain a target risk threshold corresponding to the current resource transfer data. The third execution unit is used to provide a transfer risk warning for the currently to be transferred resources when the predicted risk value is greater than the target risk threshold.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the computer-readable storage medium is located to perform the method of any one of claims 1 to 7.

10. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, performs the method according to any one of claims 1 to 7.

Images