Early warning information generation method and device, equipment, storage medium and program product

Abstract

The invention discloses an early warning information generation method and device, equipment, a storage medium and a program product, and relates to the technical field of data processing. The method comprises the following steps: when it is detected that a transaction operation occurs in a business system, storing account information and data change information of the transaction operation into a first database as first transaction data; updating a log file of the first database according to newly added first transaction data in the first database; analyzing the updated log file to obtain first transaction data corresponding to the updated log file; analyzing and processing the first transaction data through a calculation model to obtain an evaluation index corresponding to the first transaction data; and under the condition that the evaluation index meets a preset condition, storing the first transaction data to a result region of a second database, and generating early warning information according to the plurality of transaction data arranged according to a time sequence. According to the embodiment of the invention, the real-time performance of early warning information generation can be improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of data processing, and particularly relates to a method and device for generating early warning information, a storage medium, and a program product. BACKGROUND

[0002] Currently, in banks and other financial institutions, in order to discover potential risks in advance when abnormal signs appear in customer behavior or resource activities, early warning information needs to be generated according to generated business data.

[0003] In related technologies, in banks and other financial institutions, a batch of daily-end business data needs to be generated by an upstream system at the end of each day, and then the batch of daily-end business data is transmitted to a business system. After receiving the batch of daily-end business data, the business system processes the entire batch of business data using batch processing technology at night, and generates early warning signals according to the processing results. The early warning signals generated in this batch processing manner have a large delay. SUMMARY

[0004] Embodiments of the present application provide a method and device for generating early warning information, a storage medium, and a program product, which can solve the problem of large delay in generating early warning information.

[0005] In a first aspect, the embodiments of the present application provide a method for generating early warning information, which includes: In the case where a transaction operation occurs in a business system, account information and data change information of an account associated with the transaction operation are stored as first transaction data in a first database in the business system; A log file of the first database is updated according to newly added first transaction data in the first database; The log file after the update is parsed to obtain first transaction data corresponding to the log file after the update; The first transaction data is analyzed and processed by a computing model to obtain an evaluation index corresponding to the first transaction data; In the case where the evaluation index meets a preset condition, the first transaction data is stored in a result area of a second database, and a plurality of transaction data in the result area is sorted according to record times of the plurality of transaction data, to obtain a plurality of transaction data arranged in time sequence, wherein the plurality of transaction data includes the first transaction data; Early warning information is generated according to the plurality of transaction data arranged in time sequence.

[0006] In some embodiments, the first transaction data is analyzed and processed by a computing model to obtain an evaluation index corresponding to the first transaction data, which includes: determining a data feature of the first transaction data; determining a computing model corresponding to the first transaction data according to the data feature of the first transaction data; analyzing and processing the first transaction data through the computing model corresponding to the first transaction data to obtain an evaluation index corresponding to the first transaction data.

[0007] In some embodiments, the determining the data feature of the first transaction data comprises: determining a topic of the first transaction data; storing the first transaction data into a message queue corresponding to the topic; in a case where there is newly added first transaction data in the message queue, parsing the newly added first transaction data in the message queue to obtain the data feature of the first transaction data.

[0008] In some embodiments, the data feature comprises an account change feature, and the determining the computing model corresponding to the first transaction data according to the data feature of the first transaction data comprises: determining a business type in a target account corresponding to the first transaction data according to the account change feature in the target account; determining the computing model corresponding to the first transaction data according to the business type.

[0009] In some embodiments, the determining the computing model corresponding to the first transaction data according to the business type comprises: in a case where the business type of the target account is transferring resources out of the target account, determining a first computing model as the computing model corresponding to the first transaction data, wherein the first computing model is an analysis model of resource transfer-out type transaction; in a case where the business type of the target account is transferring resources into the target account, determining a second computing model as the computing model corresponding to the first transaction data, wherein the second computing model is an analysis model of resource transfer-in type transaction.

[0010] In some embodiments, after the analyzing and processing the first transaction data through the computing model to obtain the evaluation index corresponding to the first transaction data, the method further comprises: in a case where the evaluation index does not satisfy a preset condition, storing the first transaction data into a cumulative area of a second database.

[0011] In some embodiments, after the storing the first transaction data into the cumulative area of the second database in the case where the evaluation index does not satisfy the preset condition, the method further comprises: In the case where the preset condition is updated, it is determined again whether the first transaction data in the accumulation area meets the preset condition after the update; In the case where the first transaction data in the accumulation area meets the preset condition after the update, the first transaction data in the accumulation area is transferred to a result area of the second database.

[0012] In some embodiments, the storing of the first transaction data to the result area of the second database comprises: obtaining a record time of the first transaction data and key information of the first transaction data, wherein the key information is field information identifying an object or an event to which the corresponding transaction data belongs; associating the record time and the key information to obtain row key information corresponding to the first transaction data; storing the row key information to the result area of the second database.

[0013] In a second aspect, the embodiments of the present application provide a device for generating early warning information, and the device comprises: a first storage module configured to store, in the case where a transaction operation is detected in a business system, account information of an account associated with the transaction operation and data change information as first transaction data in a first database in the business system; an update module configured to update a log file of the first database according to newly added first transaction data in the first database; a parsing module configured to parse the log file after the update to obtain first transaction data corresponding to the log file after the update; an analysis module configured to analyze and process the first transaction data through a calculation model to obtain an evaluation index corresponding to the first transaction data; a second storage module configured to store, in the case where the evaluation index meets a preset condition, the first transaction data to a result area of a second database, and sort a plurality of transaction data in the result area according to record times of the plurality of transaction data to obtain a plurality of transaction data arranged in time sequence, wherein the plurality of transaction data comprises the first transaction data; a generation module configured to generate early warning information according to the plurality of transaction data arranged in time sequence.

[0014] In a third aspect, the embodiments of the present application provide a device for generating early warning information, and the device comprises a processor and a memory storing computer program instructions; The processor implements the method for generating early warning information as above when executing the computer program instructions.

[0015] Fourthly, embodiments of this application provide a computer storage medium storing computer program instructions, which, when executed by a processor, implement the above-mentioned method for generating early warning information.

[0016] Fifthly, embodiments of this application provide a computer program product, the computer program product including computer program instructions, which, when executed by a processor, implement the above-mentioned method for generating early warning information.

[0017] In this application, upon detecting an update to the log file of the first database in the business system, the newly added first transaction data in the first database is acquired in real time. A risk assessment is then performed on the first transaction data based on the corresponding calculation model to obtain assessment indicators. If the assessment indicators of the first transaction data meet preset conditions, the first transaction data is written to the result area of ​​the second database. Multiple transaction data are then sorted chronologically, and an early warning message is generated based on the chronologically arranged transaction data. This method, because the transaction data in the first database is collected and assessed incrementally in real time, without waiting for the end of the day for batch processing of business data, enables rapid generation of early warnings when transaction data poses a risk, thus improving the real-time nature of the early warning information. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating a method for generating early warning information according to an embodiment of this application; Figure 2 This is a schematic diagram of the structure of a warning information generation device provided in an embodiment of this application; Figure 3 This is a schematic diagram of the hardware structure of a warning information generation device provided in an embodiment of this application. Detailed Implementation

[0020] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples of this application.

[0021] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0022] It should be noted that the acquisition, storage, use, and processing of data in the technical solution of this application all comply with the relevant provisions of national laws and regulations.

[0023] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0024] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. The embodiments will now be described in detail with reference to the accompanying drawings.

[0025] Specifically, in order to address the problems of the prior art, embodiments of this application provide a method, apparatus, device, storage medium, and program product for generating early warning information. The method for generating early warning information provided in this application embodiment will be described first below.

[0026] Figure 1 A flowchart illustrating a method for generating early warning information according to an embodiment of this application is shown. The method includes the following steps: S110, when a transaction operation is detected in the business system, the account information and data change information of the account associated with the transaction operation are stored as the first transaction data in the first database of the business system. In this embodiment of the application, when a transaction operation is detected in the business system, the account information and data change information associated with the transaction operation are stored as the first transaction data in the first database. In this way, it can be ensured that all transactions have accurate data records.

[0027] Transaction operations can include transfers, deposits, and withdrawals. Account information can include account number, customer number, account type, etc., while data change information corresponds to the direction and value of changes in resource or business data. For example, when a customer makes a transfer via mobile banking, the business system writes the paying account, receiving account, and corresponding value changes as the first transaction data into the database. In another embodiment, when a customer makes a deposit or withdrawal at a branch, account information and data change information are also generated and written to the first database simultaneously. In this way, the first database can accumulate complete transaction details in real time, laying the data foundation for subsequent analysis.

[0028] S120, Update the log file of the first database according to the newly added first transaction data in the first database.

[0029] In this embodiment, after the newly added first transaction data is written to the first database, the database system of the first database will automatically update the log file of the first database. The log file may include the timestamp of the transaction operation, the operation type of the transaction operation, and related metadata.

[0030] When multiple transaction operations occur, the log file can be updated in the order in which the transactions happen, writing the log corresponding to each new transaction to disk so that data can be replayed or recovered later. For example, when the transaction data corresponding to a transfer operation is written to the database, a log entry is simultaneously generated, recording the transfer operation type, the time the transaction data was written, and the account information involved in the transfer operation. Similarly, when batch transaction operations occur, the log file will also be updated synchronously according to the execution order of multiple transaction operations to ensure complete recording of batch processing.

[0031] S130, parse the updated log file to obtain the first transaction data corresponding to the updated log file.

[0032] In this embodiment, after detecting an update to the log file, the log file can be parsed to obtain the newly added first transaction data. For example, the parsing process may include identifying the operation type in the log file, extracting the corresponding field values, and constructing the complete first transaction data.

[0033] For example, the first database can be an Oracle database. When data changes such as adding, modifying, or deleting data are performed in the first database, these data changes are recorded in the redo log of the first database. Then, OGG (Oracle GoldenGate) technology can be used to read these redo logs in real time through a capture process, extract the data changes contained therein, and transform them into structured incremental data for transmission to downstream systems.

[0034] When a user initiates a transaction in the business system, the first transaction data corresponding to that transaction is written to the Oracle database log file. The OGG tool then parses the log file in real time, extracting key information from the newly added first transaction data. This key information may include account identifier, operation time, and change value, and is used to generate the first transaction data. This log-based capture method allows for real-time acquisition of incremental data from the upstream database without directly scanning the database content, ensuring the timeliness and completeness of data collection.

[0035] S140, the first transaction data is analyzed and processed through a calculation model to obtain the evaluation index corresponding to the first transaction data.

[0036] In this embodiment, after parsing the updated log file and obtaining the first transaction data corresponding to the updated log file, the first transaction data can be processed by a computational model to obtain an evaluation index for the first transaction data. This evaluation index is used to characterize the features of this transaction operation. The computational model is a logical processing model used to output corresponding analysis results for different types of data scenarios. The computational model may include a rule model, a classification model, or a statistical model.

[0037] In one embodiment, if an account has multiple consecutive short-term transactions, the computational model can output evaluation indicators for high-frequency trading; in another embodiment, if the account has cross-regional transactions, the computational model can output evaluation indicators for cross-regional operations.

[0038] S150, if the evaluation index meets the preset conditions, the first transaction data is stored in the result area of ​​the second database, and the multiple transaction data are sorted according to the recording time of the multiple transaction data in the result area to obtain multiple transaction data arranged in chronological order, wherein the multiple transaction data includes the first transaction data.

[0039] In this embodiment, when the evaluation indicators meet preset conditions, the first transaction data that meets the preset conditions can be stored in the result area of ​​the second database. The result area of ​​the second database also includes multiple previously stored transaction data. Whenever new transaction data is stored in the result area of ​​the second database, all transaction data in the result area can be sorted by recording time to generate dynamic data arranged in chronological order. The second database can be an HBase database, and the result area can be a result column family of the HBase database.

[0040] For example, if a customer makes a transaction on September 1, September 5, and September 10 that meets the preset conditions for the evaluation indicators, the transaction data corresponding to these three transactions will be stored in the results area in chronological order.

[0041] S160, generate early warning information based on the multiple transaction data arranged in chronological order.

[0042] In this embodiment, whenever new transaction data is stored in the result area of ​​the second database, all transaction data in the result area can be sorted by recording time to generate dynamic data arranged in chronological order. Since the dynamic data arranged in chronological order is dynamic analysis data based on the time dimension, it can continuously update and add new transaction data over time, thus reflecting the trajectory of transaction data changes over time.

[0043] Based on existing time-series transaction data, the system can identify abnormal behavior patterns and generate early warning information. This warning information can include the transaction account, operation time, pre-defined conditions met, and corresponding evaluation indicators. For example, if a customer makes frequent large-amount transactions within a short period, the system will immediately generate an early warning, prompting staff to investigate. Similarly, if an account operates across regions, it may also generate a warning with a risk flag.

[0044] In this embodiment, upon detecting an update to the log file in the first database of the business system, newly added first transaction data is acquired in real time from the first database. A risk assessment is then performed on the first transaction data based on the corresponding calculation model to obtain assessment indicators. If the assessment indicators of the first transaction data meet preset conditions, the first transaction data is written to the result area of ​​the second database. Multiple transaction data are then sorted chronologically, and an early warning message is generated based on the chronologically arranged transaction data. This method, because the transaction data in the first database is collected and assessed incrementally in real time, without waiting for the end of the day for batch processing of business data, enables rapid generation of early warnings when transaction data poses a risk, improving the real-time nature of the early warning information.

[0045] As an optional embodiment, the step of analyzing and processing the first transaction data through a computational model to obtain the evaluation index corresponding to the first transaction data includes: Determine the data characteristics of the first transaction data; The calculation model corresponding to the first transaction data is determined based on the data characteristics of the first transaction data; The first transaction data is analyzed and processed using the calculation model corresponding to the first transaction data to obtain the evaluation index corresponding to the first transaction data.

[0046] In this embodiment, data features refer to the attribute information in transaction data that reflects the essence of the business, such as transaction direction, numerical value, operation time, and operation channel. These data features determine which calculation model to use to analyze the first transaction data. A calculation model is a set of rules based on preset logic or algorithms used to process transaction data with specific data features. For example, in a transaction, if the data feature includes a numerical value greater than a first threshold, it indicates a large transaction value, and a large transaction analysis model can be selected. This model focuses more on the impact of large transactions on account stability or business processes, such as analyzing the frequency and time distribution of large transactions, or combining historical data to determine whether there are concentrated large transactions. If the data feature includes a numerical value less than a second threshold, it indicates a small transaction value, and a small transaction analysis model can be selected. This model is more suitable for identifying scattered operations or frequent small activities. In another scenario, data features can also be represented by the time interval of the transaction, such as transactions occurring in the early morning or cross-border transactions. These features also influence the choice of model.

[0047] Once the computational model is determined, it can be used to analyze and process the first transaction data, thereby outputting corresponding evaluation indicators. Evaluation indicators are quantitative expressions of the behavioral characteristics of transaction data; they can be numerical indicators or categorical results. For example, after analysis by the computational model, the output evaluation indicators for a particular transaction might be a transaction frequency score, a transaction value range level, or a transaction behavior label. In another embodiment, the evaluation indicators can also be statistical results, such as the number of similar transactions within the past week, or the proportion occurring through different channels.

[0048] These evaluation metrics enable the system to abstract raw data into standardized results, facilitating comparison with preset conditions.

[0049] As an optional embodiment, determining the data characteristics of the first transaction data includes: Determine the subject of the first transaction data; The first transaction data is stored in the message queue corresponding to the topic; If there is newly added first transaction data in the message queue, the newly added first transaction data in the message queue is parsed to obtain the data characteristics of the first transaction data.

[0050] In this embodiment, the topic of transaction data is used to characterize the category of transaction data. For example, the topic may include "transfer transaction", "deposit and withdrawal transaction" or "payment transaction". For each topic of transaction data, a corresponding message queue can be set up.

[0051] Therefore, whenever a new transaction is detected in the first database, the topic of that transaction can be determined, and the transaction data is stored in the message queue corresponding to that topic. The message queue is an asynchronous communication mechanism used to temporarily store and transmit messages, decoupling transaction data between the producer and consumer ends. The message queue can be a Kafka queue.

[0052] When a new first transaction is detected in the message queue, the system automatically triggers a parsing process to extract key data features from it. This parsing process may include identifying the transaction data format, separating fields, and extracting feature values. For example, for a transfer transaction record, parsing can extract features such as transaction time, transfer amount, transaction direction, and account identifier.

[0053] In this embodiment, by determining the topic corresponding to the transaction data, storing it in the message queue, and parsing its data features, the classification management and real-time feature extraction of different types of data are realized.

[0054] As an optional embodiment, the data features include account change features, and the step of determining the calculation model corresponding to the first transaction data based on the data features of the first transaction data includes: The business type in the target account is determined based on the account change characteristics in the target account corresponding to the first transaction data; The calculation model corresponding to the first transaction data is determined based on the business type.

[0055] In this embodiment, account change characteristics refer to the directional change in the value of a target account after a transaction occurs. For example, a decrease in account resource value can be considered a transfer-out characteristic, while an increase can be considered a transfer-in characteristic. This characteristic can intuitively reflect the basic nature of the transaction. For instance, in a payment scenario, the paying account exhibits a transfer-out characteristic, while the receiving account exhibits a transfer-in characteristic. In another embodiment, a user account shows an increase in resources when making a top-up transaction, and a decrease in resources when making a withdrawal. By identifying account change characteristics, the system can determine the business type of the transaction, thereby providing input for subsequent model selection.

[0056] Business types can be categorized based on the results of account changes. For example, business types can be divided into resource transfer-out business and resource transfer-in business. Resource transfer-out business mainly includes operations such as payments and transfers from an account to external systems or other accounts, while resource transfer-in business includes operations such as accounts receiving top-ups and fund returns from external sources.

[0057] After determining the business type, the system can select the corresponding calculation model based on the business type of the first transaction data. The calculation model can be an analysis method or set of rules designed for a specific business type. For example, when the business type is a transfer-out transaction, a calculation model specifically analyzing account outflows can be selected, which will focus on characteristics such as the frequency of large-amount transfers and concentrated transfers; when the business type is a transfer-in transaction, a calculation model analyzing account inflows can be selected, which may statistically analyze multiple consecutive inflows and transactions from abnormal sources.

[0058] In this embodiment, the accuracy of the analysis process can be guaranteed by this business type-based calculation model selection mechanism, enabling refined classification and dynamic processing of transaction behavior, and providing a reliable basis for the generation of subsequent early warnings.

[0059] As an optional embodiment, determining the calculation model corresponding to the first transaction data based on the business type includes: When the business type of the target account is to transfer resources out of the target account, the first calculation model is determined to be the calculation model corresponding to the first transaction data, wherein the first calculation model is an analysis model for resource transfer-out transactions; When the business type of the target account is the transfer of resources from the target account, the second calculation model is determined as the calculation model corresponding to the first transaction data, wherein the second calculation model is an analysis model for resource transfer transactions.

[0060] In this embodiment, since the business type can reflect the behavioral characteristics of an account in a transaction, for example, when an account transfers resources out, the business type of the account can be identified as resource transfer out; when an account transfers resources in, the business type of the account can be identified as resource transfer in.

[0061] When the target account's business type is resource outflow, the system selects the first calculation model, which analyzes resource outflow scenarios. For example, the first calculation model can focus on the frequency, concentration, and amount characteristics of outflow operations. Conversely, when the target account's business type is resource inflow, the system selects the second calculation model, which is used for characteristic analysis of resource inflow behavior. For example, the analysis model for resource inflow transactions can identify the number of inflows, the sources of inflows, and their regularity within a certain period.

[0062] By mapping business types to different computational models, the system can implement differentiated processing mechanisms for different accounts, allowing different computational models to perform better in their respective scenarios. This design improves the accuracy of model invocation, resulting in more accurate analytical results output by the computational models.

[0063] As an optional embodiment, after analyzing and processing the first transaction data through a computational model to obtain the evaluation index corresponding to the first transaction data, the method further includes: If the evaluation indicators do not meet the preset conditions, the first transaction data will be stored in the cumulative area of ​​the second database.

[0064] In this embodiment, the preset conditions are a set of pre-defined judgment logic used to determine whether the evaluation indicators of transaction data possess specific characteristics. Specifically, the preset conditions may include whether the evaluation indicator matches a pre-set rule model. If it matches the rule model, the evaluation indicator is considered to meet the preset conditions; otherwise, it is considered not to meet the preset conditions. For example, the preset conditions may include a single transaction value greater than 1 million yuan, or more than 5 consecutive transactions occurring within 10 minutes by the same account.

[0065] When the evaluation metrics do not meet the preset conditions, the first transaction data can be stored in the cumulative area of ​​the second database, thus ensuring that these transaction data that do not yet meet the preset conditions are not directly discarded. The second database can be an HBase database, and the result area can be the result column family of the HBase database.

[0066] With this design, the data processing system can temporarily retain transaction data that does not meet preset conditions, avoiding data omissions and enabling the system to maintain real-time performance while ensuring the integrity of long-term analysis.

[0067] As an optional embodiment, after storing the first transaction data in the cumulative area of ​​the second database when the evaluation metric does not meet the preset conditions, the method further includes: If the preset conditions are updated, it is re-determined whether the first transaction data in the cumulative area meets the updated preset conditions; If the first transaction data in the cumulative area meets the preset conditions after the update, the first transaction data in the cumulative area is transferred to the result area of ​​the second database.

[0068] In this embodiment, the preset conditions are not fixed, but can be updated according to the user's settings. When the preset conditions are updated, the system will re-evaluate whether the data in the cumulative area meets the updated conditions.

[0069] For example, when the threshold of the preset conditions is reduced from 1 million yuan to 500,000 yuan, transaction data between 500,000 yuan and 1 million yuan, previously stored in the cumulative area, will be re-identified and transferred to the results area. In this way, as the preset rules are continuously adjusted, the system can dynamically reintegrate historical transaction data into the analysis scope.

[0070] Through this reassessment and transfer of transaction data, the accumulated regional transaction data can flexibly adapt to changes in conditions, enabling multiple uses of the transaction data and improving the comprehensiveness and accuracy of early warnings.

[0071] As an optional embodiment, the step of storing the first transaction data in the result area of ​​the second database includes: Obtain the recording time of the first transaction data and the key information of the first transaction data, wherein the key information is field information that identifies the object or event to which the corresponding transaction data belongs; By associating the recording time with the key information, the row key information corresponding to the first transaction data is obtained; The row key information is stored in the result area of ​​the second database.

[0072] In this embodiment, during the process of storing the first transaction data into the result area of ​​the second database, it is first necessary to obtain the recording time and key information of the first transaction data. The recording time reflects the specific point in time when the transaction operation corresponding to the first transaction data occurred; the key information is the core field that identifies the object or event to which the transaction data belongs, such as the account number, customer number, or transaction serial number in the first transaction data. For example, in a transfer operation, the recording time is the specific timestamp of the transaction, and the key information can be the payment account number or customer number.

[0073] Secondly, after obtaining the recording time and key information of the first transaction data, the recording time and key information can be associated to generate the row key information of that first transaction data. The row key is a unique identifier for locating data in a distributed column-oriented storage database; it is composed of a combination of multiple fields. In this embodiment, the row key is generated by concatenating or encoding the recording time and key information. For example, a customer number and transaction time can be combined to form the row key information "20250923_Customer12345". Furthermore, the row key information can also be optimized for data distribution through hashing or prefix design to prevent hotspot issues in the distributed system.

[0074] Finally, the generated row key information can be stored in the results area. Since the results area contains row key information for multiple transaction data, a dynamic data link can be generated in chronological order based on this row key information to reflect the behavioral trajectory of a user at different times.

[0075] By using the above method, transaction data is constructed into row keys based on recorded time and key information and stored in the results area, which enhances the system's ability to perform time-series analysis of transaction behavior and facilitates subsequent rapid data retrieval and dynamic early warning generation.

[0076] Based on the method for generating early warning information provided in the above embodiments, this application also provides specific implementation methods for the device for generating early warning information. Please refer to the following embodiments.

[0077] First see Figure 2 The warning information generation device 200 provided in this application embodiment includes the following modules: The first storage module 201 is used to store the account information and data change information of the account associated with the transaction operation as the first transaction data in the first database of the business system when a transaction operation is detected in the business system. Update module 202 is used to update the log file of the first database according to the newly added first transaction data in the first database; The parsing module 203 is used to parse the updated log file to obtain the first transaction data corresponding to the updated log file; Analysis module 204 is used to analyze and process the first transaction data through a calculation model to obtain the evaluation index corresponding to the first transaction data. The second storage module 205 is used to store the first transaction data in the result area of ​​the second database when the evaluation index meets the preset conditions, and sort the multiple transaction data according to the recording time of the multiple transaction data in the result area to obtain multiple transaction data arranged in chronological order, wherein the multiple transaction data includes the first transaction data. The generation module 206 is used to generate early warning information based on the multiple transaction data arranged in chronological order.

[0078] In this embodiment, upon detecting an update to the log file of the first database in the business system, newly added first transaction data in the first database can be acquired in real time. A risk assessment is then performed on the first transaction data based on the corresponding calculation model to obtain assessment indicators. If the assessment indicators of the first transaction data meet preset conditions, the first transaction data is written to the result area of ​​the second database. Multiple transaction data are then sorted chronologically, and an early warning message is generated based on the chronologically arranged transaction data. In this way, because the transaction data in the first database is collected and assessed incrementally in real time, without waiting for the end of the day for batch processing of business data, early warnings can be generated quickly when transaction data poses a risk, improving the real-time nature of the early warning information.

[0079] As one implementation of this application, the analysis module 204 may further include: The first determining unit is used to determine the data characteristics of the first transaction data; The second determining unit is used to determine the calculation model corresponding to the first transaction data based on the data characteristics of the first transaction data. The analysis unit is used to analyze and process the first transaction data through the calculation model corresponding to the first transaction data to obtain the evaluation index corresponding to the first transaction data.

[0080] As one implementation of this application, the first determining unit may further include: The first determining subunit is used to determine the subject of the first transaction data; The first storage subunit is used to store the first transaction data into the message queue corresponding to the topic; The parsing subunit is used to parse the newly added first transaction data in the message queue when there is newly added first transaction data in the message queue, so as to obtain the data characteristics of the first transaction data.

[0081] As one implementation of this application, the second determining unit may further include: The second determining subunit is used to determine the business type in the target account based on the account change characteristics in the target account corresponding to the first transaction data. The third determining subunit is used to determine the calculation model corresponding to the first transaction data according to the business type.

[0082] As one implementation of this application, the aforementioned third determining subunit is specifically used for: When the business type of the target account is to transfer resources out of the target account, the first calculation model is determined to be the calculation model corresponding to the first transaction data, wherein the first calculation model is an analysis model for resource transfer-out transactions; When the business type of the target account is the transfer of resources from the target account, the second calculation model is determined as the calculation model corresponding to the first transaction data, wherein the second calculation model is an analysis model for resource transfer transactions.

[0083] As one implementation of this application, the aforementioned warning information generation device 200 may further include: No. Two storage The module is used to store the first transaction data in the cumulative area of ​​the second database when the evaluation index does not meet the preset conditions.

[0084] As one implementation of this application, the aforementioned warning information generation device 200 may further include: The determination module is used to re-determine whether the first transaction data in the cumulative area meets the updated preset conditions when the preset conditions are updated. The transfer module is used to transfer the first transaction data in the cumulative area to the result area of ​​the second database when the first transaction data in the cumulative area meets the preset conditions after the update.

[0085] As one implementation of this application, the second storage module is specifically used for: Obtain the recording time of the first transaction data and the key information of the first transaction data, wherein the key information is field information that identifies the object or event to which the corresponding transaction data belongs; By associating the recording time with the key information, the row key information corresponding to the first transaction data is obtained; The row key information is stored in the result area of ​​the second database.

[0086] The warning information generation device provided in this embodiment of the invention can implement the steps in the above method embodiments, and will not be repeated here to avoid repetition.

[0087] Figure 3 A schematic diagram of the hardware structure of the warning information generation device provided in an embodiment of this application is shown.

[0088] The device for generating early warning information may include a processor 1001 and a memory 1002 storing computer program instructions.

[0089] Specifically, the processor 1001 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0090] Memory 1002 may include mass storage for data or instructions. For example, and not limitingly, memory 1002 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 1002 may include removable or non-removable (or fixed) media. Where appropriate, memory 1002 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 1002 is non-volatile solid-state memory.

[0091] Memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the methods according to one aspect of this disclosure.

[0092] The processor 1001 reads and executes computer program instructions stored in the memory 1002 to implement any of the warning information generation methods in the above embodiments.

[0093] In one example, the device for generating early warning information may further include a communication interface 1003 and a bus 1010. For example, Figure 3As shown, the processor 1001, memory 1002, and communication interface 1003 are connected through bus 1010 and complete communication with each other.

[0094] The communication interface 1003 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0095] Bus 1010 includes hardware, software, or both, that couples components of the device generating the warning information together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 1010 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0096] The device for generating the early warning information can be based on the above embodiments, thereby realizing the method and apparatus for generating early warning information combined with the above.

[0097] Furthermore, in conjunction with the warning information generation method in the above embodiments, this application embodiment can provide a computer storage medium for implementation. This computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the warning information generation methods in the above embodiments and achieve the same technical effect. To avoid repetition, further details are omitted here. The aforementioned computer-readable storage medium may include non-transitory computer-readable storage media, such as read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks, etc., and is not limited thereto.

[0098] In addition, this application also provides a computer program product, including computer program instructions, which, when executed by a processor, can implement the steps and corresponding content of the aforementioned method embodiments.

[0099] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0100] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0101] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0102] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus, and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0103] The above are merely specific embodiments of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for generating early warning information, characterized by the following data features: The method includes: Upon detecting a transaction operation in the business system, the account information and data change information of the account associated with the transaction operation are stored as the first transaction data in the first database of the business system. Update the log file of the first database according to the newly added first transaction data in the first database; Parse the updated log file to obtain the first transaction data corresponding to the updated log file; The first transaction data is analyzed and processed using a computational model to obtain the evaluation indicators corresponding to the first transaction data. When the evaluation indicators meet the preset conditions, the first transaction data is stored in the result area of ​​the second database, and the multiple transaction data are sorted according to the recording time of the multiple transaction data in the result area to obtain multiple transaction data arranged in chronological order, wherein the multiple transaction data includes the first transaction data. An early warning message is generated based on the multiple transaction data arranged in chronological order.

2. The method for generating early warning information according to claim 1, characterized in that, The step of analyzing and processing the first transaction data through a computational model to obtain the evaluation indicators corresponding to the first transaction data includes: Determine the data characteristics of the first transaction data; The calculation model corresponding to the first transaction data is determined based on the data characteristics of the first transaction data; The first transaction data is analyzed and processed using the calculation model corresponding to the first transaction data to obtain the evaluation index corresponding to the first transaction data.

3. The method for generating early warning information according to claim 2, characterized in that, The determination of the data characteristics of the first transaction data includes: Determine the subject of the first transaction data; The first transaction data is stored in the message queue corresponding to the topic; If there is newly added first transaction data in the message queue, the newly added first transaction data in the message queue is parsed to obtain the data characteristics of the first transaction data.

4. The method for generating early warning information according to claim 2, characterized in that, The data features include account change features, and the step of determining the calculation model corresponding to the first transaction data based on the data features of the first transaction data includes: The business type in the target account is determined based on the account change characteristics in the target account corresponding to the first transaction data; The calculation model corresponding to the first transaction data is determined based on the business type.

5. The method for generating early warning information according to claim 4, characterized in that, The step of determining the calculation model corresponding to the first transaction data based on the business type includes: When the business type of the target account is to transfer resources out of the target account, the first calculation model is determined to be the calculation model corresponding to the first transaction data, wherein the first calculation model is an analysis model for resource transfer-out transactions; When the business type of the target account is the transfer of resources from the target account, the second calculation model is determined as the calculation model corresponding to the first transaction data, wherein the second calculation model is an analysis model for resource transfer transactions.

6. The method for generating early warning information according to claim 1, characterized in that, After analyzing and processing the first transaction data through a computational model to obtain the evaluation indicators corresponding to the first transaction data, the method further includes: If the evaluation indicators do not meet the preset conditions, the first transaction data will be stored in the cumulative area of ​​the second database.

7. The method for generating early warning information according to claim 6, characterized in that, After storing the first transaction data in the cumulative area of ​​the second database when the evaluation indicator does not meet the preset conditions, the method further includes: If the preset conditions are updated, it is re-determined whether the first transaction data in the cumulative area meets the updated preset conditions; If the first transaction data in the cumulative area meets the preset conditions after the update, the first transaction data in the cumulative area is transferred to the result area of ​​the second database.

8. The method for generating early warning information according to claim 1, characterized in that, The result area for storing the first transaction data in the second database includes: Obtain the recording time of the first transaction data and the key information of the first transaction data, wherein the key information is field information that identifies the object or event to which the corresponding transaction data belongs; By associating the recording time with the key information, the row key information corresponding to the first transaction data is obtained; The row key information is stored in the result area of ​​the second database.

9. A device for generating early warning information, characterized in that, The device includes: The first storage module is used to store the account information and data change information of the account associated with the transaction operation as the first transaction data in the first database of the business system when a transaction operation is detected in the business system. The update module is used to update the log file of the first database based on the newly added first transaction data in the first database; The parsing module is used to parse the updated log file to obtain the first transaction data corresponding to the updated log file; The analysis module is used to analyze and process the first transaction data through a calculation model to obtain the evaluation indicators corresponding to the first transaction data. The second storage module is configured to, when the evaluation index meets the preset conditions, store the first transaction data in the result area of ​​the second database, and sort the multiple transaction data according to the recording time of the multiple transaction data in the result area to obtain multiple transaction data arranged in chronological order, wherein the multiple transaction data includes the first transaction data. The generation module is used to generate early warning information based on the multiple transaction data arranged in chronological order.

10. A device for generating early warning information, characterized in that, The device for generating the early warning information includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the method for generating early warning information as described in any one of claims 1-8.

11. A computer storage medium, characterized in that, The computer storage medium stores computer program instructions, which, when executed by a processor, implement the method for generating early warning information as described in any one of claims 1-8.

12. A computer program product, characterized in that, The computer program product includes computer program instructions, which, when executed by a processor, implement the method for generating early warning information as described in any one of claims 1-8.

Images