A risk control message intelligent analysis system and method based on service characteristics

Abstract

The application discloses a kind of based on business feature's risk control message intelligent analysis system and method, it is related to intelligent analysis technical field.The system of the present application includes: core feature extraction module, mapping library construction module, exclusive dimension locking module, risk control message determination module and result output module;The method of the present application extracts message source, transmission and content verification feature by layering, constructs three-dimensional feature-determination dimension mapping library, locks exclusive dimension by secondary positioning and excludes irrelevant items, calculates dimension abnormality and comprehensive abnormality according to priority, executes targeted determination and outputs timeliness, authenticity result and abnormal prompt.The present application solves the problem of poor generalization adaptation and redundant verification in traditional risk control, improves the accuracy and efficiency of determination, and adapts to the risk control needs of multiple scenarios.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent analysis, in particular to a risk control message intelligent analysis system and method based on business characteristics. BACKGROUND

[0002] As the core data carrier of risk prevention and control and compliance verification, the timeliness and authenticity of the risk control message directly determine the accuracy and effectiveness of the risk control decision. Various businesses have high frequency and cross-scene characteristics, and different scenes have significant differences in the effective time window and verification standard of the risk control message. For example, real-time business scenarios require messages to be verified within a millisecond time window, while non-real-time business scenarios can allow a shorter time window buffer. Cross-subject interaction messages need to focus on verifying the validity of the signature, while internal circulation messages focus on content integrity verification.

[0003] However, the existing risk control message analysis technology generally uses a universal judgment framework and does not design exclusive logic for the differentiated needs of the scene. On the one hand, the timeliness judgment lacks scene-based threshold standards and is uniformly verified according to a fixed time window, resulting in ineffective messages not being filtered in real-time scenarios and valid messages being mistakenly judged as invalid in non-real-time scenarios. On the other hand, authenticity verification relies on a single dimension and does not integrate multi-dimensional verification such as source legitimacy, content integrity, and signature validity in combination with scene characteristics, making it easy for tampered messages and fake source messages to evade verification.

[0004] In addition, the existing technology does not explicitly define the core verification points, and redundant verification of irrelevant items occupies computing resources, resulting in delayed risk control response and missing key verification links that can cause missed judgment risks. It cannot adapt to the dual needs of risk control accuracy and efficiency for various business scenarios. Therefore, there is an urgent need for a scene-based analysis scheme based on business characteristics to achieve targeted judgment of the timeliness and authenticity of risk control messages and to solve the defects of traditional universal frameworks to ensure compliance and security in business operations. SUMMARY

[0005] The purpose of the present application is to provide a risk control message intelligent analysis system and method based on business characteristics to solve the problems raised in the background art.

[0006] To solve the above technical problems, the present application provides the following technical solutions:

[0007] A risk control message intelligent analysis method based on business characteristics, comprising the following steps:

[0008] S1. Collect risk control messages generated under various scenes, extract core information related to timeliness and authenticity judgment according to feature priority, first extract message source attributes as core positioning features, then extract message transmission attributes and content verification attributes as precise adaptation features, and all attributes are obtained through preset field analysis in the risk control message;

[0009] S2. Pre-build a feature-judgment dimension mapping library. Based on the timeliness and authenticity differences of risk control messages in different scenarios, configure exclusive judgment dimensions for each feature combination. The judgment dimensions are set around time consistency, source legality, content integrity, and signature validity. The exclusive dimensions of each feature combination are directly adapted to the timeliness and authenticity judgment requirements of the corresponding scenario.

[0010] S3. Based on the extracted message source attributes, the feature combination set in the mapping library is initially screened, and then the message transmission attributes and content verification attributes are combined for secondary positioning to lock the unique judgment dimension corresponding to the current risk control message and automatically exclude irrelevant dimensions.

[0011] S4. Based on the timeliness and authenticity verification points corresponding to the exclusive judgment dimensions, call the preset verification rules to make targeted judgments on risk control messages, focus on the core verification points to complete the judgment process, determine whether the message is timely and whether it is a real message, and output clear timeliness judgment results, authenticity judgment results and abnormal prompt information.

[0012] Furthermore, S1 includes the following:

[0013] The collected risk control messages are preprocessed to filter out invalid messages with missing fields or abnormal formats, and retain valid risk control messages with complete fields and compliant formats.

[0014] The message source attribute is extracted from the preset fields of the valid risk control message. The core positioning feature attribute is determined by calculating the source discrimination degree D of the attribute. The source discrimination degree calculation formula is: D=(K×H) / N, where K is the number of scenario categories that the message source attribute can be divided into, H is the entropy value of the message proportion in each scenario corresponding to the attribute, H=-∑(pi×log2pi), where i takes from 1 to K, pi is the message proportion of the i-th scenario corresponding to the attribute, and pi=the number of messages in the i-th scenario / the total number of valid risk control messages, N is the total number of all scenario categories; a threshold Td is set. When D≥Td, the message source attribute is determined to be the core positioning feature.

[0015] The message transmission attribute and the content verification attribute are respectively extracted from preset fields of an effective risk control message, a correlation coefficient R of the two types of attributes and a scene category is calculated, and the correlation coefficient calculation formula is: R=Cov(X,Y) / (Var(X)×Var(Y))^(1 / 2), wherein X is a quantitative value of the scene category, different scenes correspond to unique quantitative identifiers; Y is a quantitative value of a value to be determined attribute, Cov(X,Y) is a covariance of X and Y, Var(X) is a variance of X, and Var(Y) is a variance of Y; a threshold interval [T1, T2] is set, when T1≤R<T2, it is determined that the message transmission attribute and the content verification attribute are precise adaptation features, and core information layer extraction related to timeliness and authenticity determination is completed; wherein the threshold Td and the threshold interval [T1, T2] need to be adjusted according to actual conditions, and relevant personnel can determine them through routine experiments or industry experience.

[0016] Further, S2 includes the following content:

[0017] Based on the message source attribute, the message transmission attribute and the content verification attribute extracted in S1, a three-dimensional scene feature combination set is constructed, each combination corresponds to a unique risk control message determination scene, denoted as feature combination T, and T={T1, T2,..., Tn}, wherein T1 is the first feature combination, T2 is the second feature combination, and so on, Tn is the nth feature combination, and n is the total number of feature combinations;

[0018] The determination weight Wj of each feature combination Tj is quantified, and j takes 1 to n, specifically including:

[0019] The scene occurrence frequency fj is calculated, and fj=NTj / NT, wherein NTj is the number of risk control messages corresponding to Tj in T period, NT is the total number of risk control messages of all scene combinations in T period, T is a historical statistical period, and is specifically set according to actual business routine period;

[0020] The determination influence degree quantization value Ij is calculated, and Ij=α×cj+β×rj, wherein α is a timeliness failure weight coefficient, β is a message forgery weight coefficient, and α+β=1; cj is the number of timeliness failure messages corresponding to Tj in T period / the total number of messages corresponding to Tj in T period, which is the timeliness failure coefficient of the feature combination Tj; rj is the number of forged messages corresponding to Tj in T period / the total number of messages corresponding to Tj in T period, which is the message forgery coefficient of the feature combination Tj;

[0021] The determination weight Wj is calculated, and Wj=γ×fj+δ×Ij, wherein γ is an occurrence frequency weight coefficient, δ is an influence degree weight coefficient, and γ+δ=1;

[0022] A weight threshold W0 is set, when Wj≥W0, four judgment dimensions of time consistency, source legitimacy, content integrity and signature validity are configured for the feature combination Tj; when WjW0, 2-3 judgment dimensions are selected from the above four judgment dimensions, wherein cj corresponds to the time consistency dimension, and rj corresponds to the source legitimacy and content integrity dimensions; if cj>0 and rj>0, three dimensions of time consistency, source legitimacy and content integrity are selected; if cj>0 and rj=0, two dimensions of time consistency and source legitimacy are selected; if cj=0 and rj>0, two dimensions of source legitimacy and content integrity are selected.

[0023] A mapping relationship table of the feature combination and the exclusive judgment dimension is established, the dimension set corresponding to each feature combination Tj and the dimension checking order are determined, and a feature-judgment dimension mapping library is formed; the values of α, β, γ, δ and W0 are determined by relevant personnel according to the business judgment accuracy requirement, the system performance requirement and through conventional experiment calibration.

[0024] Further, S3 includes the following contents:

[0025] The message source attribute obtained in S1 is extracted, and a current attribute set A1 is constructed; the matching degree Sm1 of A1 and the message source attribute set B1 of each feature combination Tj in the feature-judgment dimension mapping library is calculated, and the calculation formula is Sm1=|A1∩B1| / |A1∪B1|, wherein |A1∩B1| is the number of intersection elements of A1 and B1, and |A1∪B1| is the number of union elements of A1 and B1; a matching degree threshold Y1 is set, and the feature combinations with Sm1≥Y1 are screened out to form a preliminary candidate set Tcd;

[0026] For each feature combination Tj in the candidate set Tcd, a current message transmission attribute set A2 and a content verification attribute set A3 are constructed, and the transmission attribute set B2 and the content verification attribute set B3 of the corresponding combination in the mapping library are constructed; the transmission attribute matching degree Sm2 and the content verification attribute matching degree Sm3 are calculated according to the calculation formula of Sm1;

[0027] The comprehensive matching degree Smz is calculated, and the formula is Smz=a1×Sm1+a2×Sm2+a3×Sm3, wherein a1 is the message source attribute matching weight, a2 is the message transmission attribute matching weight, a3 is the content verification attribute matching weight, and a1+a2+a3=1, a1>a2, a1>a3, and the weight advantage of the core positioning feature is highlighted;

[0028] A comprehensive matching degree threshold Y2 is set, and the feature combinations with Smz≥Y2 in Tcd are screened out; if there are multiple combinations meeting the condition, the feature combination corresponding to the maximum Smz value is selected as the target feature combination, and the exclusive judgment dimension corresponding to the combination is locked;

[0029] The other dimensions in the feature-determination dimension mapping library except the target feature combination corresponding exclusive determination dimension are marked as irrelevant dimensions, which are automatically excluded through the dimension shielding mechanism, and only the target exclusive determination dimension is reserved for subsequent verification; the values of Y1, Y2, a1, a2, and a3 are determined by relevant personnel according to scene distinguishing accuracy requirements and system determination efficiency requirements through conventional experiments.

[0030] Further, S4 includes the following content:

[0031] The target feature combination corresponding exclusive determination dimension and dimension verification priority sequence locked in S3 are obtained, and the invalid verification items with missing or abnormal format field data are removed from the extracted each exclusive determination dimension corresponding to the to-be-verified field data in the effective risk control message of S1.

[0032] For each exclusive determination dimension, the determination abnormality Yc is calculated, where c is the exclusive determination dimension sequence number, and the calculation formula is: Yc = |Sc-Bc| / Bc, where Sc is the actual value of the to-be-verified field of the dimension, and Bc is the normal reference value corresponding to the dimension, which is determined based on the business determination standard and historical effective message data statistics; the value range of Yc is [0, +∞), and the larger the value is, the higher the degree of timeliness or truth-falsity abnormality corresponding to the dimension is.

[0033] The determination is performed in turn from high to low according to the dimension verification priority, specifically: the dimension with the highest priority is determined first, and the abnormality threshold Yt is set, if Yc≥Yt, the corresponding abnormal type is directly marked and the warning is triggered, specifically the timeliness abnormality or the truth-falsity abnormality; if Yc

[0034] The comprehensive abnormality Yz of all exclusive dimensions is calculated, and the formula is: Yz = ∑(uc×Yc), where c takes 1 to m, and m is the number of exclusive determination dimensions; uc is the risk weight of the cth dimension, and ∑uc=1, the value of uc is positively correlated with the dimension priority, and the higher the priority is, the larger uc is; the comprehensive abnormality threshold Yh is set, if Yz≥Yh, the explicit timeliness determination result, truth-falsity determination result, and abnormal prompt information are output, wherein the abnormal prompt information includes the abnormal dimension and the corresponding abnormality; if Yz

[0035] The application discloses a risk control message intelligent analysis system based on business characteristics, which comprises a core feature extraction module, a mapping library construction module, an exclusive dimension locking module, a risk control message judgment module and a result output module.

[0036] The core feature extraction module is used for collecting risk control messages of various scenes, extracting core attributes related to timeliness and authenticity after preprocessing, determining core positioning features and accurate adaptive features, and performing hierarchical extraction according to priorities.

[0037] The mapping library construction module is used for constructing a combined set based on the extracted three-dimensional features, quantifying the combined judgment weight, configuring exclusive judgment dimensions, and establishing a mapping relationship library of features and dimensions.

[0038] The exclusive dimension locking module is used for preliminarily screening candidate combinations through source attributes, combining transmission and verification attributes for secondary positioning, locking exclusive judgment dimensions of the current message and excluding irrelevant dimensions.

[0039] The risk control message judgment module is used for extracting fields to be verified, calculating the abnormality degrees of various dimensions, performing targeted judgment according to priorities, and calculating the comprehensive abnormality degree.

[0040] The result output module is used for outputting timeliness, authenticity conclusions and abnormality prompt information according to the judgment results.

[0041] Further, the core feature extraction module comprises a message preprocessing unit and a feature hierarchical extraction unit.

[0042] The message preprocessing unit is used for collecting risk control messages of various scenes, filtering invalid messages with missing fields and abnormal formats, and retaining valid messages with complete fields and compliant formats. The feature hierarchical extraction unit is used for extracting message sources, transmission and content verification attributes from the valid messages, determining core positioning features and accurate adaptive features through feature discrimination degree and scene correlation judgment.

[0043] Further, the mapping library construction module comprises a feature combination construction unit and an exclusive dimension configuration unit.

[0044] The feature combination construction unit is used for constructing a three-dimensional feature combination set corresponding to a unique risk control judgment scene based on the three types of attributes obtained by the core feature extraction module. The exclusive dimension configuration unit is used for quantifying the judgment weight of each feature combination, configuring exclusive judgment dimensions and verification sequences according to the weight threshold, and establishing and storing a feature-judgment dimension mapping library.

[0045] Further, the exclusive dimension locking module comprises a preliminary screening unit and a secondary positioning unit.

[0046] The preliminary screening unit is used for extracting a message source attribute of the current message, calculating a matching degree with a feature combination in a mapping library, and screening a preliminary candidate set meeting a threshold requirement; and the secondary positioning unit is used for calculating a transmission, content verification attribute matching degree and a comprehensive matching degree of the candidate combination with the current message, locking a unique adaptive exclusive judgment dimension, and automatically shielding irrelevant dimensions.

[0047] Further, the risk control message judgment module comprises a field extraction unit and an abnormality degree judgment unit.

[0048] The field extraction unit is used for extracting a to-be-verified field corresponding to the exclusive judgment dimension from the valid message, and eliminating invalid verification items with missing or abnormal format; and the abnormality degree judgment unit is used for calculating a dimension judgment abnormality degree, executing a judgment process according to a priority, calculating a comprehensive abnormality degree in combination with a risk weight, and completing timeliness and authenticity verification.

[0049] Compared with the prior art, the present application has the beneficial effects that: the present application extracts core information related to timeliness and authenticity of a risk control message according to feature priority, constructs a mapping library of three-dimensional feature combination and exclusive judgment dimension, accurately locks a unique adaptive judgment dimension and automatically excludes irrelevant items by relying on a secondary positioning mechanism, executes targeted verification in combination with a dimension priority sequence and a comprehensive abnormality judgment mechanism, and forms a complete logical chain of "feature hierarchical extraction-scene accurate adaptation-dimension efficient screening-targeted judgment output". The three-dimensional feature combination is configured with the exclusive dimension, so that the judgment logic is directly matched with the timeliness and authenticity requirements of different scenes, avoiding "over-verification" or "missed verification" caused by universal judgment, and improving scene adaptation flexibility; irrelevant dimensions are excluded by the secondary positioning, targeted judgment is executed by focusing on core verification points, calculation resources occupied by redundant verification links are reduced, risk control response time is shortened, and high-frequency risk control scene requirements are adapted; hierarchical extraction of core features ensures information accuracy, and combination of priority judgment and comprehensive abnormality degree calculation not only highlights the prevention and control priority of core risk points, but also comprehensively covers scene risks, effectively reducing the probability of timeliness misjudgment and authenticity missed judgment; all feature extraction is based on message preset field analysis, and the mapping library and various thresholds can be adjusted by experiment calibration, so that the dynamic changes of different business scenes can be adapted, the system can be extended to various risk control scenes without substantial modification, and the system has strong practicability. BRIEF DESCRIPTION OF DRAWINGS

[0050] The accompanying drawings are included to provide a further understanding of the present application, and constitute a part of the specification, illustrate the present application together with the embodiments, and are used to explain the present application, and do not constitute a limitation on the present application. In the drawings:

[0051] Figure 1 is a module schematic diagram of a risk control message intelligent analysis system based on business features. DETAILED DESCRIPTION

[0052] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the scope of the present application.

[0053] Please refer to Figure 1 The present application provides technical solutions:

[0054] A risk control message intelligent analysis system based on business characteristics comprises a core feature extraction module, a mapping library construction module, an exclusive dimension locking module, a risk control message judgment module and a result output module.

[0055] The core feature extraction module is used to collect risk control messages of various scenes, and to extract core attributes related to timeliness and authenticity after preprocessing according to priority levels, so as to determine core positioning features and accurate adaptation features.

[0056] The mapping library construction module is used to construct a combination set based on the extracted three-dimensional features, to quantify combination judgment weights and configure exclusive judgment dimensions, and to establish a mapping relationship library of features and dimensions.

[0057] The exclusive dimension locking module is used to preliminarily screen candidate combinations through source attributes, to combine transmission and verification attributes for secondary positioning, to lock exclusive judgment dimensions of the current message and to exclude irrelevant dimensions.

[0058] The risk control message judgment module is used to extract fields to be verified, to calculate the abnormality degrees of various dimensions, to perform targeted judgment according to priority levels and to calculate a comprehensive abnormality degree.

[0059] The result output module is used to output timeliness, authenticity conclusions and abnormality prompt information according to the judgment results.

[0060] The core feature extraction module comprises a message preprocessing unit and a feature hierarchical extraction unit.

[0061] The message preprocessing unit is used to collect risk control messages of various scenes, to filter invalid messages with missing fields and abnormal formats, and to retain valid messages with complete fields and compliant formats. The feature hierarchical extraction unit is used to extract message sources, transmission and content verification attributes from the valid messages, to determine core positioning features and accurate adaptation features through feature discrimination and scene correlation judgment.

[0062] The mapping library construction module comprises a feature combination construction unit and an exclusive dimension configuration unit.

[0063] The feature combination construction unit is configured to construct a three-dimensional feature combination set corresponding to a risk control judgment scene based on the three types of attributes obtained by the core feature extraction module; and the exclusive dimension configuration unit is configured to quantify the judgment weight of each feature combination, configure an exclusive judgment dimension and a checking sequence according to a weight threshold, and establish and store a feature-judgment dimension mapping library.

[0064] The exclusive dimension locking module includes a preliminary screening unit and a secondary positioning unit.

[0065] The preliminary screening unit is configured to extract a message source attribute of a current message, calculate a matching degree with the feature combinations in the mapping library, and screen out a preliminary candidate set meeting a threshold requirement; and the secondary positioning unit is configured to calculate a transmission and content checking attribute matching degree and a comprehensive matching degree of the candidate combination with the current message, lock an exclusive judgment dimension uniquely adapted, and automatically shield irrelevant dimensions.

[0066] The risk control message judgment module includes a field extraction unit and an abnormality degree judgment unit.

[0067] The field extraction unit is configured to extract a to-be-checked field corresponding to the exclusive judgment dimension from the valid message, and eliminate invalid checking items with missing or abnormal format; and the abnormality degree judgment unit is configured to calculate a dimension judgment abnormality degree, execute a judgment process according to a priority, calculate a comprehensive abnormality degree in combination with a risk weight, and complete timeliness and authenticity checking.

[0068] A risk control message intelligent analysis method based on business features, comprising the following steps:

[0069] S1. Collect risk control messages generated under various scenes, extract core information related to timeliness and authenticity judgment according to feature priority, extract a message source attribute as a core positioning feature first, and then extract a message transmission attribute and a content checking attribute as precise adaptation features, and all the attributes are obtained by parsing preset fields in the risk control message;

[0070] S2. A feature-judgment dimension mapping library is constructed in advance, exclusive judgment dimensions are configured for each feature combination based on the differences in timeliness features and authenticity features of risk control messages under different scenes; the judgment dimensions are set around time consistency, source legality, content integrity, and signature validity, and the exclusive dimensions of each feature combination are directly adapted to the timeliness and authenticity judgment requirements of the corresponding scene;

[0071] S3. The feature combination set in the mapping library is preliminarily screened based on the extracted message source attribute, and then secondary positioning is performed in combination with the message transmission attribute and the content checking attribute, to lock an exclusive judgment dimension uniquely corresponding to the current risk control message, and automatically exclude irrelevant dimensions;

[0072] S4. According to the timeliness check point and the true and false check point corresponding to the exclusive judgment dimension, a preset check rule is called to make a targeted judgment on the risk control message, a core check point is focused to complete a judgment process, whether the message has timeliness and whether it is a real message are judged, and an explicit timeliness judgment result, a true and false judgment result and an abnormal prompt information are output.

[0073] In the embodiment, it is assumed that an e-commerce platform needs to check the timeliness and the true and false of order risk control messages to avoid the risk of performance caused by false orders and invalid orders due to time out. The platform covers three types of core business scenarios: self-operated warehouse direct delivery orders, third-party merchant orders and cross-border bonded warehouse orders, and the order message transmission methods and check requirements of different scenarios are different.

[0074] S1 includes the following contents:

[0075] The collected risk control messages are preprocessed to filter out invalid messages with missing fields and abnormal formats, and valid risk control messages with complete fields and compliant formats are retained.

[0076] The message source attribute is extracted from the preset field of the valid risk control message, the core positioning characteristic attribute of the attribute is determined by calculating the source differentiation degree D of the attribute, and the source differentiation degree calculation formula is: D=(K×H) / N, wherein K is the number of scene categories that can be divided by the message source attribute, H is the entropy value of the message proportion in each scene corresponding to the attribute, H=-∑(pi×log2pi), wherein i is 1 to K, pi is the message proportion of the i-th scene corresponding to the attribute, and pi=number of messages in the i-th scene / total number of valid risk control messages, and N is the total number of all scene categories; a threshold value Td is set, and when D≥Td, it is determined that the message source attribute is a core positioning characteristic;

[0077] The message transmission attribute and the content check attribute are extracted from the preset field of the valid risk control message, respectively, the correlation coefficient R of the two types of attributes and the scene category is calculated, and the correlation coefficient calculation formula is: R=Cov(X,Y) / (Var(X)×Var(Y))^(1 / 2), wherein X is the quantized value of the scene category, and different scenes correspond to a unique quantized identifier; Y is the quantized value of the value of the attribute to be judged, Cov(X,Y) is the covariance of X and Y, Var(X) is the variance of X, and Var(Y) is the variance of Y; a threshold interval [T1, T2] is set, when T1≤R<T2, it is determined that the message transmission attribute and the content check attribute are precise adaptation characteristics, and the core information layer extraction related to the timeliness and the true and false is completed; wherein the threshold value Td and the threshold interval [T1, T2] need to be adjusted according to the actual situation, and relevant personnel can determine them through conventional experiments or industry experience.

[0078] S2 includes the following contents:

[0079] Based on the message source attribute, message transmission attribute and content verification attribute extracted from S1, a three-dimensional scene feature combination set is constructed, each combination corresponds to a unique risk control message judgment scene, denoted as feature combination T, and T={T1, T2, …, Tn}, wherein T1 is the first feature combination, T2 is the second feature combination, and so on, and Tn is the nth feature combination, and n is the total number of feature combinations;

[0080] The judgment weight Wj of each feature combination Tj is quantified, and j takes 1 to n, which specifically includes:

[0081] The scene occurrence frequency fj is calculated, and fj=NTj / NT, wherein NTj is the number of risk control messages corresponding to Tj in T period, NT is the total number of risk control messages of all scene combinations in T period, T is the historical statistical period, and the actual business regular period is set;

[0082] The judgment influence degree quantization value Ij is calculated, and Ij=α×cj+β×rj, wherein α is the timeliness failure weight coefficient, β is the message forgery weight coefficient, and α+β=1; cj is the number of timeliness failure messages corresponding to Tj in T period / the total number of messages corresponding to Tj in T period, which is the timeliness failure coefficient of feature combination Tj; rj is the number of forged messages corresponding to Tj in T period / the total number of messages corresponding to Tj in T period, which is the message forgery coefficient of feature combination Tj;

[0083] The judgment weight Wj is calculated, and Wj=γ×fj+δ×Ij, wherein γ is the occurrence frequency weight coefficient, δ is the influence degree weight coefficient, and γ+δ=1;

[0084] The weight threshold W0 is set, when Wj≥W0, the time consistency, source legality, content integrity and signature validity of 4 judgment dimensions are configured for feature combination Tj; when Wj

[0085] The mapping relationship table of feature combination and exclusive judgment dimension is established, the dimension set corresponding to each feature combination Tj and the dimension verification order are determined, and the feature-judgment dimension mapping library is formed; wherein the values of α, β, γ, δ and W0 are determined by relevant personnel according to the business judgment accuracy requirement, system performance demand and conventional experiment calibration.

[0086] In this embodiment, it is assumed that three feature combinations are constructed based on message source attribute, message transmission attribute, and content verification attribute, as follows:

[0087] T1: message source attribute = agency A, transmission attribute = private line, content verification attribute = with digital signature;

[0088] T2: message source attribute = internal system, transmission attribute = public network, content verification attribute = with hash value;

[0089] T3: message source attribute = external interface, transmission attribute = encrypted channel, content verification attribute = no verification.

[0090] It is assumed that T period = 30 days, and the total message amount NT = 10000 for all feature combinations; there are:

[0091] T1 = 5000 (1500 of which are time-expired, and 2500 of which are counterfeit); T2 = 3000 (300 of which are time-expired, and 300 of which are counterfeit); T3 = 2000 (100 of which are time-expired, and 200 of which are counterfeit);

[0092] It is assumed that a = 0.5, b = 0.5; g = 0.3, d = 0.7; and the weight threshold W0 = 0.4;

[0093] The scenario occurrence frequency fj is: T1 = 5000 / 10000 = 0.5; T2 = 3000 / 10000 = 0.3; and T3 = 2000 / 10000 = 0.2;

[0094] The determination impact degree Ij is:

[0095] T1: c1 = 1500 / 5000 = 0.3, r1 = 2500 / 5000 = 0.5; I1 = 0.5x0.3 + 0.5x0.5 = 0.4;

[0096] T2: c2 = 300 / 3000 = 0.1, r2 = 300 / 3000 = 0.1; I2 = 0.5x0.1 + 0.5x0.1 = 0.1;

[0097] T3: c3 = 100 / 2000 = 0.05, r3 = 200 / 2000 = 0.1; I3 = 0.5x0.05 + 0.5x0.1 = 0.075;

[0098] The determination weight Wj is:

[0099] T1: W1 = 0.3x0.5 + 0.7x0.4 = 0.43;

[0100] T2: W2 = 0.3x0.3 + 0.7x0.1 = 0.16;

[0101] T3: W3 = 0.3 x 0.2 + 0.7 x 0.075 = 0.1125;

[0102] T1 (W1≥W0): configure time consistency, source legitimacy, content integrity, signature validity, check order: signature validity > source legitimacy > content integrity > time consistency;

[0103] T2 (W2 < W0): select source legitimacy, content integrity, check order: source legitimacy is preferred;

[0104] T3 (W3 < W0): select source legitimacy single dimension.

[0105] S3 includes the following content:

[0106] Extract the message source attribute obtained by S1, construct the current attribute set A1; calculate the matching degree Sm1 of A1 and the message source attribute set B1 of each feature combination Tj in the feature-determination dimension mapping library, the calculation formula is: Sm1 = |A1∩B1| / |A1∪B1|, wherein |A1∩B1| is the number of intersection elements of A1 and B1, |A1∪B1| is the number of union elements of A1 and B1; set the matching degree threshold Y1, filter out the feature combination with Sm1≥Y1, form the preliminary candidate set Tcd;

[0107] For each feature combination Tj in the candidate set Tcd, respectively construct the current message transmission attribute set A2, the content verification attribute set A3, and the transmission attribute set B2, the content verification attribute set B3 of the corresponding combination in the mapping library; refer to the calculation formula of Sm1, respectively calculate the transmission attribute matching degree Sm2 and the content verification attribute matching degree Sm3;

[0108] Calculate the comprehensive matching degree Smz, the formula is: Smz = a1 x Sm1 + a2 x Sm2 + a3 x Sm3, wherein a1 is the message source attribute matching weight, a2 is the message transmission attribute matching weight, a3 is the content verification attribute matching weight, and a1 + a2 + a3 = 1, a1 > a2, a1 > a3, highlighting the weight advantage of core positioning features;

[0109] Set the comprehensive matching degree threshold Y2, filter out the feature combination Smz≥Y2 in Tcd; if there are multiple combinations that meet the condition, select the feature combination corresponding to the maximum Smz as the target feature combination, and lock the unique corresponding exclusive determination dimension of the combination;

[0110] The other dimensions in the feature-determination dimension mapping library except the target feature combination corresponding exclusive determination dimension are marked as irrelevant dimensions, which are automatically excluded through dimension shielding mechanism, and only the target exclusive determination dimension is reserved for subsequent verification; wherein the values of Y1, Y2 and a1, a2, a3 are determined by relevant personnel according to scene distinguishing accuracy requirements, system determination efficiency requirements through conventional experiments.

[0111] In the present embodiment, according to the feature-determination dimension mapping library, it is assumed that:

[0112] T1: message source attribute = agency A, transmission attribute = private line, content verification attribute = with digital signature; exclusive dimension: 4 full dimensions (signature validity > source legality > content integrity > time consistency);

[0113] T2: message source attribute = internal system, transmission attribute = public network, content verification attribute = with hash value; exclusive dimension: source legality, content integrity (source legality is preferred);

[0114] T3: message source attribute = external interface, transmission attribute = encrypted channel, content verification attribute = no verification; exclusive dimension: source legality;

[0115] Suppose there is a risk control message M1 to be determined, which has: message source attribute = agency A, transmission attribute = private line, content verification attribute = with digital signature;

[0116] Extract the current message attribute set A1 = {agency A}, transmission attribute set A2 = {private line}, and content verification attribute set A3 = {with digital signature};

[0117] Based on the message source attribute, calculate Sm1, which has:

[0118] Match with T1: T1 source set B1 = {agency A} → Sm1 = |A1∩B1| / |A1∪B1| = 1 / 1 = 1 ≥ Y1 = 0.8 → included in the candidate set Tcd = {T1};

[0119] Match with T: T2 source set B1 = {internal system} → Sm1 = |{agency A}∩{internal system}| / |{agency A}∪{internal system}| = 0 / 2 = 0 < Y1 → excluded;

[0120] Match with T3: T3 source set B1 = {external interface} → Sm1 = 0 / 2 = 0 < Y1 → excluded;

[0121] Therefore, the preliminary candidate set Tcd = {T1}.

[0122] Calculate Sm2, Sm3 and comprehensive matching degree Smz, which have:

[0123] For candidate set T1:

[0124] Transmission attribute matching: T1 transmission set B2={dedicated line}→Sm2=|A2∩B2| / |A2∪B2|=1 / 1=1;

[0125] Content verification attribute matching: T1 verification set B3={with digital signature}→Sm3=|A3∩B3| / |A3∪B3|=1 / 1=1;

[0126] Comprehensive matching degree: Smz=a1×Sm1+a2×Sm2+a3×Sm3=0.5×1+0.3×1+0.2×1=1≥Y2=0.7;

[0127] Only T1 meets the conditions, and the corresponding exclusive dimension of T1 is directly locked: time consistency, source legitimacy, content integrity, and signature validity (verification order: signature validity> source legitimacy> content integrity> time consistency).

[0128] Further, S4 includes the following content:

[0129] Obtain the exclusive judgment dimension corresponding to the target feature combination locked by S3 and the dimension verification priority sequence, extract the to-be-verified field data corresponding to each exclusive judgment dimension from the effective risk control message of S1, and eliminate invalid verification items with missing or abnormal format field data;

[0130] For each exclusive judgment dimension, calculate its judgment abnormality Yc, where c is the exclusive judgment dimension sequence number, and the calculation formula is: Yc=|Sc-Bc| / Bc, where Sc is the actual value of the to-be-verified field of the dimension, and Bc is the normal reference value corresponding to the dimension, which is determined based on business judgment standard and historical effective message data statistics; Yc takes value in the range [0, +∞), and the larger the value, the higher the degree of timeliness or authenticity abnormality corresponding to the dimension;

[0131] Execute the judgment in order from high to low according to the dimension verification priority, specifically: preferentially judge the dimension with the highest priority, set the abnormality threshold Yt, if Yc≥Yt, directly mark the corresponding abnormal type and trigger the warning, which includes timeliness abnormality or authenticity abnormality; if Yc

[0132] Calculate the comprehensive abnormality Yz of all exclusive dimensions, the formula is: Yz = ∑(uc × Yc), where c takes 1 to m, m is the number of exclusive judgment dimensions; uc is the risk weight of the cth dimension, and ∑uc = 1, the value of uc is positively correlated with the priority of the dimension, the higher the priority, the larger uc; set the comprehensive abnormality threshold Yh, if Yh ≥ Yh, output the timeliness judgment result, the true and false judgment result and the abnormal prompt information, wherein the abnormal prompt information includes the abnormal dimension and the corresponding abnormality; if Yh < Yh, output the timeliness compliance and the true and false compliance judgment result; wherein the values of normal reference value Bc, abnormality threshold Yt, judgment weight Wc and comprehensive abnormality threshold Yh are determined by relevant personnel according to the business judgment accuracy requirement, historical abnormal data and through conventional experiment calibration.

[0133] In this embodiment, it is assumed that the target feature combination is T1, and the corresponding exclusive judgment dimension and dimension verification priority sequence are: signature validity (1st level) > source legality (2nd level) > content integrity (3rd level) > time consistency (4th level);

[0134] It is assumed that the normal reference value Bc (based on business standards + historical data) is:

[0135] Signature validity (c = 1): B1 = 1 (signature verification pass mark, 1 = pass, 0 = fail);

[0136] Source legality (c = 2): B2 = 1 (source IP in whitelist mark, 1 = in list, 0 = not in list);

[0137] Content integrity (c = 3): B3 = 1 (hash value comparison consistent mark, 1 = consistent, 0 = inconsistent);

[0138] Time consistency (c = 4): B4 = 500 (message transmission time limit, unit: ms);

[0139] Threshold setting: abnormality threshold Yt = 0.2, comprehensive abnormality threshold Yh = 0.15;

[0140] Risk weight uc (∑uc = 1, positively correlated with priority), assuming u1 = 0.4, u2 = 0.3, u3 = 0.2, u4 = 0.1;

[0141] The actual value Sc of each dimension of the message to be judged M1 is:

[0142] Signature validity (c = 1): S1 = 1 (signature verification pass);

[0143] Source legality (c = 2): S2 = 1 (source IP in whitelist);

[0144] Content integrity (c=3): S3=1 (hash value match);

[0145] Time consistency (c=4): S4=600 (actual transmission time 600ms);

[0146] Four fields for verification were extracted from message M1. All of them were complete, correctly formatted, and retained as valid verification items.

[0147] Calculate the outlier score Yc for each dimension, where Yc = |Sc - Bc| / Bc, and we have:

[0148] Signature validity (c=1): Y1=|1-1| / 1=0; Source legitimacy (c=2): Y2=|1-1| / 1=0; Content integrity (c=3): Y3=|1-1| / 1=0; Time consistency (c=4): Y4=|600-500| / 500=0.2;

[0149] Execution is based on priority, and the following are possible outcomes:

[0150] Level 1 dimension (signature validity): Y1=0 < Yt=0.2 → Continue verification;

[0151] Level 2 Dimension (Source Legality): Y2=0<Yt=0.2→Continue Verification;

[0152] Level 3 Dimension (Content Integrity): Y3=0 < Yt=0.2 → Continue verification;

[0153] Level 4 Dimension (Time Consistency): Y4=0.2=Yt=0.2 → Marked as "Timeliness Abnormal", does not terminate directly (only triggers an early warning prompt, and continues to complete subsequent calculations);

[0154] Overall anomaly score: Yz = u1×Y1 + u2×Y2 + u3×Y3 + u4×Y4 = 0.4×0 + 0.3×0 + 0.2×0 + 0.1×0.2 = 0.02;

[0155] Result determination: Yz=0.02<Yh=0.15→ Output compliant result;

[0156] Final output:

[0157] Timeliness assessment result: Basically compliant (time consistency dimension is close to the threshold, triggering an alert);

[0158] Authenticity assessment result: Compliant (signature validity, source legality, and content completeness are all normal);

[0159] Error message: The actual time taken for time consistency is 600ms, which is close to the upper limit of the baseline value of 500ms. It is recommended to pay attention to the stability of the transmission link.

[0160] It should be noted that the relationship terms, such as first and second, and the like, are used only to differentiate one entity or action from another, and do not necessarily require or imply any actual such relationship or order between such entities or actions. Moreover, the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, such that processes, methods, articles, or apparatuses that comprise, include, or are otherwise characterized as including a series of elements do not require that all of the elements be present or that the elements be necessarily in order for the processes, methods, articles, or apparatuses to be deemed to be encompassed by the claimed application.

[0161] Finally, it should be noted that the above-described embodiments are merely exemplary of the application and should not be used to limit the present application, and that made modifications to the described embodiments, or equivalent substitutions of some of the technical features thereof, are possible for those skilled in the art upon having the benefit of the present disclosure. Any modifications, equivalent substitutions, improvements, and the like made within the spirit and principle of the present application shall be included in the scope of the protection of the present application.

Claims

1. A method for intelligent analysis of risk control messages based on business characteristics, characterized in that: The method comprises the following steps: S1. Collecting risk control messages generated under various scenes, extracting core information related to timeliness and authenticity determination according to feature priority, extracting message source attributes as core positioning features first, and then extracting message transmission attributes and content verification attributes as accurate adaptation features, and all attributes are obtained through preset field analysis in the risk control message; S2. Based on the message source attributes, message transmission attributes and content verification attributes extracted in S1, a three-dimensional scene feature combination set is constructed, each combination corresponds to a unique risk control message determination scene, denoted as feature combination T, and T={T1, T2,..., Tn}, wherein T1 is the first feature combination, T2 is the second feature combination, and so on, and Tn is the nth feature combination, and n is the total number of feature combinations; Quantify the determination weight Wj of each feature combination Tj, and j takes 1 to n, specifically including: Calculate the scene occurrence frequency fj, and fj=NTj / NT, wherein NTj is the number of risk control messages corresponding to Tj in T period, NT is the total number of risk control messages of all scene combinations in T period, and T is the historical statistical period; Calculate the determination influence degree quantization value Ij, and Ij=α×cj+β×rj, wherein α is the timeliness failure weight coefficient, β is the message forgery weight coefficient, and α+β=1; cj is the number of timeliness failure messages corresponding to Tj in T period / the total number of messages corresponding to Tj in T period, which is the timeliness failure coefficient of feature combination Tj; rj is the number of forged messages corresponding to Tj in T period / the total number of messages corresponding to Tj in T period, which is the message forgery coefficient of feature combination Tj; Calculate the determination weight Wj, and Wj=γ×fj+δ×Ij, wherein γ is the occurrence frequency weight coefficient, δ is the influence degree weight coefficient, and γ+δ=1; Set the weight threshold W0, when Wj≥W0, configure four determination dimensions of time consistency, source legality, content integrity and signature validity for feature combination Tj; when WjW0, select 2-3 determination dimensions from the above four determination dimensions, wherein cj corresponds to the time consistency dimension, rj corresponds to the source legality and content integrity dimensions; if cj>0 and rj>0, select time consistency, source legality and content integrity three dimensions; if cj>0 and rj=0, select time consistency and source legality two dimensions; if cj=0 and rj>0, select source legality and content integrity two dimensions; Establish a mapping relationship table of feature combinations and exclusive determination dimensions, and determine the dimension set corresponding to each feature combination Tj and the dimension verification order to form a feature-determination dimension mapping library; S3. Based on the extracted message source attributes, the feature combination set in the mapping library is preliminarily screened, and then combined with the message transmission attributes and content verification attributes for secondary positioning, locking the exclusive determination dimension uniquely corresponding to the current risk control message, and automatically excluding irrelevant dimensions; S4. According to the timeliness check point and the true-false check point corresponding to the exclusive judgment dimension, a preset check rule is called to make a targeted judgment on the risk control message, a core check point is focused to complete a judgment process, and it is judged whether the message has timeliness and whether it is a real message, and an explicit timeliness judgment result, a true-false judgment result and an abnormal prompt information are output. 2.The method of claim 1, wherein the method further comprises: The S1 includes the following contents: The collected risk control messages are preprocessed, invalid messages with missing fields and abnormal formats are filtered, and valid risk control messages with complete fields and compliant formats are reserved; The message source attribute is extracted from the preset field of the valid risk control message, the core positioning characteristic attribute is determined by calculating the source distinguish degree D of the attribute, the source distinguish degree calculation formula is: D=(KxH) / N, wherein K is the number of scene categories that can be divided by the message source attribute, H is the entropy value of the message proportion in each scene corresponding to the attribute, H=-∑(pi x log2pi), wherein i is 1 to K, pi is the message proportion of the i-th scene corresponding to the attribute, and pi=the number of messages in the i-th scene / total number of valid risk control messages, N is the total number of all scene categories; a threshold Td is set, and when D≥Td, it is determined that the message source attribute is a core positioning characteristic; The message transmission attribute and the content check attribute are extracted from the preset field of the valid risk control message respectively, the correlation coefficient R of the two types of attributes and the scene category is calculated, and the correlation coefficient calculation formula is: R=Cov(X,Y) / (Var(X) x Var(Y))^(1 / 2), wherein X is the scene category quantization value, different scenes correspond to a unique quantization identifier; Y is the value quantization value of the attribute to be judged, Cov(X,Y) is the covariance of X and Y, Var(X) is the variance of X, and Var(Y) is the variance of Y; a threshold interval [T1,T2] is set, and when T1≤R<T2, it is determined that the message transmission attribute and the content check attribute are precise adaptation characteristics, and the core information layer extraction related to the timeliness and true-false judgment is completed. 3.The method of claim 2, wherein the method further comprises: The S3 includes the following contents: The message source attribute obtained in S1 is extracted to construct the current attribute set A1; the matching degree Sm1 of A1 and the message source attribute set B1 of each feature combination Tj in the feature-judgment dimension mapping library is calculated, and the calculation formula is: Sm1=|A1∩B1| / |A1∪B1|, wherein |A1∩B1| is the intersection element number of A1 and B1, and |A1∪B1| is the union element number of A1 and B1; a matching degree threshold Y1 is set, and the feature combinations with Sm1≥Y1 are screened out to form a preliminary candidate set Tcd; For each feature combination Tj in the candidate set Tcd, the current message transmission attribute set A2 and the content check attribute set A3 are constructed respectively, and the transmission attribute set B2 and the content check attribute set B3 of the corresponding combination in the mapping library are constructed; the transmission attribute matching degree Sm2 and the content check attribute matching degree Sm3 are calculated respectively according to the calculation formula of Sm1; A comprehensive matching degree Smz is calculated, and a formula is Smz=a1×Sm1+a2×Sm2+a3×Sm3, wherein a1 is a message source attribute matching weight, a2 is a message transmission attribute matching weight, a3 is a content verification attribute matching weight, and a1+a2+a3=1; A comprehensive matching degree threshold Y2 is set, and a feature combination with Smz≥Y2 in Tcd is screened out; if there are multiple combinations meeting the condition, a feature combination corresponding to a maximum Smz is selected as a target feature combination, and an exclusive judgment dimension uniquely corresponding to the combination is locked; Other dimensions in the feature-judgment dimension mapping library except for the exclusive judgment dimension corresponding to the target feature combination are marked as irrelevant dimensions, and are automatically excluded through a dimension shielding mechanism, and only the target exclusive judgment dimension is reserved for subsequent verification. 4.The method of claim 3, wherein the method further comprises: The S4 includes the following contents: The target feature combination locked in S3 is used to obtain an exclusive judgment dimension and a dimension verification priority sequence, and field data corresponding to each exclusive judgment dimension to be verified is extracted from the effective risk control message in S1, and invalid verification items with missing or abnormal format field data are removed; For each exclusive judgment dimension, a judgment abnormality degree Yc is calculated, wherein c is the serial number of the exclusive judgment dimension, and a calculation formula is Yc=|Sc-Bc| / Bc, wherein Sc is an actual value of a field to be verified of the dimension, Bc is a normal reference value corresponding to the dimension, and is determined based on a business judgment standard and historical effective message data statistics; The judgment is sequentially performed from high to low according to the dimension verification priority, specifically: the dimension with the highest priority is preferentially judged, an abnormality degree threshold Yt is set, if the dimension Yc≥Yt, it is directly marked as a corresponding abnormal type and an early warning is triggered; if YcYt, the same judgment is continued on the next priority dimension, until all exclusive judgment dimensions are verified; A comprehensive abnormality degree Yz of all exclusive dimensions is calculated, and a formula is Yz=∑(uc×Yc), wherein c takes 1 to m, m is the number of exclusive judgment dimensions; uc is a risk weight of the cth dimension, and ∑uc=1, and the value of uc is positively correlated with the dimension priority, and the higher the priority, the larger uc is; a comprehensive abnormality degree threshold Yh is set, if Yz≥Yh, an explicit timeliness judgment result, a true-false judgment result and an abnormal prompt information are output; if YzYh, a timeliness compliance and a true-false compliance judgment result is output.

5. A system for intelligent analysis of risk control messages based on business characteristics, applied to the method for intelligent analysis of risk control messages based on business characteristics according to any one of claims 1-4, characterized in that: The system includes: a core feature extraction module, a mapping library construction module, an exclusive dimension locking module, a risk control message judgment module and a result output module; The core feature extraction module is used to collect risk control messages of various scenes, and after preprocessing, core attributes related to timeliness and true-false are extracted in a priority hierarchy, and core positioning features and accurate adaptive features are determined; The mapping library construction module is used to construct a combination set based on the extracted three-dimensional features, quantize the combination judgment weight and configure the exclusive judgment dimension, and establish a mapping relationship library of features and dimensions; The exclusive dimension locking module is used to preliminarily screen candidate combinations through source attributes, and secondarily position in combination with transmission and verification attributes, lock the exclusive judgment dimension of the current message and exclude irrelevant dimensions; The risk control message judgment module is used for extracting to-be-verified fields, calculating dimensional abnormality degrees, performing targeted judgment according to priorities, and calculating a comprehensive abnormality degree; The result output module is used for outputting timeliness, true-false nature conclusions and abnormality prompt information according to the judgment result. 6.The system of claim 5, wherein: The core feature extraction module comprises a message preprocessing unit and a feature hierarchical extraction unit. The message preprocessing unit is used for collecting various scene risk control messages, filtering invalid messages with missing fields or abnormal formats, and reserving valid messages with complete fields and compliant formats; and the feature hierarchical extraction unit is used for extracting message sources, transmission and content verification attributes from the valid messages, determining core positioning features and precise adaptive features through feature discrimination and scene relevance judgment. 7.The system of claim 5, wherein: The mapping library construction module comprises a feature combination construction unit and a dedicated dimension configuration unit. The feature combination construction unit is used for constructing a three-dimensional feature combination set corresponding to a unique risk control judgment scene based on the three types of attributes obtained by the core feature extraction module; and the dedicated dimension configuration unit is used for quantifying judgment weights of each feature combination, configuring dedicated judgment dimensions and verification sequences according to weight threshold values, establishing and storing a feature-judgment dimension mapping library. 8.The system of claim 5, wherein: The dedicated dimension locking module comprises a preliminary screening unit and a secondary positioning unit. The preliminary screening unit is used for extracting message source attributes of the current message, calculating matching degrees with feature combinations in the mapping library, and screening a preliminary candidate set meeting threshold requirements; and the secondary positioning unit is used for calculating matching degrees of candidate combinations with transmission and content verification attributes of the current message, and a comprehensive matching degree, locking a unique adaptive dedicated judgment dimension, and automatically shielding irrelevant dimensions. 9.The system of claim 5, wherein: The risk control message judgment module comprises a field extraction unit and an abnormality degree judgment unit. The field extraction unit is used for extracting to-be-verified fields corresponding to the dedicated judgment dimensions from the valid messages, and eliminating invalid verification items with missing fields or abnormal formats; The abnormality degree judgment unit is used for calculating dimensional judgment abnormality degrees, performing judgment procedures according to priorities, calculating a comprehensive abnormality degree in combination with risk weights, and completing timeliness and true-false nature verification.

Images