Transaction security processing method, device, equipment, medium and program product

Abstract

The invention provides a transaction security processing method, device and equipment, a medium and a program product, relates to the field of artificial intelligence, and can be applied to the field of financial science and technology. The method comprises the steps that under the condition that user authorization is obtained, when a target transaction related to a target user occurs, transaction information of the target transaction is obtained, and then a bank transaction data set corresponding to the target transaction is obtained; processing the bank transaction data set to obtain a transaction risk reference value; when the transaction risk reference value is compared with a preset first threshold condition to represent that the target transaction has a risk, acquiring a user account data set of the target user; evaluating a risk grading result of the target transaction based on the bank transaction data set and the user account data set; and processing the target transaction according to a processing flow corresponding to the risk grading result of the target transaction, different risk grading results corresponding to different processing flows.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence, which can be used in the field of financial technology, and more particularly to a transaction security processing method, device, equipment, medium and program product. BACKGROUND

[0002] With the continuous improvement of the electronicization and digitization of banking business, a large amount of transaction data, account data and other bank data face many security risks in the storage, transmission and processing process. The timeliness of risk monitoring and the accuracy of risk assessment are crucial to the security of bank data. SUMMARY

[0003] The present application provides a transaction security processing method, device, equipment, medium and program product which can improve the timeliness and accuracy of transaction risk detection.

[0004] In a first aspect of the embodiments of the present application, a transaction security processing method is provided. The method comprises: obtaining authorization of a target user to use its transaction data and account data; in the case of obtaining authorization, when a target transaction related to the target user occurs, obtaining transaction information of the target transaction; based on the transaction information of the target transaction, obtaining a bank transaction data set, wherein the bank transaction data set comprises transaction type data, transaction amount data and transaction time data; processing the bank transaction data set to obtain a transaction risk reference value; comparing the transaction risk reference value with a preset first threshold condition to obtain a first comparison result; when the first comparison result indicates that the target transaction is at risk, obtaining a user account data set of the target user, the user account data set comprising account balance data, account authentication information data and account operation record data; based on the bank transaction data set and the user account data set, evaluating a risk classification result of the target transaction; and processing the target transaction according to a processing flow corresponding to the risk classification result of the target transaction, wherein different risk classification results correspond to different processing flows.

[0005] According to the embodiments of the present application, the evaluation of the risk classification result of the target transaction based on the bank transaction data set and the user account data set comprises: based on the bank transaction data set and the user account data set, extracting a feature vector of the target transaction; processing the feature vector of the target transaction by using a risk assessment model constructed by a machine learning algorithm to obtain the risk classification result of the target transaction.

[0006] According to an embodiment of the present application, the risk assessment model is used to predict a risk assessment value; the processing of the feature vector of the target transaction by the risk assessment model constructed by the machine learning algorithm to obtain the risk classification result of the target transaction comprises: inputting the feature vector of the target transaction into the risk assessment model and obtaining a target risk assessment value output by the risk assessment model; comparing the target risk assessment value with a preset second threshold condition to obtain a second comparison result; and determining the risk classification result of the target transaction based on the second comparison result.

[0007] According to an embodiment of the present application, the risk assessment model is a clustering model, and the processing of the feature vector of the target transaction by the risk assessment model constructed by the machine learning algorithm to obtain the risk classification result of the target transaction comprises: the risk assessment model divides the target transaction into one of a plurality of clusters based on the feature vector of the target transaction; and the risk classification result of the target transaction is mapped based on the target cluster to which the target transaction is divided, wherein the plurality of clusters are respectively mapped to different risk classification results.

[0008] According to an embodiment of the present application, the evaluation of the risk classification result of the target transaction based on the bank transaction data set and the user account data set comprises: processing the user account data set to obtain an account risk reference value; comparing the account risk reference value with a preset third threshold condition to obtain a third comparison result; and evaluating the risk classification result of the target transaction based on the first comparison result and the third comparison result.

[0009] According to an embodiment of the present application, the processing of the target transaction according to the processing flow corresponding to the risk classification result of the target transaction comprises: when the risk classification result of the target transaction is safe, executing the target transaction and outputting a safe signal; when the risk classification result of the target transaction is dangerous, intercepting the target transaction and outputting a dangerous signal; and when the risk classification result of the target transaction is a warning, suspending the target transaction and sending a warning signal to a predetermined user to indicate that the target transaction is to be reviewed, and executing or intercepting the target transaction based on the received review result.

[0010] In a second aspect, the present application provides a transaction security processing device. The device comprises a first acquisition module, a preprocessing module, a second acquisition module, a data processing module and an early warning feedback module.

[0011] The first obtaining module is configured to obtain authorization of a target user to use transaction data and account data thereof, obtain transaction information of a target transaction related to the target user when the target transaction occurs, and obtain a bank transaction data set based on the transaction information of the target transaction, wherein the bank transaction data set comprises transaction type data, transaction amount data and transaction time data.

[0012] The preprocessing module is configured to process the bank transaction data set to obtain a transaction risk reference value, and compare the transaction risk reference value with a preset first threshold condition to obtain a first comparison result.

[0013] The second obtaining module is configured to obtain a user account data set of the target user when the first comparison result indicates that the target transaction is risky, wherein the user account data set comprises account balance data, account authentication information data and account operation record data.

[0014] The data processing module is configured to evaluate a risk grading result of the target transaction based on the bank transaction data set and the user account data set.

[0015] The early warning feedback module is configured to process the target transaction according to a processing flow corresponding to the risk grading result of the target transaction, wherein different processing flows correspond to different risk grading results.

[0016] A third aspect of the embodiment of the present application provides an electronic device, comprising one or more processors and a memory. The memory is configured to store one or more computer programs. The one or more processors execute the one or more computer programs to implement the steps of the above method.

[0017] A fourth aspect of the embodiment of the present application further provides a computer readable storage medium having a computer program or instructions stored thereon, wherein the computer program or instructions are executed by a processor to implement the steps of the above method.

[0018] A fifth aspect of the embodiment of the present application further provides a computer program product comprising a computer program or instructions, wherein the computer program or instructions are executed by a processor to implement the steps of the above method. BRIEF DESCRIPTION OF DRAWINGS

[0019] The above and other objects, features and advantages of the present application will become more apparent from the following description when taken in conjunction with the accompanying drawings, in which:

[0020] Figure 1 An application scenario diagram of a transaction security processing method, device, equipment, medium and program product according to an embodiment of the present application is schematically shown;

[0021] Figure 2 A flowchart illustrating a transaction security processing method according to an embodiment of the present invention is shown schematically.

[0022] Figure 3 The illustration schematically shows the processing flow for evaluating the risk classification results of a target transaction in one embodiment of the present invention;

[0023] Figure 4 The illustration schematically shows the processing flow for evaluating the risk classification results of a target transaction in another embodiment of the present invention;

[0024] Figure 5 A block diagram of a transaction security processing apparatus according to an embodiment of the present invention is schematically shown; and

[0025] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a transaction security processing method according to an embodiment of the present invention. Detailed Implementation

[0026] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the invention. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the invention for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0027] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0028] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0029] In the technical solution of this invention, the user information (including but not limited to user personal information, transaction information, user account information) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0030] In scenarios where personal information is used for automated decision-making, the methods, devices, and systems provided in this embodiment of the invention all provide users with corresponding operation entry points for users to choose to agree to or reject the automated decision-making results; if the user chooses to reject, the process proceeds to the expert decision-making process.

[0031] Embodiments of the present invention provide a transaction security processing method, apparatus, device, medium, and program product. When a transaction is initially judged to have risk based on a transaction risk reference value, it can more accurately assess the transaction risk classification result based on bank transaction datasets and user account datasets related to the transaction, and process the transaction according to the processing flow corresponding to the assessed risk classification result. This allows for rapid execution of transactions initially determined to have no risk without affecting transaction efficiency and reducing the impact of risk monitoring on normal transactions. Simultaneously, for transactions that may have risk, targeted processing is performed after accurate risk classification assessment. This enables precise analysis and processing of potentially risky transactions, balancing transaction efficiency, real-time risk detection, and accurate risk assessment, thereby improving the security of bank transactions.

[0032] Figure 1 The illustration shows an application scenario of the transaction security processing method, apparatus, device, medium, and program product according to embodiments of the present invention.

[0033] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. Network 104 is a medium used to provide a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0034] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as e-banking applications, shopping applications, web browser applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0035] Server 105 can be a server that provides various services (such as banking back-office services). For example, server 105 can process transaction requests initiated by users using first terminal device 101, second terminal device 102, and third terminal device 103, and send the processing results back to the corresponding terminal devices.

[0036] It should be noted that the transaction security processing method provided in the embodiments of the present invention can generally be executed by server 105. Correspondingly, the transaction security processing device provided in the embodiments of the present invention can generally be located in server 105. The transaction security processing method provided in the embodiments of the present invention can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the transaction security processing device provided in the embodiments of the present invention can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0037] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0038] The following will be based on Figure 1 The described scene, through Figures 2-4 The transaction security processing method according to embodiments of the present invention will be described in detail.

[0039] Figure 2 A flowchart illustrating a transaction security processing method according to an embodiment of the present invention is shown.

[0040] like Figure 2 As shown, the transaction security processing method of this embodiment includes operations S210 to S2100. This transaction security processing method can be executed by the server 105.

[0041] In operation S210, authorization from the target user for using their transaction and account data is obtained. This authorization request can be sent to the user when they register or log in to the e-banking application via the first terminal device 101, the second terminal device 102, or the third terminal device 103, or it can be sent to the user when they initiate a transaction via a client on the first terminal device 101, the second terminal device 102, or the third terminal device 103.

[0042] In operation S220, with authorization obtained, when a target transaction related to the target user occurs, the transaction information of the target transaction is retrieved. The target transaction can be a transaction initiated by the target user, or a transaction that requires the transfer of funds into or out of the target user's account.

[0043] In embodiments of the present invention, user consent or authorization is required before obtaining transaction information of a target transaction. Operation S220 is executed only if the user consents or authorizes the acquisition of transaction information related to that transaction.

[0044] When obtaining the target transaction's additional transaction information in operation S220, the transaction monitoring software installed on server 105 can capture transaction information (such as transaction messages, transaction logs, or transaction records) in the bank system in real time when a transaction related to the target user is generated.

[0045] In operation S230, based on the transaction information of the target transaction, a bank transaction dataset is obtained, which includes transaction type data, transaction amount data, and transaction time data. Specifically, based on the obtained transaction information, the transaction category (such as transfer, withdrawal, or consumption) can be analyzed to obtain transaction type data; the specific amount of the transaction can be extracted to obtain transaction amount data; and the transaction time data can be obtained based on the time node initiation of the transaction.

[0046] In operation S240, the aforementioned bank transaction dataset is processed to obtain transaction risk reference values. These reference values ​​are used to initially determine whether a transaction carries risk. Their purpose is to filter out the large number of small, normal transactions that occur daily, ensuring their rapid and smooth execution. Transactions that may pose a risk are then subject to more complex and precise risk assessments.

[0047] In one embodiment, a formula for calculating the transaction risk reference value derived from a bank transaction dataset can be pre-defined. For example, the formula for calculating the transaction risk reference value can be fitted using a historical dataset of a large number of normal bank transactions. For instance, the transaction risk reference value can be calculated using the following formula:

[0048]

[0049] in As a reference value for transaction risk, For transaction type data, For transaction amount data, For transaction time data, , and These are the corresponding weighting factors; different weights are set for different types of transactions, different amount ranges, and different transaction times based on historical risk data. For example, large transfers late at night have a higher weight.

[0050] In operation S250, the transaction risk reference value is compared with a preset first threshold condition to obtain a first comparison result. This first threshold condition can be a single threshold that divides the possibility of risk, or it can be a threshold range.

[0051] In one embodiment, when the magnitude of the transaction risk reference value represents the level of risk, a first threshold condition can be set including a transaction risk threshold range (Y1, Y2). Specifically, if the transaction risk reference value is less than Y1, it can be determined that the transaction has no risk. If the transaction risk reference value is greater than Y1, it can be determined that the transaction has risk. When the transaction risk reference value is within the range (Y1, Y2), the transaction is considered to be in a warning state; when the transaction risk reference value is greater than Y2, the transaction can be considered to be in a dangerous state.

[0052] In operation S260, determine whether there is a risk in the target transaction based on the first comparison result. If yes, execute operation S270; otherwise, execute operation S2100.

[0053] In operation S270, when the first comparison result indicates that the target transaction has a risk, the user account dataset of the target user is obtained. The user account dataset includes account balance data, account authentication information data and account operation record data.

[0054] In embodiments of the present invention, prior to obtaining the target user's user account dataset, the user's consent or authorization is required. This authorization can be requested along with the request for authorization to use the user's transaction data, or it can be requested separately. Furthermore, the above-described operation S270 is performed only if the user consents or authorizes the access to their account data.

[0055] When acquiring user account datasets, it is possible to connect with a bank account database to read the current balance value of the user account and obtain the account balance data; extract relevant information from the authentication process such as account login, password modification, or identity verification to obtain account authentication information data; and summarize the account's recent (e.g., one month) operation details such as deposits, withdrawals, or transfers to obtain account operation record data.

[0056] After obtaining the user account dataset, data cleaning and noise reduction can be performed to remove invalid, erroneous, or duplicate transaction and account information, restoring the authenticity and accuracy of the data.

[0057] In operation S280, the risk classification results of the target transaction are evaluated based on the aforementioned bank transaction dataset and user account dataset. Specific evaluation methods are detailed below. Figure 3 or Figure 4 The various embodiments are described below.

[0058] In operation S290, the target transaction is processed according to the processing procedure corresponding to the risk classification result of the target transaction. The processing procedure is different for different risk classification results.

[0059] The risk classification result is at least either safe or unsafe (e.g., dangerous). In some embodiments, it can be further subdivided into more categories.

[0060] For example, in one embodiment, the risk classification result may include three levels: safe, warning, and dangerous. Accordingly, the above operation S290 may include: when the risk classification result of the target transaction is safe, executing the target transaction and outputting a safe signal; when the risk classification result of the target transaction is dangerous, intercepting the target transaction and outputting a dangerous signal; and when the risk classification result of the target transaction is warning, suspending the target transaction and sending a warning signal to a predetermined user to instruct them to review the target transaction, and executing or intercepting the target transaction based on the received review result. The safe signal may contain a set of fields representing that the bank data is in a safe state, the warning signal may contain a set of fields representing that the bank data has a certain level of risk, and the dangerous signal may contain a set of fields representing that the bank data faces serious risk.

[0061] In some embodiments, for transactions that output danger signals or warning signals, the processing results can also be displayed to the terminal devices of preset administrator users in the bank system, and the bank transaction dataset and user account dataset can be analyzed to obtain and display the analysis results.

[0062] In operation S2100, when the first comparison result indicates that there is no risk in the target transaction, the target transaction is executed.

[0063] In some embodiments, after operating S290 or S2100, SMS messages or text messages can be sent to the target user and the client of relevant bank management personnel to provide feedback on the processing results of the target transaction, and the SMS messages or text messages can be displayed on the display terminal.

[0064] In some embodiments, when the risk assessment result of a transaction is a safe signal, a routine maintenance SMS can be sent to the bank's customer service via the communication unit. When the risk assessment result of a transaction is a warning signal, a warning SMS can be sent to the receiving end of relevant bank personnel via the communication unit. When the bank data risk assessment result is a danger signal, a danger response SMS can be sent to the receiving end of the bank's emergency response team via the communication unit. Routine maintenance SMS includes statements indicating that the bank's data is generally stable, reminding customer service personnel to handle customer inquiries, promote business, and monitor the daily dynamics of customer accounts. Warning SMS includes statements indicating abnormal fluctuations in bank data, requiring security personnel to immediately verify relevant transaction records and account operations, and to implement measures such as freezing suspicious transactions, restricting account operations, or strengthening identity verification based on the verification results. Danger SMS includes statements indicating that the bank's data is facing a major crisis, requiring the emergency response team to immediately activate the emergency plan, take measures to block funds, and cooperate with the police in the investigation.

[0065] The embodiments of the present invention can quickly execute transactions that are initially determined to be risk-free based on transaction risk reference values ​​without affecting transaction efficiency. At the same time, for transactions that may have risks, targeted processing is carried out after accurate risk classification results are assessed, thus balancing transaction efficiency with the real-time nature of risk detection and the accuracy of risk assessment.

[0066] Figure 3 The illustration shows the processing flow of evaluating the risk classification results of the target transaction in operation S280 of an embodiment of the present invention.

[0067] like Figure 3 As shown, combined with Figure 2 According to this embodiment, operation S280 may include operations S301 to S303.

[0068] In operation S301, the aforementioned user account dataset is processed to obtain account risk reference values. A pre-defined mapping relationship between the user account dataset and the account risk reference values ​​can be established.

[0069] For example, similar to the trading risk benchmark, an account risk benchmark can be set using the following formula:

[0070]

[0071] As a reference value for account risk, For account balance data, For account authentication information data, Record data for account operations. , and These are the corresponding weighting factors.

[0072] In operation S302, the account risk reference value is compared with a preset third threshold condition to obtain a third comparison result. This third threshold condition can be a single threshold that divides the possibility of risk, or it can be a threshold range. Specifically, it can be set according to the calculation method of the account risk reference value and the risk meaning represented by the size of the account risk reference value.

[0073] In operation S303, the risk classification result of the target transaction is evaluated based on the first comparison result and the third comparison result. If the risk classification results determined based on the first comparison result and the third comparison result are consistent, the consistent conclusion can be used directly to obtain the risk classification result. If the risk classification results determined based on the first comparison result and the third comparison result are inconsistent, the risk classification result of the one with the higher risk level is used as the risk classification result of the target transaction.

[0074] For example, when the risk classification results determined based on the first comparison result and the third comparison result are both safe results (no risk), a safe state is output; when one or more of the first comparison result and the third comparison result are warning results and the rest are safe results, a warning state is output; when one or more of the first comparison result and the third comparison result are dangerous results, a dangerous state is output.

[0075] Figure 4 The illustration shows the processing flow of evaluating the risk classification results of the target transaction in operation S280 of another embodiment of the present invention.

[0076] like Figure 4 As shown, combined with Figure 2 According to this embodiment, operation S280 may include operation S401 and operation S402.

[0077] In operation S401, based on the aforementioned bank transaction dataset and user account dataset, a feature vector of the target transaction is extracted. In one embodiment, the feature vector may include the aforementioned transaction risk reference value and account risk reference value, or the feature vector may include the processed values ​​of the aforementioned transaction risk reference value and account risk reference value, such as the sum of the transaction risk reference value and the account risk reference value.

[0078] In operation S402, the feature vector of the target transaction is processed using a risk assessment model built through machine learning algorithms to obtain the risk classification result of the target transaction.

[0079] This invention utilizes machine learning algorithms for risk assessment, achieving high accuracy. Furthermore, by analyzing both bank transaction datasets and user account datasets simultaneously, it overcomes the potential inaccuracies that can arise from relying solely on single-dimensional transaction datasets for risk assessment.

[0080] In one embodiment, the risk assessment model is a model trained through supervised learning for predicting risk assessment values. Accordingly, the specific process of operation S402 may include: inputting the feature vector of the target transaction into the risk assessment model and obtaining the target risk assessment value output by the risk assessment model; comparing the target risk assessment value with a preset second threshold condition to obtain a second comparison result; and determining the risk classification result of the target transaction based on the second comparison result.

[0081] When training a risk assessment model using supervised learning, M sets of historical feature vectors can be collected as a sample set. The sample set is then divided into a 70% training set, a 15% test set, and a 15% validation set for model training.

[0082] The second preset condition can be a threshold range (F1, F2). In this way, when the risk assessment value is less than F1, a safety signal is generated; when the risk assessment value is greater than F1 and less than F2, a warning signal is generated; and when the risk assessment value is greater than F2, a danger signal is generated.

[0083] In another embodiment, the risk assessment model is a clustering model trained through unsupervised learning, wherein the clustering results of the risk assessment model include multiple clusters. Accordingly, the specific process of operation S402 may include: the risk assessment model classifying the target transaction into one of these multiple clusters based on the feature vector of the target transaction; and mapping the risk classification result of the target transaction based on the target cluster to which it is classified, wherein the multiple clusters are mapped to different risk classification results.

[0084] Historical sample sets can be collected and clustered to build a risk classification model. Specifically, feature vectors for each sample in the training set can be obtained, such as feature vectors derived from transaction risk reference values ​​and account risk reference values. Three clusters are preset: normal data cluster K1, warning data cluster K2, and dangerous data cluster K3. Three data points are randomly selected from the training set as initial cluster centers. The distance between data items is obtained by substituting them into the following formula:

[0085]

[0086] Calculate the distance between each data item in the training set and the three cluster centers, and assign the data item to the cluster of the nearest cluster center, resulting in three new data cluster sets. Then, select new cluster centers based on these new data cluster sets. Next, recalculate and partition the clusters using the new cluster centers. Repeat this process until a preset number of iterations is reached to obtain the final clusters.

[0087] After the clustering model is built, the risk assessment model is output. Then, in operation S402, the feature vector of the target transaction is input into the risk assessment model, and the risk classification result of the target transaction is obtained by dividing the target transaction into clusters according to the risk assessment model.

[0088] According to embodiments of the present invention, risk assessment values ​​can be obtained by collecting bank transaction datasets and user account datasets, processing them, and classifying them to obtain bank data risk classification results. Then, based on the risk classification results, risk response decision results are obtained and displayed through a display terminal for routine maintenance SMS messages. Analysis of the bank transaction datasets and user account datasets yields and displays the analysis results. The risk assessment values ​​obtained by processing the bank transaction datasets and user account datasets directly reflect the current security status of transactions, thus reducing the manual workload of bank staff in analyzing and calculating security data. The risk response decision results obtained by processing the bank data risk classification results can assist banks in quickly implementing highly targeted countermeasures based on different security statuses, reducing losses caused by data security risk events. The analysis results obtained by analyzing the bank transaction datasets and user account datasets can assist banks in quickly screening individual transaction data, avoiding inappropriate responses due to inaccurate analysis of single transaction data. Therefore, embodiments of the present invention have many advantages, including strong data security processing capabilities, high decision support, and timely and accurate data risk monitoring.

[0089] Based on the transaction security processing methods of the above embodiments, the present invention also provides a transaction security processing apparatus. The following will be combined with... Figure 5 The device is described in detail.

[0090] Figure 5 A block diagram of a transaction security processing apparatus 500 according to an embodiment of the present invention is shown schematically.

[0091] like Figure 5 As shown, the transaction security processing device 500 in this embodiment includes a first acquisition module 510, a preprocessing module 520, a second acquisition module 530, a data processing module 540, an early warning feedback module 550, and a user interaction module 560.

[0092] The first acquisition module 510 is used to acquire the target user's authorization to use their transaction data and account data; upon acquisition of authorization, when a target transaction related to the target user occurs, it acquires the transaction information of the target transaction; and based on the transaction information of the target transaction, it acquires a bank transaction dataset, wherein the bank transaction dataset includes transaction type data, transaction amount data, and transaction time data. In one embodiment, the first acquisition module 510 can perform the operations S210, S220, and S230 described above.

[0093] The preprocessing module 520 processes the aforementioned bank transaction dataset to obtain a transaction risk reference value; and compares the transaction risk reference value with a preset first threshold condition to obtain a first comparison result. In one embodiment, the preprocessing module 520 can perform the operations S240 and S250 described above.

[0094] The second acquisition module 530 is used to acquire a user account dataset of the target user when the first comparison result indicates that the target transaction has a risk. The user account dataset includes account balance data, account authentication information data, and account operation record data. In one embodiment, the second acquisition module 530 can perform the operations 260 and S270 described above.

[0095] In some embodiments, the first acquisition module 510, the preprocessing module 520, and the second acquisition module 530 can be combined into a data acquisition module. The data acquisition module is used to acquire bank transaction datasets and user account datasets according to corresponding triggering conditions, and to perform preprocessing.

[0096] The data processing module 540 is used to evaluate the risk classification results of the target transaction based on the aforementioned bank transaction dataset and user account dataset. In one embodiment, the data processing module 540 can process the bank transaction dataset and user account dataset to obtain a risk assessment value, and classify it to obtain a risk classification result. In one embodiment, the data processing module 540 can perform the operation S280 described above.

[0097] The early warning feedback module 550 is used to process the target transaction according to the processing flow corresponding to the risk classification result of the target transaction, wherein different risk classification results correspond to different processing flows. In one embodiment, the early warning feedback module 550 is used to process the risk classification result of bank data to obtain a risk response decision result. In one embodiment, the early warning feedback module 550 can perform the operation S290 described above.

[0098] The user interaction module 560 is used to display routine maintenance SMS messages via a display terminal, analyze bank transaction datasets and user account datasets, and obtain and display the analysis results.

[0099] The transaction security processing device 500 obtains a risk assessment value by processing bank transaction datasets and user account datasets. This value reflects the current security status of bank data, improving the accuracy of the assessment of the security status of bank transactions and overcoming the problem of inaccurate judgments that may occur when relying solely on a single dimension of transaction dataset data for risk assessment.

[0100] According to embodiments of the present invention, any plurality of modules among the first acquisition module 510, preprocessing module 520, second acquisition module 530, data processing module 540, early warning feedback module 550, and user interaction module 560 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of the present invention, at least one of the first acquisition module 510, preprocessing module 520, second acquisition module 530, data processing module 540, early warning feedback module 550, and user interaction module 560 can be at least partially implemented as hardware circuitry, such as field-programmable gate array (FPGA), programmable logic array (PLA), system-on-a-chip, system-on-a-substrate, system-on-package, application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any one of the three implementation methods or a suitable combination of any of them. Alternatively, at least one of the first acquisition module 510, preprocessing module 520, second acquisition module 530, data processing module 540, early warning feedback module 550, and user interaction module 560 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0101] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a transaction security processing method according to an embodiment of the present invention.

[0102] like Figure 6As shown, an electronic device 900 according to an embodiment of the present invention includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0103] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 executes various operations of the method flow according to embodiments of the present invention by executing programs in ROM 902 and / or RAM 903. It should be noted that the programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also execute various operations of the method flow according to embodiments of the present invention by executing programs stored in said one or more memories.

[0104] According to an embodiment of the present invention, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the input / output (I / O) interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0105] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present invention.

[0106] According to embodiments of the present invention, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of the present invention, a computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0107] Embodiments of the present invention also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of the present invention.

[0108] When the computer program is executed by the processor 901, it performs the functions defined in the system / apparatus of this invention. According to embodiments of the invention, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0109] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0110] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of this embodiment of the invention. According to embodiments of the invention, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0111] According to embodiments of the present invention, program code for executing the computer programs provided in the embodiments of the present invention can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0112] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0113] Those skilled in the art will understand that the features described in the various embodiments of the present invention can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present invention. In particular, the features described in the various embodiments of the present invention can be combined and / or combined in various ways without departing from the spirit and teachings of the present invention. All such combinations and / or combinations fall within the scope of the present invention.

Claims

1. A method for secure transaction processing, comprising: Obtain authorization from the target user to use their transaction and account data; With authorization obtained, when a target transaction related to the target user occurs, the transaction information of the target transaction is obtained; Based on the transaction information of the target transaction, a bank transaction dataset is obtained, wherein the bank transaction dataset includes transaction type data, transaction amount data, and transaction time data; The bank transaction dataset is processed to obtain a transaction risk reference value; By comparing the transaction risk reference value with a preset first threshold condition, a first comparison result is obtained; When the first comparison result indicates that the target transaction has a risk, the user account dataset of the target user is obtained. The user account dataset includes account balance data, account authentication information data, and account operation record data. The risk classification results of the target transaction are evaluated based on the bank transaction dataset and the user account dataset. as well as The target transaction is processed according to the processing procedure corresponding to the risk classification result of the target transaction, wherein different risk classification results correspond to different processing procedures.

2. The transaction security processing method according to claim 1, wherein, The risk grading results for the target transaction based on the bank transaction dataset and the user account dataset include: Based on the bank transaction dataset and the user account dataset, extract the feature vector of the target transaction; The feature vector of the target transaction is processed using a risk assessment model constructed through machine learning algorithms to obtain the risk classification result of the target transaction.

3. The transaction security processing method according to claim 2, wherein, The risk assessment model is used to predict risk assessment values; The process of using a risk assessment model constructed through machine learning algorithms to process the feature vector of the target transaction and obtain the risk classification result of the target transaction includes: Input the feature vector of the target transaction into the risk assessment model, and obtain the target risk assessment value output by the risk assessment model; The target risk assessment value is compared with a preset second threshold condition to obtain a second comparison result; The risk classification result of the target transaction is determined based on the second comparison result.

4. The transaction security processing method according to claim 2, wherein, The risk assessment model is a clustering model, and the clustering results of the risk assessment model include multiple clusters. The process of using the risk assessment model constructed through machine learning algorithms to process the feature vector of the target transaction and obtain the risk classification result of the target transaction includes: The risk assessment model classifies the target transaction into one of the multiple clusters based on the feature vector of the target transaction; Based on the target cluster to which the target transaction is classified, the risk classification result of the target transaction is obtained by mapping, wherein the multiple clusters are mapped to different risk classification results.

5. The transaction security processing method according to claim 1, wherein, The risk grading results for the target transaction based on the bank transaction dataset and the user account dataset include: Process the user account dataset to obtain account risk reference values; The account risk reference value is compared with the preset third threshold condition to obtain a third comparison result; Based on the first comparison result and the third comparison result, the risk classification result of the target transaction is evaluated.

6. The transaction security processing method according to claim 1, wherein, The process of processing the target transaction according to the risk classification result of the target transaction includes: When the risk assessment result of the target transaction is safe, the target transaction is executed and a safety signal is output; When the risk assessment result of the target transaction is "dangerous", the target transaction is intercepted and a danger signal is output; and When the risk classification result of the target transaction is a warning, the target transaction is suspended and a warning signal is sent to the predetermined user to instruct the target transaction to be reviewed, and the target transaction is executed or intercepted based on the received review result.

7. A transaction security processing device, comprising: The first acquisition module is configured to: acquire the target user's authorization to use their transaction data and account data; acquire the transaction information of the target transaction when a target transaction related to the target user occurs, provided that authorization has been acquired; and acquire a bank transaction dataset based on the transaction information of the target transaction, wherein the bank transaction dataset includes transaction type data, transaction amount data, and transaction time data. The preprocessing module is used to process the bank transaction dataset to obtain transaction risk reference values; And by comparing the transaction risk reference value with a preset first threshold condition, a first comparison result is obtained; The second acquisition module is used to acquire the user account dataset of the target user when the first comparison result indicates that the target transaction has a risk. The user account dataset includes account balance data, account authentication information data and account operation record data. The data processing module is used to evaluate the risk classification results of the target transaction based on the bank transaction dataset and the user account dataset; as well as The early warning feedback module is used to process the target transaction according to the processing procedure corresponding to the risk classification result of the target transaction, wherein different risk classification results correspond to different processing procedures.

8. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instructions stored thereon, wherein, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program or instructions, wherein, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

Images