Rule threshold adjusting and optimizing method and device, computer equipment and storage medium

Abstract

The invention relates to a rule threshold adjusting and optimizing method and device, computer equipment and a storage medium. The method comprises the following steps: determining a table picture and a table title of a searchable table; generating a table prompt word according to the position information of the table link of the searchable table, the table picture of the searchable table, the table title table abstract generation instruction and the table abstract specification; generating a table summary text according to the table prompt word, determining summary fragments, performing vectorization processing on the summary fragments, and determining summary text vectors; storing the table abstract text, a text identifier corresponding to the table abstract text, a link sequence number of a table link, a table picture address of the searchable table and an abstract text vector into a vector database; and obtaining a rule threshold adjustment and optimization request sent by a user, performing rule threshold adjustment and optimization on the vector database, and determining a rule threshold adjustment and optimization result corresponding to the rule threshold adjustment and optimization request. According to the scheme, the accuracy and integrity of rule threshold adjustment and optimization can be improved.

Description

Technical Field

[0001] This application relates to the field of big data technology, and in particular to a method, apparatus, computer device, and storage medium for optimizing rule thresholds. Background Technology

[0002] Financial risk control refers to the process by which financial institutions identify, assess, monitor, and control potential credit, market, and operational risks in their operations through a series of strategies, processes, models, and technologies, aiming to achieve acceptable risk and stable returns. In the initial screening and pre-filtering stages of risk control, expert rules are typically configured in the risk control system to reduce the burden of manual review. Expert rules are logical judgment systems based on domain expert knowledge and experience, using formats such as "if...then...", "threshold judgments," and "blacklists / whitelists." These rules set thresholds for risk assessment. When the same set of expert rules is used in similar business scenarios, the thresholds used for risk assessment may need to be changed. This requires experts to readjust the thresholds, and the results are influenced by the experts' subjective judgment, leading to low efficiency. Therefore, how to automate the adjustment of thresholds in expert rules based on the actual needs of business scenarios, improving the accuracy and efficiency of threshold adjustments, is a problem that needs to be solved. Summary of the Invention

[0003] Therefore, it is necessary to provide a rule threshold optimization method, device, computer equipment, and storage medium that can automatically adjust the thresholds in expert rules based on the actual needs of business scenarios, thereby improving the accuracy and efficiency of threshold adjustment.

[0004] Firstly, this application provides a rule threshold tuning method, the method comprising:

[0005] The system acquires business transaction data for the target business scenario, and parses the sample rule files in the risk control system using a rule threshold optimization program to determine the indicator data; the business transaction data includes security transaction data and risk transaction data.

[0006] Based on the aforementioned indicator data, data binning analysis is performed on the business flow data to determine target location data; the target location data includes location indicators and the corresponding thresholds to be verified for the location indicators.

[0007] Threshold combination calculations are performed on the target point data to determine the rules to be verified;

[0008] The rules to be verified are verified based on the business transaction data, and a target rule is determined from the rules to be verified based on the verification results; the target rule includes a target threshold.

[0009] In one embodiment, data binning analysis is performed on the business flow data based on the indicator data to determine target location data, including:

[0010] Based on the indicator data, data binning analysis is performed on the business flow data to determine the proportion of risk flow data in the business flow data corresponding to each candidate point element in the business flow data.

[0011] Based on the data ratio of the risk flow data, at least two target point elements are determined from the candidate point elements, and the target point data corresponding to the target point elements is determined.

[0012] In one embodiment, the rule to be verified is verified based on the business transaction data, and a target rule is determined from the rule to be verified based on the verification result, including:

[0013] The rules to be verified are compiled to determine the compiled rule file;

[0014] The accumulator performs parallel verification on the compiled rule file based on the business flow data, and determines the target rule from the rules to be verified based on the verification results.

[0015] In one embodiment, an accumulator performs parallel verification on the compiled rule file based on the business flow data, and determines the target rule from the rules to be verified based on the verification results, including:

[0016] The accumulator performs parallel verification on the compiled rule file based on the business transaction data to determine the first recall rate of the compiled rule file for the risk transaction data and the first statistical accuracy rate of the rule to be verified for the risk transaction data.

[0017] Based on the first recall rate and the first statistical accuracy rate, the target rule is determined from the rules to be verified corresponding to the compiled rule file.

[0018] In one embodiment, determining the target rule from the rules to be verified corresponding to the compiled rule file based on the first recall rate and the first statistical accuracy rate includes:

[0019] The first recall rate and the first statistical accuracy are weighted and calculated to determine the rule score of the rule to be verified corresponding to the compiled rule file;

[0020] Based on the rule scores, target rules are determined from the rules to be verified; the number of target rules is at least two.

[0021] In one embodiment, after determining the target rule from the rules to be verified based on the rule score, the method further includes:

[0022] The target rules are combined to determine the combination rules, and the combination index and combination threshold in the combination rules are determined.

[0023] Based on the combined index and the combined threshold, the combined rule is calculated to determine the update rule.

[0024] The update rules are verified based on the business transaction data, and the optimal rule is determined from the update rules according to the verification results; the optimal rule includes the optimal threshold.

[0025] In one embodiment, validating the update rules based on the business transaction data and determining the optimal rule from the update rules according to the validation result includes:

[0026] The update rules are compiled to determine the updated files after compilation;

[0027] The accumulator performs parallel verification on the compiled update file based on the business flow data to determine the second recall rate of the compiled update file for the risk flow data and the second statistical accuracy rate of the update rule for the risk flow data.

[0028] The optimal rule is determined from the updated rules based on the second recall rate and the second statistical accuracy rate.

[0029] Secondly, this application also provides a rule threshold tuning device, the device comprising:

[0030] The indicator data determination module is used to acquire business transaction data for the target business scenario, and to determine indicator data by parsing the sample rule file in the risk control system through a rule threshold optimization program; the business transaction data includes security transaction data and risk transaction data.

[0031] The target location data determination module is used to perform data binning analysis on the business flow data based on the indicator data to determine the target location data; the target location data includes location indicators and the threshold to be verified corresponding to the location indicators.

[0032] The module for determining the rule to be verified is used to perform threshold combination calculations on the target point data to determine the rule to be verified.

[0033] The target rule determination module is used to verify the rule to be verified based on the business flow data, and determine the target rule from the rule to be verified according to the verification result; the target rule includes a target threshold.

[0034] Thirdly, this application also provides a computer device, the computer device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0035] The system acquires business transaction data for the target business scenario, and parses the sample rule files in the risk control system using a rule threshold optimization program to determine the indicator data; the business transaction data includes security transaction data and risk transaction data.

[0036] Based on the aforementioned indicator data, data binning analysis is performed on the business flow data to determine target location data; the target location data includes location indicators and the corresponding thresholds to be verified for the location indicators.

[0037] Threshold combination calculations are performed on the target point data to determine the rules to be verified;

[0038] The rules to be verified are verified based on the business transaction data, and a target rule is determined from the rules to be verified based on the verification results; the target rule includes a target threshold.

[0039] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0040] The system acquires business transaction data for the target business scenario, and parses the sample rule files in the risk control system using a rule threshold optimization program to determine the indicator data; the business transaction data includes security transaction data and risk transaction data.

[0041] Based on the aforementioned indicator data, data binning analysis is performed on the business flow data to determine target location data; the target location data includes location indicators and the corresponding thresholds to be verified for the location indicators.

[0042] Threshold combination calculations are performed on the target point data to determine the rules to be verified;

[0043] The rules to be verified are verified based on the business transaction data, and a target rule is determined from the rules to be verified based on the verification results; the target rule includes a target threshold.

[0044] The aforementioned rule threshold optimization method, apparatus, computer equipment, and storage medium acquire business transaction data for the target business scenario. A rule threshold optimization program parses sample rule files in the risk control system to determine indicator data. Based on the indicator data, data binning analysis is performed on the business transaction data to determine target point data. Threshold combination calculations are performed on the target point data to determine the rules to be verified. The rules to be verified are verified based on the business transaction data, and the target rule is determined from the rules to be verified based on the verification results. This addresses the problem that in the initial screening and pre-filtering of risk control, in order to reduce the burden of manual review, expert rules are often configured in the risk control system for rule screening. However, when the same set of expert rules is used for similar business scenarios, the thresholds used for risk judgment in the expert rules need to be changed. In this case, experts need to readjust the thresholds, which results in the threshold adjustment results being affected by the expert's subjective judgment and inefficient threshold adjustment. The above solution uses a rule threshold optimization program to perform binning analysis on the business flow data of the target business scenario, determine the target point data, and combine multiple rules to be verified based on the target point data. Then, the rules to be verified are verified based on the business flow data to determine the target rule. This can realize the automatic adjustment of rule thresholds, reduce the manual cost of rule threshold adjustment, and improve the efficiency and accuracy of rule threshold adjustment. Attached Figure Description

[0045] Figure 1 This is a diagram illustrating the application environment of the rule threshold tuning method in one embodiment;

[0046] Figure 2 This is a flowchart illustrating a rule threshold optimization method in one embodiment;

[0047] Figure 3 This is a flowchart illustrating the rule threshold optimization method in another embodiment;

[0048] Figure 4 This is a flowchart illustrating the rule threshold tuning method in another embodiment;

[0049] Figure 5 This is a structural block diagram of a rule threshold optimization device in one embodiment;

[0050] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0052] The rule threshold optimization method provided in this application can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Server 104 acquires business transaction data for the target business scenario, parses sample rule files in the risk control system using a rule threshold optimization program, and determines indicator data; the business transaction data includes security transaction data and risk transaction data; based on the indicator data, data binning analysis is performed on the business transaction data to determine target location data; the target location data includes location indicators and corresponding thresholds to be verified; threshold combination calculations are performed on the target location data to determine rules to be verified; the rules to be verified are verified based on the business transaction data, and a target rule is determined from the rules to be verified according to the verification results; the target rule includes a target threshold, and the target rule is sent to terminal 102 via a communication network. The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, and smart in-vehicle systems. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted devices. The server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0053] In one embodiment, such as Figure 2 As shown, a rule threshold optimization method is provided. This embodiment illustrates the method applied to a terminal. It is understood that this method can also be applied to a server, and further to a system including both a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0054] S210. Obtain business transaction data for the target business scenario, and parse the sample rule file in the risk control system through the rule threshold optimization program to determine the indicator data.

[0055] Business transaction data includes security transaction data and risk transaction data.

[0056] The target business scenario can be the business scenario of a financial institution. The rule threshold optimization program refers to a rule threshold optimization program built on Spark. Spark is a big data distributed computing technology that provides a distributed framework where the data processing logic is user-defined. The sample rule file refers to the expert rule file configured in the risk control system. The sample rule file defines the judgment rules for whether a user is a risk user corresponding to the target business scenario. The judgment rules in the sample rule file consist of multiple sub-conditions, which are directly connected by "AND" and "OR" symbols. For example, the judgment rule in the sample rule file could be "age > 20 & height > 170 cm", which can determine that users who are older than 20 years old and taller than 170 cm are risk users corresponding to the target business scenario. Indicator data refers to the indicators used in the judgment rules to determine whether a user is a risk user, such as age and gender. Safe transaction data refers to the transaction data generated by normal users in the target business scenario, while risk transaction data can be the transaction data generated by risky users in the target business scenario.

[0057] Specifically, with the user permission corresponding to the business transaction data of the target business scenario, the business transaction data of the target business scenario is obtained from the big data platform. For example, the business transaction data of the target scenario from the most recent year can be randomly extracted from the big data platform, and the obtained business transaction data is stored in a specified path HDFS (Hadoop Distributed File System) as material for subsequent adjustment of rule thresholds. The sample rule file is parsed by a rule threshold tuning program built on Spark to determine the rule object data, and the indicator data is determined based on the rule object data.

[0058] The rule object data includes a rule ID (Identity document) and a set of expressions of Map type data. For example, if the judgment rule A in the sample rule file is age > 18 & sex = female, the rule object data can include: age > 18 and sex = female, with the indicator data being age and gender. A Map is a data structure that stores data through key-value pairs, allowing for quick lookup of the corresponding value using a unique key. Each key maps to at most one value, and duplicates are not allowed.

[0059] It should be noted that extracting business transaction data from the target business scenario from the big data platform can avoid the difficulties in data sampling and the overfitting caused by improper sampling methods, as well as the defects of threshold results being overly dependent on sampling. The threshold optimization method based on full real transaction data can avoid the bias caused by human subjective factors and improve the stability and reliability of threshold results.

[0060] S220. Based on the indicator data, perform data binning analysis on the business flow data to determine the target location data.

[0061] The target location data includes location indicators and the corresponding thresholds to be verified.

[0062] Data binning refers to taking a column of data and dividing it into one or more bins based on the distribution of values, aiming to distribute the data within each bin as evenly as possible. Binning analysis, based on data binning, generates corresponding interval judgment rules according to the binned bins, and obtains bad sample rate and lift values ​​from the statistical values ​​of the rule results. Point indicators refer to the indicator data corresponding to the target point data, and the threshold to be verified is the rule threshold corresponding to the indicator data of the target point data. For example, if the indicator data corresponding to the target point data is age and height, then the target point data are A and B, where A can be (20, 30, 40) and B can be (160, 170, 180). A is age, and B is height.

[0063] Specifically, data binning analysis is performed on the indicator values ​​corresponding to the indicator data in the business flow data to determine the target point data.

[0064] For example, based on the indicator data, data binning analysis is performed on the business flow data to determine target location data, including:

[0065] Based on the indicator data, perform data binning analysis on the business flow data to determine the proportion of risk flow data in the business flow data corresponding to each candidate point element; based on the proportion of risk flow data, determine at least two target point elements from the candidate point elements, and determine the target point data corresponding to the target point elements.

[0066] In this context, candidate point elements refer to the indicator values ​​corresponding to each indicator data in the business transaction data. For example, if the business transaction data records business transaction data for a target business scenario including users aged 20, 30, 40, and 50, then candidate point elements can include 20, 30, 40, and 50 years old.

[0067] For example, the proportion of risky transaction data in the business transaction data corresponding to a 20-year-old user refers to the proportion of risky transaction data in all business transaction data corresponding to a 20-year-old user.

[0068] Specifically, based on indicator data, data binning analysis is performed on business transaction data to determine the proportion of risky transaction data corresponding to each candidate point element in the business transaction data. The candidate point elements corresponding to the k highest data proportions are identified as target point elements, and the target point data corresponding to these target point elements is obtained. For example, if the indicator data corresponding to the target point data is age and height, and the target point element is 20 years old, then the target point data could be the height of a 20-year-old user. The target point data includes the point indicator and the corresponding threshold to be verified. k is an integer greater than or equal to 2.

[0069] The above solution, based on the proportion of risk data in the business transaction flow data corresponding to each candidate point element, determines the target point element from the candidate point elements, thereby improving the reliability of the target point element.

[0070] S230. Perform threshold combination calculations on the target point data to determine the rules to be verified.

[0071] Specifically, the threshold to be verified is determined by performing threshold combination calculations on the target point data using the Cartesian product method.

[0072] For example, if the target point data are A and B, where A is (20, 30, 40) and B is (160, 170, 180), then 9 rules to be verified can be obtained through Cartesian product. For example, the rules to be verified include: A>20&B>160, A>20&B>170, A>20&B>180, A>30&B>160, A>30&B>170, A>30&B>180, A>40&B>160, A>40&B>170, A>40&B>180.

[0073] S240. Verify the rules to be verified based on business transaction data, and determine the target rule from the rules to be verified based on the verification results.

[0074] The target rules include a target threshold.

[0075] It should be noted that the business transaction data includes security transaction data and risk transaction data, and the business transaction data is stored with corresponding actual transaction identifiers. The actual transaction identifiers include security transaction identifiers and risk transaction identifiers. That is, security transaction data is stored with corresponding security transaction identifiers, and risk transaction data is stored with corresponding risk transaction identifiers.

[0076] For example, user indicator information corresponding to each transaction in the business transaction data can be analyzed using the rules to be verified. Based on the analysis results, it can be determined whether each transaction in the business transaction data verified by the rules to be verified is risky. Each transaction in the business transaction data is then marked according to the verification results to determine a verification transaction identifier for each transaction. This verification transaction identifier can be used as the verification result. The verification transaction identifier can be either a risky transaction identifier or a safe transaction identifier. The verification transaction identifier corresponding to each rule to be verified is compared with the actual transaction identifier of the business transaction data to determine the accuracy rate of the verification transaction identifier obtained by each rule to be verified. The n rules with the highest accuracy rate of the verification transaction identifier can be determined as the target rules. 1 ≤ n ≤ m, where n is an integer and m is the number of rules to be verified. m is a positive integer.

[0077] The aforementioned rule threshold optimization method involves acquiring business transaction data for the target business scenario, parsing sample rule files in the risk control system using a rule threshold optimization program to determine indicator data, performing data binning analysis on the business transaction data based on the indicator data to determine target point data, calculating threshold combinations on the target point data to determine the rules to be verified, verifying the rules to be verified based on the business transaction data, and determining the target rule from the rules to be verified based on the verification results. This method addresses the problem that in the initial screening and pre-filtering of risk control, in order to reduce the burden of manual review, expert rules are often configured in the risk control system for rule screening. However, when the same set of expert rules is used for similar business scenarios, the thresholds used for risk judgment in the expert rules need to be changed. In this case, experts need to readjust the thresholds, which results in the threshold adjustment being affected by the expert's subjective judgment and inefficient. The above solution uses a rule threshold optimization program to perform binning analysis on the business flow data of the target business scenario, determine the target point data, and combine multiple rules to be verified based on the target point data. Then, the rules to be verified are verified based on the business flow data to determine the target rule. This can realize the automatic adjustment of rule thresholds, reduce the manual cost of rule threshold adjustment, and improve the efficiency and accuracy of rule threshold adjustment.

[0078] In one embodiment, such as Figure 3 As shown, the rules to be verified are verified based on the business transaction data, and the target rule is determined from the rules to be verified based on the verification results, including:

[0079] S310. Compile the rules to be verified and determine the compiled rule file.

[0080] The compiled rule file is the Java file compiled from the rules to be verified.

[0081] Specifically, the rules to be validated are compiled using Java to determine the compiled rule file.

[0082] Understandably, compiling the rules to be verified into Java files can reduce the complexity of subsequent decision-making regarding the rules to be verified and the determination of target rules.

[0083] S320. Using an accumulator, perform parallel verification of the compiled rule file based on business flow data, and determine the target rule from the rules to be verified based on the verification results.

[0084] For example, by using an accumulator to perform parallel verification of compiled rule files based on business flow data, if there are identical compiled rule files during the verification process, only one of the identical compiled rule files can be verified. The decision engine can then cache the verification results of other identical compiled rule files to avoid performing multiple verifications on the same compiled rule files.

[0085] For example, the method for determining the target rule may include: using an accumulator to perform parallel verification on the compiled rule file based on business transaction data, determining the first recall rate of the compiled rule file for risk transaction data and the first statistical accuracy rate of the rule to be verified for risk transaction data; and determining the target rule from the rules to be verified corresponding to the compiled rule file based on the first recall rate and the first statistical accuracy rate.

[0086] Recall refers to the proportion of all samples that are actually positive that are correctly predicted as positive by the model. The accumulator, a data accumulation unit provided by the Spark framework, can retrieve data from distributed nodes, accumulate data, and perform statistical analysis.

[0087] The above solution achieves the decision-making of data batch rules in one go by customizing the accumulator logic, avoiding the problem of multiple data iterations in Spark and simplifying the calculation process.

[0088] For example, based on the first recall rate and the first statistical precision rate, the target rule is determined from the rules to be verified corresponding to the compiled rule file, including:

[0089] The first recall rate and the first statistical precision are weighted and calculated to determine the rule score of the rule to be verified corresponding to the compiled rule file; based on the rule score, the target rule is determined from the rules to be verified; the number of target rules is at least two.

[0090] For example, the first recall rate and the first statistical precision rate can be weighted to determine the rule score of the rule to be verified, and the n rules with the highest scores can be identified as the target rules.

[0091] The above scheme can determine the target rule from the rules to be verified based on recall and statistical precision, thus improving the reliability of the target rule.

[0092] For example, after determining the target rule from the rules to be verified based on the rule score, the process further includes:

[0093] The target rules are combined to determine the combination rules, and the combination indicators and combination thresholds in the combination rules are determined; based on the combination indicators and combination thresholds, the combination rules are used to perform threshold combination calculations to determine the update rules; the update rules are verified based on business transaction data, and the optimal rule is determined from the update rules according to the verification results.

[0094] The optimal rule includes the optimal threshold.

[0095] For example, if there are two target rules, and one target rule corresponds to the indicator data of age and gender, while the other target rule corresponds to the indicator data of education level and height, then the combined indicators include: age, gender, education level, and height. Using a Cartesian product approach, based on the combined indicators and combined thresholds, threshold combination calculations are performed on the above combined rules to obtain four update rules. The update rules are then validated based on business transaction data, and the optimal rule is determined from the validation results.

[0096] The above scheme, after determining the target rules, combines the target rules to determine the combined update rules. This allows the update rules to include all the indicators corresponding to the target rules. Validating the update rules and determining the optimal rules from them ensures the completeness of the indicators in the optimal rules and improves the reliability of the optimized thresholds in the optimal rules.

[0097] For example, the update rule is validated based on the business transaction data, and the optimal rule is determined from the update rules according to the validation result, including:

[0098] The update rules are compiled to determine the compiled update file; the compiled update file is then validated in parallel using an accumulator based on business transaction data to determine the second recall rate of the compiled update file for risky transaction data and the second statistical accuracy rate of the update rules for risky transaction data; the optimal rule is then determined from the update rules based on the second recall rate and the second statistical accuracy rate.

[0099] For example, the second recall rate and the second statistical precision rate can be weighted to determine the rule score of each update rule, and the update rule with the highest score can be determined as the optimal rule.

[0100] For example, by using an accumulator to perform parallel verification of compiled update files based on business pipeline data, if there are identical compiled update files during the verification process, only one of the identical compiled update files can be verified, and the verification results corresponding to other identical compiled update files can be cached by the decision engine.

[0101] For example, such as Figure 4 As shown, based on the above embodiments, the rule threshold optimization method includes:

[0102] With the user permission corresponding to the business transaction data of the target business scenario, the business transaction data of the target business scenario is obtained from the big data platform. For example, the business transaction data of the target scenario from the most recent year can be randomly extracted from the big data platform, and the obtained business transaction data is stored in HDFS in a specified path as material for subsequent adjustment of rule thresholds. The sample rule file is parsed by a rule threshold tuning program built on Spark to determine the rule object data, and the indicator data is determined based on the rule object data.

[0103] Based on indicator data, data binning analysis is performed on business transaction data to determine the proportion of risky transaction data corresponding to each candidate point element in the business transaction data. The candidate point elements corresponding to the k highest data proportions are identified as target point elements, and their corresponding target point data is obtained. Target point data includes point indicators and corresponding thresholds to be verified. Threshold combinations are calculated using Cartesian products on the target point data to determine the thresholds to be verified.

[0104] The rules to be verified are compiled using Java to determine the compiled rule files. An accumulator is used to perform parallel verification of these rules based on business transaction data, determining the first recall and first statistical accuracy of each rule on the risk transaction data. Based on these first recall and first statistical accuracy, the target rule is determined from the list of rules to be verified. While the compiled rule files are being verified in parallel using the accumulator based on business transaction data, if identical compiled rule files exist during the verification process, only one of the identical compiled rule files can be verified. The decision engine then caches the verification results for the other identical compiled rule files.

[0105] The update rules are compiled to determine the compiled update files. An accumulator is used to perform parallel verification of these compiled update files based on business transaction data, determining the second recall rate of the compiled update files for risky transaction data and the second statistical accuracy rate of the update rules for risky transaction data. Based on the second recall rate and the second statistical accuracy rate, the optimal rule is determined from the update rules. While performing parallel verification of the compiled update files based on business transaction data using the accumulator, if identical compiled update files exist during verification, only one of the identical compiled update files can be verified, and the verification results for the other identical compiled update files can be cached through the decision engine.

[0106] Furthermore, after determining the optimal rule, a threshold compression module can be executed to compress some thresholds in the optimal rule according to the user's actual needs. The optimal rule after threshold compression is then verified using business transaction data to determine the third recall rate and the third statistical accuracy of the optimal rule after threshold compression for the risk transaction data. When the third recall rate and the third statistical accuracy meet the requirements, the optimal rule after threshold compression is determined to be the expected rule that meets the user's needs, and the optimized threshold in the expected rule is the expected threshold.

[0107] It should be noted that threshold compression refers to setting a trigger value for a rule in advance. If the final trigger value of the rule is greater than this value, the trigger value of each condition of the rule is analyzed, the condition value with the largest trigger value is selected, and the data of the trigger rule is re-binded to obtain new points. The new points are then used to make decisions while other rules remain unchanged. In this way, the trigger value of the rule is reduced, and threshold compression is achieved.

[0108] The above solution provides a Spark-based method for optimizing rule thresholds. It loads the full dataset and employs complex but more effective analysis methods to obtain a batch of optimized thresholds. Further selection of optimized thresholds among multiple rules is achieved through rule threshold combination. The calculation process incorporates a decision engine, Spark parallel architecture, and custom accumulator statistics to address performance issues arising from large datasets and complex computations. Finally, the updated rules undergo overall analysis and threshold compression, ensuring that the final rules better meet user needs. Addressing the shortcomings of existing technologies, such as difficulties in data sampling, overfitting due to improper sampling methods, and excessive reliance on sampling for threshold results, this invention provides a threshold optimization method based on full-volume real-world data, avoiding biases caused by subjective human factors and improving the stability and reliability of threshold results. Furthermore, addressing the limitations of existing technologies, such as reliance on simple statistical methods for threshold calculation leading to insufficient accuracy, this invention introduces binning analysis, indicator combination, and parallel computation under large-scale data conditions to improve the accuracy and efficiency of threshold calculation. Meanwhile, to address the shortcomings of existing technologies that can only achieve optimal thresholds for single rules and cannot take into account the global optimality of rule combinations, a rule combination threshold tuning mechanism is used to support the Cartesian product combination of multiple rules and effect evaluation, ultimately achieving global optimal threshold decision-making under multiple rule combinations.

[0109] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0110] Based on the same inventive concept, this application also provides a rule threshold tuning device for implementing the rule threshold tuning method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more rule threshold tuning device embodiments provided below can be found in the limitations of the rule threshold tuning method described above, and will not be repeated here.

[0111] In one embodiment, such as Figure 5As shown, a rule threshold optimization device is provided, including: an indicator data determination module 501, a target point data determination module 502, a rule to be verified determination module 503, and a target rule determination module 504, wherein:

[0112] The indicator data determination module 501 is used to acquire business transaction data of the target business scenario, and to determine indicator data by parsing the sample rule file in the risk control system through a rule threshold optimization program; the business transaction data includes security transaction data and risk transaction data.

[0113] The target location data determination module 502 is used to perform data binning analysis on the business flow data based on the indicator data to determine the target location data; the target location data includes location indicators and the threshold to be verified corresponding to the location indicators.

[0114] The rule to be verified determination module 503 is used to perform threshold combination calculation on the target point data to determine the rule to be verified.

[0115] The target rule determination module 504 is used to verify the rule to be verified based on the business flow data, and determine the target rule from the rule to be verified according to the verification result; the target rule includes a target threshold.

[0116] For example, the target location data determination module 502 is specifically used for:

[0117] Based on the indicator data, data binning analysis is performed on the business flow data to determine the proportion of risk flow data in the business flow data corresponding to each candidate point element in the business flow data.

[0118] Based on the data ratio of the risk flow data, at least two target point elements are determined from the candidate point elements, and the target point data corresponding to the target point elements is determined.

[0119] For example, the target rule determination module 504 is specifically used for:

[0120] The rules to be verified are compiled to determine the compiled rule file;

[0121] The accumulator performs parallel verification on the compiled rule file based on the business flow data, and determines the target rule from the rules to be verified based on the verification results.

[0122] For example, the target rule determination module 504 is also specifically used for:

[0123] The accumulator performs parallel verification on the compiled rule file based on the business transaction data to determine the first recall rate of the compiled rule file for the risk transaction data and the first statistical accuracy rate of the rule to be verified for the risk transaction data.

[0124] Based on the first recall rate and the first statistical accuracy rate, the target rule is determined from the rules to be verified corresponding to the compiled rule file.

[0125] For example, the target rule determination module 504 is also specifically used for:

[0126] The first recall rate and the first statistical accuracy are weighted and calculated to determine the rule score of the rule to be verified corresponding to the compiled rule file;

[0127] Based on the rule scores, target rules are determined from the rules to be verified; the number of target rules is at least two.

[0128] For example, the target rule determination module 504 is also specifically used for:

[0129] The target rules are combined to determine the combination rules, and the combination index and combination threshold in the combination rules are determined.

[0130] Based on the combined index and the combined threshold, the combined rule is calculated to determine the update rule.

[0131] The update rules are verified based on the business transaction data, and the optimal rule is determined from the update rules according to the verification results; the optimal rule includes the optimal threshold.

[0132] For example, the target rule determination module 504 is also specifically used for:

[0133] The update rules are compiled to determine the updated files after compilation;

[0134] The accumulator performs parallel verification on the compiled update file based on the business flow data to determine the second recall rate of the compiled update file for the risk flow data and the second statistical accuracy rate of the update rule for the risk flow data.

[0135] The optimal rule is determined from the updated rules based on the second recall rate and the second statistical accuracy rate.

[0136] Each module in the aforementioned rule threshold optimization device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0137] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a rule-based threshold optimization method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0138] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0139] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0140] Step 1: Obtain business transaction data for the target business scenario, and parse the sample rule file in the risk control system using a rule threshold optimization program to determine the indicator data; the business transaction data includes security transaction data and risk transaction data.

[0141] Step 2: Perform data binning analysis on the business flow data based on the indicator data to determine the target location data; the target location data includes the location indicator and the corresponding threshold to be verified.

[0142] Step 3: Perform threshold combination calculations on the target point data to determine the rules to be verified;

[0143] Step 4: Verify the rules to be verified based on the business transaction data, and determine the target rule from the rules to be verified according to the verification results; the target rule includes a target threshold.

[0144] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0145] Step 1: Obtain business transaction data for the target business scenario, and parse the sample rule file in the risk control system using a rule threshold optimization program to determine the indicator data; the business transaction data includes security transaction data and risk transaction data.

[0146] Step 2: Perform data binning analysis on the business flow data based on the indicator data to determine the target location data; the target location data includes the location indicator and the corresponding threshold to be verified.

[0147] Step 3: Perform threshold combination calculations on the target point data to determine the rules to be verified;

[0148] Step 4: Verify the rules to be verified based on the business transaction data, and determine the target rule from the rules to be verified according to the verification results; the target rule includes a target threshold.

[0149] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0150] Step 1: Obtain business transaction data for the target business scenario, and parse the sample rule file in the risk control system using a rule threshold optimization program to determine the indicator data; the business transaction data includes security transaction data and risk transaction data.

[0151] Step 2: Perform data binning analysis on the business flow data based on the indicator data to determine the target location data; the target location data includes the location indicator and the corresponding threshold to be verified.

[0152] Step 3: Perform threshold combination calculations on the target point data to determine the rules to be verified;

[0153] Step 4: Verify the rules to be verified based on the business transaction data, and determine the target rule from the rules to be verified according to the verification results; the target rule includes a target threshold.

[0154] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0155] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0156] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0157] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for optimizing rule-based thresholds, characterized in that, include: The system acquires business transaction data for the target business scenario, and parses the sample rule files in the risk control system using a rule threshold optimization program to determine the indicator data; the business transaction data includes security transaction data and risk transaction data. Based on the aforementioned indicator data, data binning analysis is performed on the business flow data to determine target location data; the target location data includes location indicators and the corresponding thresholds to be verified for the location indicators. Threshold combination calculations are performed on the target point data to determine the rules to be verified; The rules to be verified are verified based on the business transaction data, and a target rule is determined from the rules to be verified based on the verification results; the target rule includes a target threshold.

2. The method according to claim 1, characterized in that, Based on the aforementioned indicator data, data binning analysis is performed on the business flow data to determine target location data, including: Based on the indicator data, data binning analysis is performed on the business flow data to determine the proportion of risk flow data in the business flow data corresponding to each candidate point element in the business flow data. Based on the data ratio of the risk flow data, at least two target point elements are determined from the candidate point elements, and the target point data corresponding to the target point elements are determined.

3. The method according to claim 1, characterized in that, The rules to be verified are verified based on the business transaction data, and the target rule is determined from the rules to be verified based on the verification results, including: The rules to be verified are compiled to determine the compiled rule file; The accumulator performs parallel verification on the compiled rule file based on the business flow data, and determines the target rule from the rules to be verified based on the verification results.

4. The method according to claim 3, characterized in that, The compiled rule file is validated in parallel using an accumulator based on the business flow data, and the target rule is determined from the rules to be validated based on the validation results, including: The accumulator performs parallel verification on the compiled rule file based on the business transaction data to determine the first recall rate of the compiled rule file for the risk transaction data and the first statistical accuracy rate of the rule to be verified for the risk transaction data. Based on the first recall rate and the first statistical accuracy rate, the target rule is determined from the rules to be verified corresponding to the compiled rule file.

5. The method according to claim 4, characterized in that, Based on the first recall rate and the first statistical accuracy rate, the target rule is determined from the rules to be verified corresponding to the compiled rule file, including: The first recall rate and the first statistical precision rate are weighted and calculated to determine the rule score of the rule to be verified corresponding to the compiled rule file; Based on the rule scores, target rules are determined from the rules to be verified; the number of target rules is at least two.

6. The method according to claim 5, characterized in that, After determining the target rule from the rules to be verified based on the rule score, the process further includes: The target rules are combined to determine the combination rules, and the combination index and combination threshold in the combination rules are determined. Based on the combined index and the combined threshold, the combined rule is calculated to determine the update rule. The update rules are verified based on the business transaction data, and the optimal rule is determined from the update rules according to the verification results; the optimal rule includes the optimal threshold.

7. The method according to claim 6, characterized in that, The update rules are validated based on the business transaction data, and the optimal rule is determined from the update rules based on the validation results, including: The update rules are compiled to determine the updated files after compilation; The accumulator performs parallel verification on the compiled update file based on the business flow data to determine the second recall rate of the compiled update file for the risk flow data and the second statistical accuracy rate of the update rule for the risk flow data. The optimal rule is determined from the updated rules based on the second recall rate and the second statistical accuracy rate.

8. A rule-based threshold tuning device, characterized in that, The rule threshold tuning device includes: The indicator data determination module is used to acquire business transaction data for the target business scenario, and to determine indicator data by parsing the sample rule file in the risk control system through a rule threshold optimization program; the business transaction data includes security transaction data and risk transaction data. The target location data determination module is used to perform data binning analysis on the business flow data based on the indicator data to determine the target location data; the target location data includes location indicators and the threshold to be verified corresponding to the location indicators. The module for determining the rule to be verified is used to perform threshold combination calculations on the target point data to determine the rule to be verified. The target rule determination module is used to verify the rule to be verified based on the business flow data, and determine the target rule from the rule to be verified according to the verification result; the target rule includes a target threshold.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images