Abnormal transaction processing method and device and electronic equipment

Abstract

The invention discloses an abnormal transaction processing method and device and electronic equipment. Relates to the field of financial science and technology, and the method comprises the steps: obtaining transaction data from transaction request information when the transaction request information initiated by a target user is received, and calling historical data and associated data associated with the transaction data through a data lake, the transaction request being used for requesting to execute a target transaction; the transaction data, the historical data and the associated data are input into a target classification model, a state recognition result of the target transaction is obtained, and the state recognition result comprises whether the target transaction is in an abnormal state or not and an abnormal reason under the condition that the target transaction is in the abnormal state; and when the state identification result indicates that the target transaction is in the abnormal state, determining an intervention operation executed on the target transaction according to an abnormal reason. According to the method and the device, the problem that the accuracy and the efficiency of identifying and processing the abnormal transaction are relatively low in the related technology is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of financial technology, in particular to an abnormal transaction processing method and device and electronic equipment. BACKGROUND

[0002] In order to improve the security of the user's business transaction, before performing the business transaction, the business transaction performed each time needs to be detected, so as to discover abnormal transactions in time and process them, thereby improving the transaction security of the user.

[0003] The traditional business transaction abnormality detection operation mainly relies on the analysis of a single transaction data point. Although this method can identify some direct transaction abnormalities, such as insufficient balance or incorrect payment password when the business transaction is to purchase goods using a credit card, its inherent limitation is that it can only identify abnormalities through the data of the transaction itself and cannot comprehensively identify associated transactions, which may result in some abnormal businesses being unable to be identified. Moreover, after identifying the abnormal transaction, the abnormal transaction cannot be solved by itself, which results in the transaction being interrupted, so that some transactions that can be executed after eliminating the abnormality also need to be interrupted and re-executed, affecting the transaction execution efficiency.

[0004] At present, there is no effective solution to the problem of low accuracy and efficiency of identifying and processing abnormal transactions in the related art. SUMMARY

[0005] The main purpose of the present application is to provide an abnormal transaction processing method, device and electronic equipment to solve the problem of low accuracy and efficiency of identifying and processing abnormal transactions in the related art.

[0006] In order to achieve the above purpose, according to one aspect of the present application, an abnormal transaction processing method is provided. The method comprises: in the case of receiving a transaction request information initiated by a target user, obtaining transaction data from the transaction request information, and calling historical data and associated data associated with the transaction data through a data lake, wherein the transaction request is used to request to perform a target transaction; inputting the transaction data, the historical data and the associated data into a target classification model to obtain a state identification result of the target transaction, wherein the state identification result includes whether the target transaction is in an abnormal state and the abnormal reason in the case of being in the abnormal state; in the case that the state identification result indicates that the target transaction is in an abnormal state, determining an intervention operation performed on the target transaction according to the abnormal reason.

[0007] Optionally, the calling, by the data lake, the historical data and the association data associated with the transaction data comprises: obtaining a transaction account of the target transaction from the transaction data, and generating a data query request according to the transaction account; sending the data query request to the data lake, and obtaining association information related to the transaction account and historical information of the transaction account from an association table of the data lake according to the data query request.

[0008] Optionally, the intervention operation executed on the target transaction according to the abnormal reason comprises: determining an abnormal level of the target transaction according to the abnormal reason, and obtaining a user level of the target user; determining a target configuration file from a preset configuration file set according to the abnormal level and the user level, wherein the preset configuration file set comprises a plurality of configuration files, each configuration file comprises a plurality of preset abnormal reasons, and each preset abnormal reason in the configuration file comprises a preset intervention operation; obtaining the preset intervention operation under the preset abnormal reason same as the abnormal reason from the target configuration file to obtain the intervention operation executed on the target transaction.

[0009] Optionally, in the case that the intervention operation represents that the target user is allowed to execute the target transaction, the method further comprises: executing the target transaction, and after completing the execution of the target transaction, generating prompt information according to the abnormal reason, and sending the prompt information to the transaction operation device of the target user.

[0010] Optionally, in the case that the intervention operation represents that the target user is not allowed to execute the target transaction, the method further comprises: generating an abnormal processing flow according to the abnormal reason, and generating to-be-confirmed information according to the abnormal processing flow; sending the to-be-confirmed information to the transaction operation device of the target user, and judging whether a confirmation instruction of the target user is received; in the case that the confirmation instruction is received, executing the abnormal processing flow, and after completing the execution of the abnormal processing flow, executing the target transaction; in the case that the confirmation instruction is not received, terminating the target transaction, and sending the transaction request information and the abnormal reason to the operation and maintenance end.

[0011] Optionally, after obtaining the state recognition result of the target transaction, the method further comprises: in the case that the state recognition result indicates that the target transaction has an abnormality, storing the transaction data to an abnormal transaction data storage unit of the data lake; in the case that the state recognition result indicates that the target transaction has no abnormality, storing the transaction data to a normal transaction data storage unit of the data lake.

[0012] Optionally, the target classification model is trained as follows: Abnormal transaction data within the target time period is obtained from the abnormal transaction data storage unit, along with historical and associated data for each abnormal transaction data, to obtain multiple first sample data sets. Each first sample data set includes an abnormal transaction data set, its historical and associated data, and the cause of the abnormality. Normal transaction data within the target time period is obtained from the normal transaction data storage unit, along with historical and associated data for each normal transaction data, to obtain multiple second sample data sets. Each second sample data set includes a normal transaction data set, its historical and associated data. The multiple first sample data sets and the multiple second sample data sets are combined into a training set, and the initial classification model is trained using the training set to obtain the target classification model.

[0013] To achieve the above objectives, according to another aspect of this application, an apparatus for processing abnormal transactions is provided. The apparatus includes: a calling unit, configured to, upon receiving a transaction request information initiated by a target user, obtain transaction data from the transaction request information and call historical data and related data associated with the transaction data through a data lake, wherein the transaction request is used to request the execution of a target transaction; an identification unit, configured to input the transaction data, historical data, and related data into a target classification model to obtain a status identification result of the target transaction, wherein the status identification result includes whether the target transaction is in an abnormal state and the cause of the abnormality if it is in an abnormal state; and a determining unit, configured to, if the status identification result indicates that the target transaction is in an abnormal state, determine an intervention operation to be performed on the target transaction based on the cause of the abnormality.

[0014] To achieve the above objectives, according to another aspect of this application, an electronic device is provided, comprising a memory storing an executable program; and a processor for running the program, wherein the program executes the above-described method for handling abnormal transactions during runtime.

[0015] To achieve the above objectives, according to another aspect of this application, a computer program product is provided, including computer instructions that, when executed by a processor, implement the steps of the above-described abnormal transaction processing method.

[0016] In this embodiment, upon receiving a transaction request from a target user, transaction data is obtained from the request information. A data lake is used to access historical and associated data related to the transaction data. The transaction request requests the execution of a target transaction. The transaction data, historical data, and associated data are input into a target classification model to obtain a status identification result for the target transaction. This result includes whether the target transaction is in an abnormal state and the cause of the abnormality. If the status identification result indicates that the target transaction is in an abnormal state, the intervention method for the target transaction is determined based on the cause of the abnormality. By using the data lake to access historical and associated data related to the transaction data, and then using these data to jointly determine the status identification result, the accuracy of the status identification result is improved. Furthermore, determining the intervention method based on the cause of the abnormality allows for different intervention methods to be used to resolve transactions with different causes of abnormality, enabling some abnormal transactions to continue execution and improving the security of transaction results. This achieves the technical effect of improving the accuracy and efficiency of identifying and processing abnormal transactions, thereby improving the execution efficiency of user business transaction operations and solving the technical problem of low accuracy and efficiency in identifying and processing abnormal transactions in related technologies. Attached Figure Description

[0017] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 A hardware structure block diagram of a computer terminal for implementing a method for handling abnormal transactions is shown.

[0019] Figure 2 This is a flowchart of the abnormal transaction processing method provided in Embodiment 1 of this application;

[0020] Figure 3 This is a schematic diagram of an abnormal transaction processing system provided in Embodiment 1 of this application;

[0021] Figure 4 This is a schematic diagram of an abnormal transaction processing device provided according to Embodiment 2 of this application;

[0022] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0023] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] It should be noted that the abnormal transaction processing methods, devices, and electronic devices defined in this disclosure can be used in the fintech field, or in any field other than fintech. The application fields of the abnormal transaction processing methods, devices, and electronic devices defined in this disclosure are not limited.

[0027] It should be noted that all information, user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) used in this application are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse use. If the user chooses to refuse, the process will proceed to the expert decision-making process. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface. After receiving consent from the aforementioned user or organization, the relevant information is obtained. Users can view the purpose of data use in real time through the authorization interface and have the right to withdraw authorization or delete data at any time. After the authorization is withdrawn, the system will terminate the relevant data processing within 24 hours.

[0028] The embodiments or examples disclosed herein are not exhaustive, but merely illustrative of some embodiments or examples, and are not intended to limit the scope of protection of this disclosure. Unless otherwise specified, each step in a particular embodiment or example can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment or example can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment or example can be arbitrarily interchanged. Furthermore, optional methods or examples in a particular embodiment or example can be arbitrarily combined; moreover, embodiments or examples can be arbitrarily combined. For example, some or all steps of different embodiments or examples can be arbitrarily combined, and a particular embodiment or example can be arbitrarily combined with optional methods or examples of other embodiments or examples.

[0029] For ease of description, the following explains some of the nouns or terms used in the embodiments of this application:

[0030] Streaming data processing is a real-time data processing technology that primarily targets continuous, unbounded data streams, rather than data in batches or stored in fixed datasets.

[0031] LSTM: Long Short-Term Memory network, is a special type of recurrent neural network specifically designed to handle long-term dependencies in sequential data.

[0032] Stream Join Operation: Real-time Stream Join Operation refers to merging two or more real-time data streams to find shared or related data items between the streams.

[0033] Example 1

[0034] According to an embodiment of this application, an embodiment of a method for processing abnormal transactions is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0035] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal for implementing a method for handling abnormal transactions is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, processing devices such as microprocessors or programmable logic devices), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface, a universal serial bus port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0036] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0037] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal transaction processing method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the above-mentioned abnormal transaction processing method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0038] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0039] The display may be, for example, a touchscreen LCD display that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0040] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for handling abnormal transactions is shown. Figure 2 This is a flowchart of the abnormal transaction processing method provided in Embodiment 1 of this application, as follows: Figure 2 As shown, the method includes:

[0041] Step S201: Upon receiving a transaction request information initiated by the target user, transaction data is obtained from the transaction request information, and historical data and related data associated with the transaction data are called through the data lake. The transaction request is used to request the execution of the target transaction.

[0042] It should be noted that the execution entity in this embodiment can be an abnormal transaction processing system. When the system detects that a target user has initiated a transaction request, it can identify whether the request information is abnormal, and then determine whether to intervene in the execution process of the target transaction based on the identification result, thereby improving the security of the execution process of the target transaction.

[0043] It should be noted that the transaction request information can be a credit card transaction request submitted by the target user, which may contain transaction data. This transaction data can include specific transaction details such as transaction amount, currency, transaction timestamp, and transaction channel. A data lake is a scalable storage system capable of storing and processing large amounts of raw data.

[0044] For example, when the system receives a transaction request from a target user, it initiates a data collection process, extracts key fields from the transaction data, and retrieves historical and related data through a data lake interface. This may include retrieving the target user's recent transaction activities, credit score, risk level, and geographic location information obtained based on the transaction location from the data lake, as well as historical transaction information of the target user executing the same transactions within a historical time period. Here, the data lake, as a centralized storage location for data, not only contains real-time transaction data but also stores detailed records of past transactions, thereby leveraging the flexibility and scalability of the data lake to provide rich data support for subsequent analysis and decision-making.

[0045] For example, when the system receives a transaction request for a credit card to be used at venue A, it needs to extract information such as the amount, time, and location of the transaction. It will also retrieve the user's historical transaction information at venue A over a period of time from the data lake, as well as related information such as the user's credit score and risk level, thereby providing comprehensive data support for subsequent real-time analysis.

[0046] It should be noted that when acquiring user transaction data, the acquired transaction data is information that financial institutions can access and monitor, thereby improving the security of financial institutions and business transactions. When acquiring transaction data, streaming data processing can be used. Through the high throughput and low latency of streaming data processing, the data can be made complete and consistent, while also flexibly accessing and processing transaction data acquired from different sources.

[0047] Step S202: Input transaction data, historical data and related data into the target classification model to obtain the status identification result of the target transaction. The status identification result includes whether the target transaction is in an abnormal state and the abnormal reason if it is in an abnormal state.

[0048] It should be noted that the target classification model can be a neural network model that integrates LSTM and deep learning technologies, and the state recognition result can be the model output, used to indicate whether the transaction is abnormal and the specific reason for the abnormality.

[0049] For example, after acquiring transaction data, historical data, and related data, this data can be input into a pre-trained target classification model. This model, based on LSTM and deep learning techniques, can capture the time dependencies and pattern features in the transaction sequence and identify the current transaction status in real time. During model execution, the model checks the degree of deviation between the current transaction data and the user's historical behavior, as well as its fit with risk thresholds, to determine whether the transaction deviates from the normal pattern and is in an abnormal state. If the model determines the transaction is abnormal, it will further analyze and output the specific reasons for the anomaly, such as insufficient credit limit, abnormal card status, system or rule errors, thus obtaining the status identification result.

[0050] For example, if the model detects a significant deviation between a transaction request and the pattern in historical data, such as the transaction amount far exceeding the customer's average monthly spending level, or the transaction location not matching the customer's usual residence, the model will output an "abnormal state" identification result, along with a classification of the abnormal reason, such as "the transaction location has moved a large range, which may pose a risk."

[0051] Step S203: If the status identification result indicates that the target transaction is in an abnormal state, determine the intervention operation to be performed on the target transaction based on the cause of the abnormality.

[0052] It should be noted that the intervention action is a smart action that is dynamically generated based on the cause of the anomaly and is used to resolve transaction obstacles in a timely manner.

[0053] For example, if the status recognition result confirms that the target transaction is in an abnormal state, intervention actions need to be formulated and executed based on the identified cause of the abnormality. These intervention actions may include, but are not limited to, temporarily adjusting the credit limit to complete the transaction, sending verification information to the user to confirm transaction authorization, freezing the transaction until manual review. The system can automatically select the most appropriate intervention measures based on the specific cause of the abnormality to minimize interference with the normal transaction process while controlling transaction risks.

[0054] For example, if the identification result is "credit limit exceeded" and the customer has a good credit record, the credit limit can be automatically adjusted, and an SMS notification containing the new limit and validity period can be generated and sent to the customer and back-office staff to quickly resolve the transaction interruption problem, while controlling the security and compliance of the operation.

[0055] Through the steps described above, this embodiment achieves real-time monitoring and intelligent processing of business transactions. First, data collection and integration enable the system to gather comprehensive information, laying a solid foundation for subsequent analysis. Second, real-time analysis and status recognition, through sophisticated model algorithms, can quickly identify potential anomalies in transactions, improving the accuracy and response speed of anomaly detection. Finally, intelligent decision-making and intervention, based on the analysis results, proactively take measures to resolve problems, not only enhancing risk control capabilities but also significantly improving user experience and transaction execution efficiency.

[0056] The abnormal transaction handling method provided in this application embodiment involves, upon receiving a transaction request from a target user, obtaining transaction data from the transaction request information and then calling historical and related data associated with the transaction data through a data lake. The transaction request is used to request the execution of a target transaction. The transaction data, historical data, and related data are input into a target classification model to obtain a status identification result for the target transaction. This status identification result includes whether the target transaction is in an abnormal state and the reason for the abnormal state if it is. If the status identification result indicates that the target transaction is in an abnormal state, the method of intervention to be performed on the target transaction is determined based on the reason for the abnormal state, and this is achieved by using a data lake to call... By using historical and related data associated with transaction data, and then using these historical and related data together to determine the status identification result of the target transaction, the accuracy of the status identification result is improved. Furthermore, by determining the intervention operation to be performed on the target transaction through the cause of the anomaly, different intervention methods can be used to resolve the anomaly caused by different reasons, allowing some anomaly transactions to continue to be executed and improving the security of transaction results. This achieves the technical effect of improving the accuracy and efficiency of identifying and processing anomaly transactions, thereby improving the execution efficiency of users' business transaction operations, and thus solving the technical problem of low accuracy and efficiency in identifying and processing anomaly transactions in related technologies.

[0057] To improve the efficiency and accuracy of acquiring historical and related data, optionally, in the abnormal transaction processing method provided in this application embodiment, calling historical and related data associated with the transaction data through the data lake includes: obtaining the transaction account of the target transaction from the transaction data, and generating a data query request based on the transaction account; sending the data query request to the data lake, and obtaining the related information of the transaction account and the historical information of the transaction account from the association table of the data lake based on the data query request.

[0058] For example, in order to obtain more data for status recognition and thus improve the accuracy of status recognition results, after receiving the transaction request information initiated by the target user, the system needs to parse and determine the transaction account of the target transaction, and generate a data query request based on the transaction account. This request not only includes the identifier of the transaction account, but may also include parameters such as the transaction time window and transaction type, so as to more accurately locate the data related to this transaction. By identifying the transaction account and generating a data query request, subsequent data retrieval operations become more targeted, avoiding unnecessary data retrieval, thereby improving the efficiency and accuracy of data processing.

[0059] Furthermore, the system sends the generated data query request to the data lake. As a centralized data storage and processing center, the data lake can quickly respond to requests and retrieve related information and historical information directly related to the transaction account from its association tables. The data query process relies on the technical characteristics of the data lake, namely, its ability to support high concurrency and low latency data query and processing capabilities. The data in the data lake is stored in an optimized manner, maintaining data quality and integrity while performing fast data retrieval.

[0060] Through efficient data querying via the data lake, the system can quickly obtain all relevant and historical information required for the target transaction, including account historical transaction patterns, credit assessment, risk thresholds, etc.

[0061] Furthermore, after obtaining the relevant and historical information, the relevant and historical information, along with transaction data, can be used as input data for identification operations. This improves the accuracy of the model's state identification results by comprehensively acquiring data related to the target transaction.

[0062] This embodiment improves the accuracy of model state recognition results by identifying transaction accounts, generating data query requests, and quickly retrieving related and historical information from the data lake, thereby comprehensively acquiring data related to the target transaction.

[0063] To accurately determine the intervention operation, optionally, in the abnormal transaction processing method provided in this application embodiment, determining the intervention operation to be performed on the target transaction based on the cause of the abnormality includes: determining the abnormality level of the target transaction based on the cause of the abnormality, and obtaining the user level of the target user; determining the target configuration file from a preset configuration file set based on the abnormality level and the user level, wherein the preset configuration file set includes multiple configuration files, each configuration file includes multiple preset abnormality causes, and a preset intervention operation for each preset abnormality cause in the configuration file; obtaining the preset intervention operation under the same preset abnormality cause as the abnormality cause from the target configuration file, thereby obtaining the intervention operation to be performed on the target transaction.

[0064] It should be noted that the cause of the anomaly is the specific reason for determining that the target transaction is in an abnormal state. The anomaly level is a quantitative assessment of the transaction risk based on the cause of the anomaly. The user level is the service level assessed based on factors such as the target user's credit history and transaction activity at the financial institution, which influences the personalized selection of intervention operations. The set of preset configuration files is a series of rule files predefined by the financial institution, each file corresponding to a specific anomaly level and user group, containing standardized procedures for anomaly handling.

[0065] For example, when the status identification result indicates that the target transaction is in an abnormal state, it is necessary to confirm the level of the abnormality. The determination of the abnormality level is based on the potential impact of the abnormality cause on transaction security. For example, "abnormal card status" would be marked as high risk, while "authorization request failed" might be considered low risk. At the same time, the system synchronously obtains the target user's service level within the financial institution system. This level can be used to measure whether the user has had risky transactions in the past, as well as the frequency and impact of such transactions. It should be noted that this user level is determined solely based on the user's historical risky transaction history and is unrelated to the user's other transaction content or user information.

[0066] Furthermore, after obtaining the anomaly level and user level, it is necessary to find a matching target configuration file in the preset configuration file set. The preset configuration file set can contain multiple configuration files, each of which can carry multiple preset intervention operations. Each intervention operation corresponds to a certain anomaly cause, and each configuration file corresponds to a set of user levels and anomaly levels. Thus, the corresponding target configuration file can be located based on the user level and anomaly level, and the corresponding intervention operation can be determined from the target configuration file based on the anomaly cause. This allows different users to take different intervention operations when transactions with the same anomaly cause occur, ensuring that the handling process for abnormal transactions meets risk control standards while also taking into account user experience.

[0067] For example, regarding the abnormal reason of "insufficient credit limit", since User A has a high user level, meaning that the user has never had a risky transaction, and the level of the abnormality is low, the corresponding intervention operation in the configuration file for "User A" can be a temporary increase in credit limit. This allows the user to complete the transaction without being aware of it, and then go through the compliance process of supplementary authentication and confirmation. This makes the process of handling abnormal transactions both compliant with risk control standards and takes into account user experience.

[0068] This embodiment improves the matching degree and accuracy between the selected intervention operations and the target transaction and target user by selecting the intervention operation corresponding to the target transaction based on the user level, the anomaly level and the cause of the anomaly.

[0069] To improve the security and compliance of transaction operations, optionally, in the abnormal transaction handling method provided in the embodiments of this application, if the intervention operation characterization allows the target user to execute the target transaction, the method further includes: executing the target transaction, and after completing the execution of the target transaction, generating a prompt message according to the cause of the abnormality, and sending the prompt message to the target user's transaction operation device.

[0070] For example, when the intervention indicates that the target transaction can continue, the system will immediately execute the transaction, thereby improving the timeliness of transaction execution and enabling users to complete the transaction normally. For instance, when a large transaction is blocked, if the intelligent decision determines that the user has good credit and the reason for the anomaly is a temporary overdraft, the system will automatically adjust the credit limit to allow the transaction to be completed immediately. This operation is performed automatically in the background, without requiring any additional confirmation steps from the user.

[0071] Furthermore, after a target transaction is successfully executed, the system will automatically generate a prompt message based on the reason for the abnormality of the target transaction, thereby informing the user of the intervention operation performed on it, so that the user can understand the operation performed by the system after the transaction.

[0072] For example, after adjusting the credit limit, the system sends a notification message to the user's device to let the user know that the limit has been adjusted, so that the user does not find out that the limit has been modified when checking it themselves, thus protecting the user's right to know.

[0073] This embodiment improves the convenience and transparency of the abnormal transaction handling process by automatically executing the target transaction based on the intervention operation and generating and sending transaction prompt information to the user's operating device.

[0074] To improve transaction processing efficiency and security, optionally, in the abnormal transaction handling method provided in this application embodiment, when the intervention operation indicates that the target user is not allowed to execute the target transaction, the method further includes: generating an abnormal handling process based on the abnormal reason, and generating confirmation information based on the abnormal handling process; sending the confirmation information to the target user's transaction operation device, and determining whether a confirmation instruction from the target user has been received; if a confirmation instruction is received, executing the abnormal handling process, and executing the target transaction after completing the execution operation of the abnormal handling process; if no confirmation instruction is received, terminating the target transaction, and sending the transaction request information and the abnormal reason to the operation and maintenance terminal.

[0075] For example, if the intervention operation indicates that the target user is not allowed to execute the target transaction, the system will generate an exception handling process based on the specific reason for the exception. This exception handling process is used to process the abnormal transaction and change it into a normal transaction.

[0076] After generating the exception handling process, a confirmation message can be generated based on the process. This message can inform the user how to handle the transaction, such as requiring identity verification or requesting a credit limit increase. The user then needs to provide feedback based on the confirmation message, i.e., send a confirmation command to the system. The system can then determine whether the exception transaction can be processed according to the exception handling process based on the command content. If it can be processed, the system will process the exception transaction according to the process, allowing it to execute normally. If it cannot be processed, for example, due to incorrect user identity verification information, the target transaction needs to be terminated. Similarly, if the user does not send a confirmation command, the target transaction also needs to be terminated, and the transaction request information and the reason for the exception will be sent to the operations and maintenance team. This allows the operations and maintenance team to promptly process the transaction and even the user's account based on the transaction request information and the reason for the exception, thereby improving the transaction security of financial institutions.

[0077] This embodiment generates an exception handling process and determines the user confirmation instruction, enabling the system to not only effectively resolve transaction obstacles, but also enhance transaction transparency and security, improve user experience, and increase the efficiency of bank risk management.

[0078] To improve data storage efficiency and ease of access, optionally, in the abnormal transaction processing method provided in this application embodiment, after obtaining the status identification result of the target transaction, the method further includes: if the status identification result indicates that the target transaction is abnormal, storing the transaction data in the abnormal transaction data storage unit of the data lake; if the status identification result indicates that the target transaction is not abnormal, storing the transaction data in the normal transaction data storage unit of the data lake.

[0079] For example, after completing the identification of the target transaction status, the system stores the transaction data in different units of the data lake according to the results.

[0080] When the status recognition result indicates that the target transaction is abnormal, the system needs to store the transaction data in the abnormal transaction data storage unit for subsequent anomaly analysis, risk assessment and manual review. It should be noted that in order to cope with the high-concurrency data flow during peak business transaction periods, the system adopts high-concurrency storage technology, which enables the data to be recorded in real time and accurately, thereby providing timely and accurate data support for subsequent recognition model update training.

[0081] When the status recognition result indicates that there is no anomaly in the target transaction, the system initiates a real-time update mechanism to store the transaction data in the normal transaction data storage unit. By utilizing the real-time data processing capabilities of the data lake, the transaction data can be updated to the data storage in real time, providing timely and accurate data support for subsequent recognition model update training.

[0082] This embodiment not only achieves accurate capture and management of abnormal transactions by classifying and storing transaction data based on state recognition results, but also enables normal transaction data to be updated and archived in real time. In turn, by storing data, it provides an accurate and comprehensive data foundation for subsequent updates and training of the recognition model.

[0083] To improve the accuracy of model prediction results, optionally, in the abnormal transaction processing method provided in this application embodiment, the target classification model is trained in the following manner: Abnormal transaction data within a target time period, as well as historical data and associated data for each abnormal transaction data, are obtained from the abnormal transaction data storage unit to obtain multiple first sample data, wherein each first sample data includes an abnormal transaction data, its historical data and associated data, and the abnormal reason for the abnormal transaction data; normal transaction data within a target time period, as well as historical data and associated data for each normal transaction data, are obtained from the normal transaction data storage unit to obtain multiple second sample data, wherein each second sample data includes a normal transaction data, its historical data and associated data; the multiple first sample data and the multiple second sample data are combined into a training set, and the initial classification model is trained using the training set to obtain the target classification model.

[0084] For example, to train a target classification model, the system extracts abnormal transaction data generated within a specified target time period from the abnormal transaction data storage unit. For each abnormal transaction data item, the system also retrieves its corresponding historical transaction data and related information to form a first sample dataset containing abnormal transaction data, historical data, and related data. For instance, the system might collect all transaction records judged as "insufficient credit limit" within the past month, along with related information such as user credit history, transaction channel evaluation, and transaction time window.

[0085] Similarly, the system also needs to extract normal transaction data generated within the target time period from the normal transaction data storage unit. For each normal transaction data item, the system will also call its corresponding historical transaction data and related information to form a second sample dataset that includes normal transaction data, historical data, and related data. For example, the system may collect all normal consumption transaction records within the same time period, as well as related information such as user credit history, transaction channel evaluation, and transaction time window.

[0086] Furthermore, the first and second sample datasets are merged to construct a training set that comprehensively reflects the diversity of transaction states. Using this training set, the system begins training the initial classification model. Through repeated iterations and parameter adjustments, the model learns how to accurately identify whether a transaction is abnormal and the specific reasons for the abnormality based on the characteristics of transaction data, historical data, and related data, thereby completing the training of the target recognition model.

[0087] This embodiment trains the model based on historical and correlation information of abnormal and normal transaction data, thereby improving the model's accuracy in identifying abnormal transactions.

[0088] Figure 3 This is a schematic diagram of the abnormal transaction processing system provided in Embodiment 1 of this application, as shown below. Figure 3 As shown, the abnormal transaction processing system can be used to execute the above-mentioned abnormal transaction processing methods. The system includes: a data acquisition module 31, a stream processing engine 32, a non-real-time construction module 33, a real-time analysis module 34, and an intelligent decision-making module 35. When the monitored transaction is a credit card transaction, the functions of each module are shown in Table 1.

[0089] Table 1

[0090]

[0091] The data acquisition module 31 first needs to interface with various operational channels, such as mobile banking, telephone banking, and terminal counters, to receive various credit card transaction data streams in real time. These data streams include, but are not limited to, transfer transactions, deposit and withdrawal transactions, consumption transactions, credit limit adjustment requests, and key installment payment transactions, comprehensively covering transaction types that may cause card usage anomalies. After receiving abnormal transaction data, the data acquisition module 31 uses data parsing technology to extract key elements from each abnormal transaction. These elements include at least: transaction card number, account number (de-sensitized to protect user privacy), transaction amount, transaction currency, transaction timestamp, channel where the transaction occurred, transaction amount, and anomaly reason code or description provided by the system or user.

[0092] Furthermore, to efficiently store and quickly access this critical information, the data acquisition module 31 creates and maintains a distributed, high-concurrency "card usage anomaly register." This ensures data consistency and persistence during stream processing. The register structure design must fully consider query efficiency and data integrity, supporting fast insertion, updates, and multi-dimensional query operations (such as time windows, transaction types, and anomaly reasons).

[0093] Meanwhile, throughout the entire data collection process, the data collection module 31 adheres to the principles of data security and privacy protection, encrypting sensitive information such as card numbers and accounts or using hashing technology to de-identify them, thereby ensuring data availability without disclosing users' personal information.

[0094] In other words, the data acquisition module 31 is responsible for extracting key elements of the transaction and registering the information in the "Card Usage Anomaly Register". The Card Usage Anomaly Register records the following key information, including the transaction card number, account number, transaction amount, transaction currency, transaction timestamp, transaction channel, transaction amount, and reason for the anomaly.

[0095] The stream processing engine module 32 can include a real-time data processing pipeline built on a pre-defined framework for analyzing and processing data streams from abnormal transactions. To achieve long-term data storage and efficient retrieval, data from the "Credit Card Exception Registration Book" can be efficiently migrated to the data lake tables through an optimized inbound process. This process not only improves data integrity but also leverages the flexibility and scalability of the data lake, providing a solid foundation for subsequent in-depth analysis and historical data backtracking.

[0096] In the data processing stage, streaming join operations can be used to perform real-time correlation calculations between the card usage anomaly register in the data lake and data from different sources, such as media tables and protocol tables. Through rapid matching and aggregation of multi-dimensional data, potential patterns, abnormal behaviors, or risks in credit card transactions can be revealed. The system can identify event sequences that conform to preset rules, further enhancing the depth and breadth of data analysis. Finally, the result set obtained from the above complex calculations is persistently stored in the data table.

[0097] The non-real-time building module 33 is used to build a model based on historical transaction data. By training a neural network model that integrates LSTM and deep learning technologies, it not only effectively improves the accuracy and response speed of credit card transaction monitoring, but also can adaptively adjust according to the dynamic changes in customer transaction behavior, thereby enhancing the robustness and flexibility of the system.

[0098] The real-time analysis module 34 is used to realize the instant monitoring and intelligent diagnosis of abnormal credit card transactions. Whenever new abnormal credit card data is detected in the data lake, the real-time analysis module 34 is immediately activated, connecting to the backend pre-trained model dedicated to identifying the root cause of abnormal transactions. According to business needs, the causes of abnormalities can be divided into major categories such as insufficient account limit, abnormal card status, abnormal customer information verification, triggering of risk control measures, and authorization request rejection. This classification process is not limited to basic judgment, but also goes deep into the secondary classification level, that is, automatically distinguishing between situations that "do not require manual intervention" and "require immediate manual intervention", providing financial institutions with timely and accurate operational guidelines, effectively balancing the efficiency of automated processing and the necessity of risk control.

[0099] The intelligent decision-making module 35 is used to determine the corresponding intervention operation based on real-time analysis results, thereby resolving transaction obstacles in an instant, optimizing customer experience, and strengthening risk control.

[0100] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0101] Example 2

[0102] This application also provides an apparatus for processing abnormal transactions. It should be noted that the apparatus for processing abnormal transactions in this application can be used to execute the abnormal transaction processing method provided in the above embodiments. The abnormal transaction processing apparatus provided in this application will be described below.

[0103] According to an embodiment of this application, an apparatus for implementing the above-described method for processing abnormal transactions is also provided. Figure 4 This is a schematic diagram of an abnormal transaction processing device according to Embodiment 2 of this application, as shown below. Figure 4 As shown, the device includes:

[0104] Calling unit 41 is used to obtain transaction data from the transaction request information when it receives the transaction request information initiated by the target user, and call the historical data and related data associated with the transaction data through the data lake. The transaction request is used to request the execution of the target transaction.

[0105] The identification unit 42 is used to input transaction data, historical data and related data into the target classification model to obtain the status identification result of the target transaction. The status identification result includes whether the target transaction is in an abnormal state and the abnormal reason if it is in an abnormal state.

[0106] The determination unit 43 is used to determine the intervention operation to be performed on the target transaction based on the cause of the abnormality when the status recognition result indicates that the target transaction is in an abnormal state.

[0107] The abnormal transaction processing apparatus provided in this application embodiment, upon receiving a transaction request information initiated by a target user, uses a calling unit 41 to obtain transaction data from the transaction request information and calls historical and associated data related to the transaction data through a data lake. The transaction request is used to request the execution of a target transaction. An identification unit 42 inputs the transaction data, historical data, and associated data into a target classification model to obtain a status identification result for the target transaction. This status identification result includes whether the target transaction is in an abnormal state and the reason for the abnormal state. If the status identification result indicates that the target transaction is in an abnormal state, a determining unit 43 determines the intervention operation to be performed on the target transaction based on the reason for the abnormal state. By using a data lake to access historical and associated data related to transaction data, and then using these historical and associated data to jointly determine the status identification result of the target transaction, the accuracy of the status identification result is improved. Furthermore, by determining the intervention operation to be performed on the target transaction through the cause of the anomaly, different intervention methods can be used to resolve the anomaly caused by different reasons, allowing some anomaly transactions to continue to be executed and improving the security of transaction results. This achieves the technical effect of improving the accuracy and efficiency of identifying and handling anomaly transactions, thereby improving the execution efficiency of users' business transaction operations, and thus solving the technical problem of low accuracy and efficiency in identifying and handling anomaly transactions in related technologies.

[0108] Optionally, in the abnormal transaction processing apparatus provided in this application embodiment, the calling unit 41 includes: a first acquisition module, used to acquire the transaction account of the target transaction from the transaction data, and generate a data query request based on the transaction account; and a second acquisition module, used to send the data query request to the data lake, and acquire the association information related to the transaction account and the historical information of the transaction account from the association table of the data lake based on the data query request.

[0109] Optionally, in the abnormal transaction processing apparatus provided in this application embodiment, the determining unit 43 includes: a first determining module, configured to determine the abnormality level of the target transaction based on the abnormality cause, and obtain the user level of the target user; a second determining module, configured to determine a target configuration file from a preset configuration file set based on the abnormality level and the user level, wherein the preset configuration file set includes multiple configuration files, each configuration file includes multiple preset abnormality causes, and preset intervention operations for each preset abnormality cause in the configuration file; and a third obtaining module, configured to obtain preset intervention operations under the same preset abnormality cause as the abnormality cause from the target configuration file, thereby obtaining the intervention operations to be performed on the target transaction.

[0110] Optionally, in the abnormal transaction processing apparatus provided in the embodiments of this application, when the intervention operation characterization allows the target user to execute the target transaction, the apparatus further includes: a first generation unit, used to execute the target transaction, and after completing the execution of the target transaction, generate a prompt message according to the cause of the abnormality, and send the prompt message to the target user's transaction operation device.

[0111] Optionally, in the abnormal transaction processing apparatus provided in this application embodiment, when the intervention operation indicates that the target user is not allowed to execute the target transaction, the apparatus further includes: a second generation unit, used to generate an abnormal processing flow according to the abnormal reason, and generate confirmation information according to the abnormal processing flow; a judgment unit, used to send the confirmation information to the target user's transaction operation device, and judge whether a confirmation instruction from the target user has been received; an execution unit, used to execute the abnormal processing flow when a confirmation instruction is received, and execute the target transaction after completing the execution operation of the abnormal processing flow; and a termination unit, used to terminate the target transaction when no confirmation instruction is received, and send the transaction request information and the abnormal reason to the operation and maintenance end.

[0112] Optionally, in the abnormal transaction processing apparatus provided in the embodiments of this application, after obtaining the status identification result of the target transaction, the apparatus further includes: a first storage unit, used to store the transaction data in the abnormal transaction data storage unit of the data lake when the status identification result indicates that the target transaction is abnormal; and a second storage unit, used to store the transaction data in the normal transaction data storage unit of the data lake when the status identification result indicates that the target transaction is not abnormal.

[0113] Optionally, in the abnormal transaction processing apparatus provided in this application embodiment, the target classification model is trained by the following apparatus: a first acquisition unit, configured to acquire abnormal transaction data within a target time period from the abnormal transaction data storage unit, as well as historical data and associated data of each abnormal transaction data, to obtain multiple first sample data, wherein each first sample data includes an abnormal transaction data and its historical data and associated data, and the abnormal reason of the abnormal transaction data; a second acquisition unit, configured to acquire normal transaction data within a target time period from the normal transaction data storage unit, as well as historical data and associated data of each normal transaction data, to obtain multiple second sample data, wherein each second sample data includes a normal transaction data and its historical data and associated data; and a training unit, configured to combine the multiple first sample data and the multiple second sample data into a training set, and use the training set to train the initial classification model to obtain the target classification model.

[0114] It should be noted that the aforementioned calling unit 41, identification unit 42, and determination unit 43 correspond to steps S201 to S203 in Embodiment 1. The instances and application scenarios implemented by each of these units and their corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should also be noted that the aforementioned modules or units can be hardware or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). These modules can also run as part of a device in the computer terminal 10 provided in Embodiment 1.

[0115] Example 3

[0116] Embodiments of this application may provide an electronic device. Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (Only one is shown) processor 1002, memory 1004, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0117] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0118] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.

[0119] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0120] Example 4

[0121] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the abnormal transaction processing method provided in Embodiment 1.

[0122] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0123] Embodiments of this application also provide a computer program product, which, when executed on a data processing device, is a program adapted to perform the steps of a method for processing abnormal transactions.

[0124] Embodiments of this application also provide a computer-readable storage medium, which includes a stored executable program, wherein the executable program controls the device where the computer-readable storage medium is located to perform the above-described abnormal transaction processing method when it runs.

[0125] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0126] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0127] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0128] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0129] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0130] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0131] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for handling abnormal transactions, characterized in that, include: Upon receiving a transaction request from a target user, transaction data is obtained from the transaction request information, and historical and related data associated with the transaction data are retrieved through the data lake. The transaction request is used to request the execution of the target transaction. The transaction data, the historical data, and the associated data are input into the target classification model to obtain the status identification result of the target transaction. The status identification result includes whether the target transaction is in an abnormal state and the reason for the abnormal state. If the status identification result indicates that the target transaction is in an abnormal state, the intervention operation to be performed on the target transaction is determined according to the cause of the abnormality.

2. The method according to claim 1, characterized in that, Accessing historical and related data associated with the transaction data via the data lake includes: Obtain the transaction account of the target transaction from the transaction data, and generate a data query request based on the transaction account; The data query request is sent to the data lake, and the association information related to the transaction account and the historical information of the transaction account are obtained from the association table of the data lake according to the data query request.

3. The method according to claim 1, characterized in that, The intervention operations to be performed on the target transaction based on the stated cause of the anomaly include: The anomaly level of the target transaction is determined based on the cause of the anomaly, and the user level of the target user is obtained; The target configuration file is determined from a set of preset configuration files based on the anomaly level and the user level. The set of preset configuration files includes multiple configuration files, each configuration file includes multiple preset anomaly reasons, and a preset intervention operation for each preset anomaly reason in the configuration file. Obtain the preset intervention operation under the preset abnormal reason that is the same as the abnormal reason from the target configuration file, and obtain the intervention operation to be executed on the target transaction.

4. The method according to claim 1, characterized in that, If the intervention operation characterization allows the target user to execute the target transaction, the method further includes: The target transaction is executed, and after the execution of the target transaction is completed, a prompt message is generated based on the reason for the exception, and the prompt message is sent to the target user's transaction operation device.

5. The method according to claim 1, characterized in that, If the intervention operation characterization does not allow the target user to execute the target transaction, the method further includes: An exception handling process is generated based on the cause of the exception, and information to be confirmed is generated based on the exception handling process. The information to be confirmed is sent to the target user's transaction operation device, and it is determined whether the target user's confirmation instruction has been received; Upon receiving the confirmation instruction, the exception handling process is executed, and after the execution of the exception handling process is completed, the target transaction is executed. If the confirmation instruction is not received, the target transaction is terminated, and the transaction request information and the reason for the anomaly are sent to the operation and maintenance terminal.

6. The method according to claim 1, characterized in that, After obtaining the state identification result of the target transaction, the method further includes: If the status identification result indicates that the target transaction is abnormal, the transaction data will be stored in the abnormal transaction data storage unit of the data lake; If the status identification result indicates that the target transaction is not abnormal, the transaction data is stored in the normal transaction data storage unit of the data lake.

7. The method according to claim 6, characterized in that, The target classification model is trained in the following manner: Abnormal transaction data within the target time period is obtained from the abnormal transaction data storage unit, as well as historical data and related data of each abnormal transaction data, to obtain multiple first sample data. Each first sample data includes an abnormal transaction data, its historical data and related data, and the abnormal reason of the abnormal transaction data. Normal transaction data within the target time period is obtained from the normal transaction data storage unit, as well as historical data and related data of each normal transaction data, to obtain multiple second sample data, wherein each second sample data includes a normal transaction data and its historical data and related data; The plurality of first sample data and the plurality of second sample data are combined into a training set, and the initial classification model is trained using the training set to obtain the target classification model.

8. An apparatus for processing abnormal transactions, characterized in that, include: The invocation unit is used to obtain transaction data from the transaction request information initiated by the target user upon receiving such information, and to call historical data and related data associated with the transaction data through the data lake, wherein the transaction request is used to request the execution of the target transaction; The identification unit is used to input the transaction data, the historical data and the associated data into the target classification model to obtain the status identification result of the target transaction, wherein the status identification result includes whether the target transaction is in an abnormal state and the abnormal reason if it is in the abnormal state; The determining unit is configured to determine, based on the cause of the abnormality, an intervention operation to be performed on the target transaction when the state identification result indicates that the target transaction is in an abnormal state.

9. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the abnormal transaction processing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, executes the abnormal transaction processing method according to any one of claims 1 to 7.

Images