Transaction risk prediction method, model training method, device, equipment, medium and program product

Abstract

The invention provides a transaction risk prediction method which can be applied to the technical field of artificial intelligence. The method comprises the following steps: in response to acquired transaction data, extracting transaction characteristics of the transaction data; inputting into a pre-trained transaction risk prediction model, and outputting a transaction risk prediction result; the training mode of the transaction risk prediction model comprises the following steps: in response to an obtained selected risk event type, determining a training sample from a risk feature library according to a mapping relationship between the risk event type and a risk feature type; outputting at least one rule combination by utilizing a rule generation model according to the training sample; calculating a performance index of each rule combination by using the training sample; if the performance index meets a preset index requirement, determining one of the rule combinations as a target rule combination; and training by using the target rule combination and the training sample to obtain a transaction risk prediction model. The invention further provides a model training method, a transaction risk prediction device, equipment, a storage medium and a program product.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, specifically to financial risk management, and more specifically to a method for predicting transaction risks, a model training method, an apparatus, equipment, medium, and program product. Background Technology

[0002] In the modern financial system, banks face various risks, including credit risk, market risk, and operational risk. Accurate assessment and effective management of these risks are crucial for the sound operation of banks. Furthermore, while existing modeling platforms offer general modeling capabilities, they suffer from the following problems: 1. High technical threshold: Existing modeling platforms typically require advanced technical skills, making it difficult for ordinary business personnel to quickly learn and use them. 2. Lack of specificity: Existing platforms are not specifically adapted for risk control scenarios, failing to meet the diverse needs of the risk domain. 3. Low modeling efficiency: The modeling process in the risk domain involves complex data processing, feature engineering, and model optimization, requiring significant manual intervention and resulting in low efficiency. 4. Difficulty in model sharing: The experience of risk control experts in different fields is difficult to accumulate and share, leading to duplication of effort and wasted resources. Summary of the Invention

[0003] In view of the above problems, this application provides a method for predicting transaction risk, a method for training models, an apparatus, an equipment, a medium, and a program product to improve the efficiency of risk modeling.

[0004] According to a first aspect of this application, a method for predicting transaction risk is provided, comprising: in response to acquiring transaction data, extracting transaction features from the transaction data, the transaction features indicating information affecting the determination of the degree of transaction risk; inputting the transaction features into a pre-trained transaction risk prediction model, and outputting a transaction risk prediction result; wherein the transaction risk prediction model is trained by: in response to acquiring a selected risk event type, determining training samples from a risk feature library based on the mapping relationship between risk event types and risk feature types, wherein the risk feature library contains training samples labeled with different risk feature types; outputting at least one rule combination using a rule generation model based on the training samples, the rule combination being used to classify the risk of the training samples based on a regression algorithm; calculating a performance index for each rule combination using the training samples, the performance index including at least one of recall, precision, discriminant ability, group stability, and accuracy; if the performance index meets preset index requirements, determining one of the rule combinations as a target rule combination; and training using the target rule combination and the training samples to obtain a transaction risk prediction model.

[0005] According to embodiments of this application, training using target rule combinations and training samples includes: converting the target rule combinations into numerical features based on the training samples; fusing the numerical features and the transaction features of the training samples to obtain fused features; and using the fused features to train a transaction risk prediction model based on a regression algorithm.

[0006] According to an embodiment of this application, training using a combination of target rules and training samples includes: screening training samples using the combination of target rules to remove samples with risk values ​​exceeding a preset range to obtain core samples; extracting transaction features of the core samples; and training a transaction risk prediction model based on a regression algorithm using the transaction features of the core samples.

[0007] According to an embodiment of this application, training using target rule combination and training samples includes: using target rule combination to input pre-trained risk score regression model with training samples not covered, and outputting risk score for each training sample; in response to a risk score greater than a preset threshold, supplementing rule combination based on the uncovered training samples.

[0008] According to an embodiment of this application, a transaction risk prediction model is obtained by training a regression algorithm based on a target rule combination and training samples, including: performing conflict detection between the output of the transaction risk prediction model and the rule combination; if the score of the transaction risk prediction model for bad samples defined by the rule combination is lower than a preset threshold, increasing the weight value of the feature corresponding to the bad sample, wherein the risk level of bad samples defined by the rule combination is higher than that of normal transaction samples.

[0009] According to an embodiment of this application, the performance index of each rule combination is calculated using training samples, including: selecting first risk transaction details that conform to the rule combination at a first time point from the training samples; obtaining second risk transaction details that actually occurred at a second time point from the training samples, wherein the second time point is later than the first time point; and obtaining the risk identification rate of the rule combination based on the ratio of the number of overlaps between the second risk transaction details and the first risk transaction details to the total number of second risk transaction details.

[0010] According to an embodiment of this application, the training method of the transaction risk prediction model includes: performing statistical analysis on the training samples according to the type of risk event, and outputting at least one of the following distributions for each feature of the training samples: missing rate, mean, median, or dictionary value; preprocessing the features of the training samples, including at least one of normalization, binarization, missing value imputation, or binning method definition; and screening the transaction features of the training samples through information value calculation and / or stepwise regression algorithm.

[0011] The second aspect of this application provides a method for training a trading risk prediction model, comprising: in response to obtaining a selected risk event type, determining training samples from a risk feature library based on the mapping relationship between risk event types and risk feature types, wherein the risk feature library contains training samples labeled with different risk feature types; using a rule generation model to output at least one rule combination based on the training samples, the rule combination being used to classify the risk of the training samples based on a regression algorithm; calculating a performance index for each rule combination using the training samples, the performance index including at least one of recall, precision, discriminant power, group stability, and accuracy; if the performance index meets preset index requirements, determining one of the rule combinations as a target rule combination; and training using the target rule combination and the training samples to obtain a trading risk prediction model.

[0012] A third aspect of this application provides a transaction risk prediction device, comprising: a transaction data acquisition module, configured to extract transaction features from the acquired transaction data, wherein the transaction features indicate information affecting the determination of the degree of transaction risk; and a transaction risk prediction module, configured to input the transaction features into a pre-trained transaction risk prediction model and output a transaction risk prediction result; wherein the transaction risk prediction model is trained in the following manner: in response to acquiring a selected risk event type, determining training samples from a risk feature library based on the mapping relationship between risk event types and risk feature types, wherein the risk feature library contains training samples labeled with different risk feature types; outputting at least one rule combination using a rule generation model based on the training samples, wherein the rule combination is used to classify the risk of the training samples based on a regression algorithm; calculating the performance index of each rule combination using the training samples, wherein the performance index includes at least one of recall, precision, discrimination ability, group stability, and accuracy; if the performance index meets the preset index requirements, determining one of the rule combinations as a target rule combination; and training using the target rule combination and the training samples to obtain a transaction risk prediction model.

[0013] A fourth aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0014] A fifth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0015] A sixth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0016] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 The illustrations depict application scenarios of the transaction risk prediction method, model training method, apparatus, device, medium, and program product according to embodiments of this application.

[0018] Figure 2 A flowchart illustrating a transaction risk prediction method according to an embodiment of this application is shown schematically.

[0019] Figure 3 The diagram illustrates a sample structure of the risk feature library according to an embodiment of this application.

[0020] Figure 4 This illustration schematically shows a feature filtering function according to an embodiment of the present application;

[0021] Figure 5 A flowchart illustrating a method for training a transaction risk prediction model according to an embodiment of this application is shown.

[0022] Figure 6 This schematic diagram illustrates the structural block diagram of a transaction risk prediction device according to an embodiment of the present application;

[0023] Figure 7 This schematic diagram illustrates the structural block diagram of a risk model incubation engine module according to an embodiment of this application;

[0024] Figure 8 This schematically illustrates the relationship between the risk model incubation engine and other modules according to embodiments of this application; and

[0025] Figure 9 A block diagram schematically illustrates an electronic device suitable for implementing a transaction risk prediction method according to an embodiment of this application. Detailed Implementation

[0026] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0027] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0028] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0029] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0030] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0031] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0032] The embodiments of this application provide a transaction risk prediction method, which, in response to acquiring transaction data, extracts transaction features from the transaction data; inputs the transaction features into a pre-trained transaction risk prediction model, and outputs transaction risk prediction results.

[0033] This application's embodiment of the transaction risk prediction model training process leverages an enterprise-level data foundation to provide a standardized risk modeling workflow from sample selection to model construction. It supports the incubation of various model types with zero-code encapsulation, thereby achieving the following objectives: 1. Lowering the modeling threshold in the risk domain: By encapsulating general modeling platform capabilities with risk domain-specific application scenarios, more business experts can complete risk feature analysis, mining, and model construction with minimal or even zero coding. 2. Standardizing risk domain modeling methods: Through a standardized modeling process, it accumulates common modeling capability components and provides full-cycle post-investment model operation capabilities, allowing for the accumulation and sharing of experience from risk control experts across various fields. 3. Improving modeling efficiency and effectiveness: Through automated feature engineering, standardized modeling processes, and an enterprise-level data foundation, it efficiently selects highly adaptable risk features, thereby improving modeling efficiency and effectiveness.

[0034] Figure 1 The illustrations depict application scenarios of transaction risk prediction methods, training methods, apparatuses, devices, media, and program products according to embodiments of this application.

[0035] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0036] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0037] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0038] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0039] It should be noted that the transaction risk prediction method and training method provided in this application embodiment can generally be executed by server 105. Correspondingly, the transaction risk prediction device provided in this application embodiment can generally be located in server 105. The transaction risk prediction method and training method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the transaction risk prediction device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0040] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0041] The following will be based on Figure 1 The described scene, through Figures 2-4 The transaction risk prediction method according to the embodiments of this application will be described in detail.

[0042] Figure 2 A flowchart illustrating a transaction risk prediction method according to an embodiment of this application is shown.

[0043] like Figure 2 As shown, the transaction risk prediction method in this embodiment includes operations S210 to S220.

[0044] In operation S210, in response to acquiring transaction data, the transaction features of the transaction data are extracted.

[0045] In embodiments of this application, the consent or authorization of the trading user can be obtained before acquiring the trading user's information. For example, a request to acquire user information can be sent to the trading user before operation S210. If the trading user agrees or authorizes the acquisition of user information, operation S210 is executed.

[0046] In the embodiments of this application, a corresponding operation entry point can be provided for trading users, allowing them to choose to agree to or reject the automated decision-making result. That is, before processing / making a decision on the trading user information in step S210, the trading user can provide their consent or rejection instruction via the corresponding operation entry point. If the trading user agrees to the processing / decision, then the trading user information is processed / made a decision in step S210. If the trading user refuses to process / make a decision, then the expert decision-making process begins.

[0047] Transaction characteristics indicate information that influences the determination of the level of transaction risk. Transaction characteristics may include core basic information such as the transaction amount, transaction type, and transaction frequency, as well as the degree of difference between this transaction and the customer's historical similar transactions; transaction characteristics may also include behavioral attributes indicating the customer's behavior when initiating this transaction, such as familiarity with the transaction device, the matching degree between the login Internet Protocol (IP) location (hereinafter referred to as "location") and the commonly used address, and the degree of fit between the transaction time and the customer's regular transaction time; transaction characteristics may also include security attributes indicating the transaction environment, including network environment type, risk level of the transaction terminal, and geofencing matching status; transaction characteristics may also include historical risk association information indicating the customer, including risk labels of historical transactions and risk status of associated accounts.

[0048] In operation S220, the transaction features are input into the pre-trained transaction risk prediction model, and the transaction risk prediction result is output.

[0049] The trading risk prediction model is trained as follows: In response to the selection of a risk event type, training samples are determined from a risk feature library based on the mapping relationship between risk event types and risk feature types. This risk feature library contains training samples labeled with different risk feature types. Based on the training samples, a rule generation model outputs at least one rule combination, which is used to classify the risk of the training samples using a regression algorithm. Performance metrics for each rule combination are calculated using the training samples. These performance metrics include at least one of recall, precision, discriminant power, group stability, and accuracy. If the performance metrics meet preset requirements, one of the rule combinations is selected as the target rule combination. The trading risk prediction model is then trained using the target rule combination and the training samples.

[0050] Figure 3 The diagram illustrates a sample structure of the risk feature library according to an embodiment of this application.

[0051] This embodiment allows for the pre-construction of a risk feature library and a risk event library. The risk feature library is structured according to an expandable, multi-level directory structure, classifying, processing, and storing risk data based on different categories. The directory structure, categorized and labeled at different levels, facilitates the current modeling personnel in finding and understanding the meaning of features. It also supports online customization and processing of personalized features by users.

[0052] exist Figure 3 The risk characteristic database structure shown includes three levels: a first-level category containing micro, meso, and macro classifications; a second-level category containing categories such as A-type customers, B-type customers, products, and markets; a third-level category containing information from A to F; and a fourth-level category that can include situations 1 to 4. Each situation further includes characteristics from A to E. For transaction risk, characteristics may include basic transaction characteristics, customer behavior characteristics, transaction environment characteristics, historical risk characteristics, and derivative analysis characteristics. Basic transaction characteristics may specifically include transaction amount, transaction time, transaction type, transaction frequency, and transaction counterparty. For example, for asset transaction risk, characteristics may include the ratio of fixed assets to total assets, fixed asset growth rate, loan-to-deposit turnover ratio, the ratio of accounts receivable to current assets, and the ratio of accounts receivable to total assets.

[0053] In this embodiment, the risk event database is associated with risk scenario tags (such as customer default, overdue bills, abnormal credit card transactions, supply chain anomalies, etc.), supporting event-driven automatic feature tagging. Risk event type tags may also include: sudden increases in transaction amounts, destinations in high-risk areas, and first-time transactions with unfamiliar devices. The mapping relationship between risk event types and risk feature types can be a preset mapping relationship, or it can be obtained by performing semantic analysis on the risk event types or inputting them into a pre-trained relational mapping model.

[0054] For example, a user in the modeling database can open the risk event database's tag list and directly select "Personal credit card overdue for more than 90 days". Based on the user's selection, the database identifies the corresponding tags such as "personal customer", "credit card", and "overdue for more than 90 days". In the risk feature database, it locates relevant features such as "financial information", "repayment behavior information", and "credit information" under the "personal customer" category.

[0055] Based on the corresponding risk event type labels above, training samples are determined from the risk feature database. For example, if the user selects "abnormal credit card transaction" as the risk event type, transaction records that simultaneously meet the following characteristics are selected as bad samples: transaction amount characteristic: "the transaction amount / the average transaction amount in the past 30 days > 3"; address characteristic: the transaction location is a high-risk area overseas; device characteristic: the transaction device is an unfamiliar device that the customer has never used before.

[0056] The rule generation model can output at least one combination of rules based on training samples (including feature data and good / bad labels). In this embodiment, the rule generation model can be a pre-trained decision tree algorithm, genetic algorithm, or other algorithmic model.

[0057] In the above example of abnormal credit card transactions, three candidate rule combinations can be output, as follows:

[0058] Rule combination 1: (Transaction amount / 30-day average > 3) and (location is a high-risk overseas region) → High risk; (Transaction amount / 30-day average ≤ 3) or (location is a commonly used domestic region) → Low risk.

[0059] Rule combination 2: (Transaction of unfamiliar equipment) and (Transaction outside business hours) and (Transaction amount > 50,000 yuan) → High risk; (Transaction of familiar equipment) or (Transaction during business hours) or (Amount ≤ 50,000 yuan) → Low risk.

[0060] Rule combination 3: (Abnormal location) or (transactions using unfamiliar devices) or (more than 5 transactions in the last hour) → High risk; (normal location) and (frequently used devices) and (less than 5 transactions in the last hour) → Low risk.

[0061] During the performance evaluation phase, performance metrics for each rule combination are calculated using the training samples. For example, the evaluated performance metrics for rule combination 1 are: recall 82%, precision 76%, discrimination ability 0.45, population stability 0.08, and accuracy 89%; for rule combination 2, they are: recall 65%, precision 89%, discrimination ability 0.38, population stability 0.09, and accuracy 91%; and for rule combination 3, they are: recall 95%, precision 62%, discrimination ability 0.42, population stability 0.12, and accuracy 85%.

[0062] Assume the preset performance indicators are recall ≥70%, precision ≥70%, discrimination ability ≥0.4, and group stability ≤0.1. Rule combination 1 meets the indicator requirements, and is therefore selected as the target rule combination. Subsequently, a trading risk prediction model is obtained by training a regression algorithm using rule combination 1 and the training samples.

[0063] This embodiment extracts transaction features from transaction data and inputs them into a transaction risk prediction model, enabling rapid and reliable transaction risk prediction results. During the training phase of the transaction risk prediction model, training samples are selected from a risk feature library based on the user's choice of risk event types, lowering the technical threshold for risk model building. A rule generation model automatically generates candidate rule combinations, and these combinations are then selected based on performance indicators, standardizing the modeling process by incorporating expert experience. Finally, the final transaction risk prediction model is trained using the determined target rule combinations that meet the indicator requirements, ensuring the model possesses both strong interpretability and high prediction accuracy, reducing modeling difficulty and improving modeling efficiency.

[0064] In some embodiments of this application, training using target rule combinations and training samples includes: converting the target rule combinations into numerical features based on the training samples; fusing the numerical features and the transaction features of the training samples to obtain fused features; and using the fused features to train a transaction risk prediction model based on a regression algorithm.

[0065] The target rule combination is a logical judgment of risk. For specific training samples, it can be transformed into quantifiable numerical features and input into the model for training. For example, the target rule combination is: (transaction amount / 30-day average > 3) and (originating from a high-risk overseas region) → high risk. When a transaction simultaneously meets the conditions of "amount deviation > 3" and "originating from a high-risk overseas region", the feature value is 1; otherwise, it is 0.

[0066] Suppose the original features of a transaction record in the training sample are: transaction amount: 10,000 yuan; average transaction amount in the past 30 days: 2,000 yuan; amount deviation = 10,000 / 2,000 = 5; location: high-risk overseas region; device type: unfamiliar device. Based on this training sample, the target rules are combined and transformed into numerical features; then, the numerical features are fused with the transaction features of the training sample. The fused features are: transaction amount: 10,000 yuan; average transaction amount in the past 30 days: 2,000 yuan; amount deviation: 5; location: 1; device type: 1. Using the fused features as input, the logistic regression algorithm is selected, and the actual risk label of the transaction (e.g., 1 indicates an abnormal transaction, 0 indicates a normal transaction) is used as output to train the model.

[0067] This embodiment transforms target rule combinations into numerical features, integrates them with transaction features, and trains the model using a regression algorithm. This achieves synergy between rule combinations based on business experience and sample data. Furthermore, the integration with transaction features and the application of regression algorithms enable the model to uncover complex risk correlations hidden within the data, achieving both data-driven prediction accuracy. The transaction risk prediction model achieves both rule interpretability and the ability to capture implicit risks, improving the comprehensiveness of risk identification and the reliability of prediction results. It effectively meets the interpretability and high accuracy requirements of transaction risk scenarios.

[0068] In some embodiments of this application, training using a combination of target rules and training samples includes: filtering training samples using the combination of target rules to remove samples with risk values ​​exceeding a preset range to obtain core samples; extracting transaction features of the core samples; and training a transaction risk prediction model based on a regression algorithm using the transaction features of the core samples.

[0069] This embodiment utilizes a combination of target rules to filter extreme or noisy samples, focusing on core effective samples to train the model. This reduces the interference of abnormal data on the model and improves prediction stability and accuracy.

[0070] For example, in a certain business scenario, the risk value distribution is 0-1 (1 represents the highest risk). The risk value range of 0.2-0.8 is the area the model needs to focus on learning, as learning this range can improve the model's generalization ability. The original training samples contain 1000 abnormal transactions (bad samples) and 5000 normal transactions (good samples). The risk value is calculated for each original sample using a combination of objective rules, and filtered according to a preset range (risk value 0.2-0.8), removing samples with a risk value ≥0.8 and a risk value ≤0.2. After this filtering, 4800 core samples are obtained. The transaction features of the core samples can be represented by numerical features, and the logistic regression algorithm is selected to train the model.

[0071] This embodiment uses a combination of target rules to select training samples, removes interference samples with extreme risk values, and obtains more representative core samples. Then, a regression algorithm is used to train the model based on the transaction characteristics of the core samples. This can effectively reduce the interference of extreme samples and noise on the model, making the model more focused on gray risk scenarios that require precise prediction, thereby improving the accuracy of the transaction risk prediction model in identifying complex risks. At the same time, the selection logic of the rule combination is based on a clear definition of business risks, making the correlation between the characteristics of the core samples and risks more intuitive, and enhancing the interpretability of the final model output results.

[0072] In some embodiments of this application, the screening of training samples using target rule combinations further includes: using training samples not covered by the rule combinations to input a pre-trained risk score regression model and output a risk score for each training sample; and supplementing rule combinations based on the uncovered training samples in response to a risk score greater than a preset threshold.

[0073] In this embodiment, training samples not covered by rule combinations refer to samples that do not meet any existing rule combination judgment conditions, neither triggering high-risk rules nor low-risk rules, and are in the rule judgment blind spot.

[0074] A pre-trained risk score regression model can output a quantitative risk score in the 0-1 range. The risk score regression model can reuse the trading risk prediction model, thereby simplifying the number of models.

[0075] Existing rule combinations may only identify explicitly high-risk samples, while omitting samples with atypical features but still considered high-risk. By utilizing a risk score regression model to filter high-risk samples from the blind spots and supplementing the rules, the rule combinations can cover more high-risk scenarios, thus reducing the false negative rate.

[0076] For example, the existing target rule combination in this embodiment includes: (Amount deviation > 3) AND (Location is a high-risk overseas region) → High risk. The preset threshold is 0.7. When the risk score is greater than 0.7, the training sample is determined to be a high-risk, uncovered sample, and additional rules need to be added.

[0077] Training sample A has the following characteristics: amount deviation = 2.8, origin risk value = 0.5 (for ordinary overseas regions), device unfamiliarity = 1, and transaction time risk value = 0.6 (outside business hours), indicating an abnormal transaction. Assume the regression model outputs a risk score of 0.82 for training sample A, which is higher than the preset threshold. Training sample B has the following characteristics: amount deviation = 2.5, origin risk value = 0 (for domestic regions), device unfamiliarity = 1, and transaction time risk value = 0.6 (outside business hours), indicating an abnormal transaction. Assume the regression model outputs a risk score of 0.78, which is higher than the preset threshold.

[0078] Analysis revealed that training samples A and B share the following common characteristics: Device unfamiliarity = 1 (unfamiliar device) AND Transaction period risk value = 0.6 (outside business hours) AND Amount deviation ≥ 2.0. Based on these common characteristics, a new rule was generated and added to the existing rule combination. The new rule is: (Device unfamiliarity = 1) AND (Transaction period risk value = 0.6) AND (Amount deviation ≥ 2.0) → High risk.

[0079] This embodiment uses rule combinations to quickly cover explicit risk scenarios, ensuring the interpretability and efficiency of risk identification; then, it uses a regression model to deeply model samples not covered by the rules, capturing complex implicit risks and improving the comprehensiveness of identification; and uses training samples greater than a preset threshold to supplement the rules in reverse, forming a closed loop between rules and algorithms, ultimately achieving a synergistic improvement in the accuracy, comprehensiveness, and self-optimization capabilities of risk identification.

[0080] In some embodiments of this application, a transaction risk prediction model is trained based on a regression algorithm according to a target rule combination and training samples, including: performing conflict detection between the output of the transaction risk prediction model and the rule combination; if the score of the transaction risk prediction model for bad samples defined by the rule combination is lower than a preset threshold, increasing the weight value of the feature corresponding to the bad sample, wherein the risk level of bad samples defined by the rule combination is higher than that of normal transaction samples.

[0081] In this embodiment, the rule combinations clearly define which feature combinations are bad samples. Therefore, after model training, it is necessary to ensure that the model can also assign a high-risk score to bad samples defined by the rules. This avoids conflicts where the rules classify a sample as high-risk, while the model classifies it as low-risk. If a bad sample defined by a rule combination has a risk score output by the model that is less than a preset threshold (e.g., 0.5), and is thus classified as low-risk, then this bad sample is a training sample with a conflict. For such bad samples, the weight values ​​of their corresponding transaction features need to be adjusted to improve the model's recognition accuracy.

[0082] For example, the target rule combination includes: Rule 1: (Amount deviation > 3) AND (Original location is a high-risk overseas region) → bad sample; Rule 2: (Device unfamiliarity = 1) AND (Transaction period risk value = 0.6) AND (Amount deviation ≥ 2.0) → bad sample.

[0083] The initial model weights can be expressed as: Probability of abnormal transactions = Classification function (0.1 × Amount deviation + 0.2 × Location risk value + 0.15 × Device unfamiliarity + 0.1 × Transaction time period risk value + 0.05 × Frequency in the past hour - 0.5).

[0084] The characteristics of a training sample C include: a deviation of 3.2 (>3), and a risk value of 1 for the region of origin (high risk overseas), classifying it as a bad sample according to the rule combination. However, the initial model risk score is 0.42 < 0.5 (preset threshold), which conflicts with the initial model risk score.

[0085] Based on the characteristics of the training sample C above, the weights of the amount deviation and the risk value of the originating region are increased. For example, the adjusted model weights can be expressed as: Anomaly Probability = Classification Function (0.25 × Amount Deviation + 0.3 × Originating Region Risk Value + 0.3 × Device Unfamiliarity + 0.2 × Transaction Time Risk Value + 0.05 × Frequency in the Last Hour - 0.5). The adjusted transaction risk prediction model can correctly identify the training sample C.

[0086] This embodiment detects conflicts between the model output and rule combinations during the training process of the transaction risk prediction model, and increases the corresponding feature weights for high-risk negative samples defined by the rules. On the one hand, it can promptly identify logical deviations between the model and business rules, ensuring that the model's prediction direction is consistent with the rule logic based on business experience. On the other hand, by strengthening the weights of high-risk sample features, it can effectively improve the model's accuracy in identifying high-risk transactions, enhance risk coverage, and make the model's prediction logic more aligned with the business's definition of risk, thereby improving the model's interpretability and business adaptability.

[0087] In some embodiments of this application, the performance index of each rule combination is calculated using training samples, including: selecting first risk transaction details that meet the rule combination at a first time point from the training samples; obtaining second risk transaction details that actually occurred at a second time point from the training samples, wherein the second time point is later than the first time point; and obtaining the risk identification rate of the rule combination based on the ratio of the number of overlaps between the second risk transaction details and the first risk transaction details to the total number of second risk transaction details.

[0088] The method for obtaining performance indicators in this embodiment may include conducting backtesting on historical data, selecting details from the first historical time point, running rules, comparing them with the list of customers who have defaulted at the second subsequent time point, and statistically analyzing indicators such as risk identification rate.

[0089] Risk identification rate can be used to measure the forward-looking risk capture capability of a combination of rules. It is calculated by comparing the overlap between high-risk transactions identified in advance by the rules and the risk transactions that actually occur later, reflecting whether the rules can effectively identify potential risks before they occur.

[0090] For example, a certain rule combination is: (amount deviation > 3) AND (originating from a high-risk overseas region) → high risk.

[0091] Transactions meeting the rule combination criteria on January 1, 2024 (first time point) were selected from the training sample, resulting in 800 transactions (first-risk transaction details). The rules predicted that these transactions might experience anomalies in the future. Transactions meeting the rule combination criteria on April 1, 2024 (second time point) were selected from the training sample, resulting in 100 transactions (second-risk transaction details). Comparing the 800 first-risk transactions with the 100 second-risk transactions, it was found that 85 of these transactions were both predicted as high-risk by the rules and actually experienced anomalies. The risk identification rate was calculated as 85 ÷ 100 × 100% = 85%. This means that 85% of the actual abnormal transactions were identified by the rules before the risk occurred, indicating that the rule combination has strong foresight.

[0092] This embodiment compares historical data at different points in time and verifies the performance of rule combinations through actual risk results. This ensures that the evaluation of the effectiveness of rule combinations is consistent with real business scenarios, and can intuitively quantify the ability of rule combinations to identify risks in advance. At the same time, the clear indicator calculation method allows modelers to quickly judge the advantages and disadvantages of different rule combinations, providing accurate data support for subsequent selection of the optimal rule combination and optimization of risk models, ultimately improving the practical application value and reliability of risk models.

[0093] In some embodiments of this application, the training method of the transaction risk prediction model includes: performing statistical analysis on the training samples according to the type of risk event, and outputting at least one of the following: the missing rate, mean, median, or dictionary value distribution of each feature of the training samples; preprocessing the features of the training samples, including at least one of normalization, binarization, missing value imputation, or binning method definition; and screening the transaction features of the training samples through information value calculation and / or stepwise regression algorithm.

[0094] Figure 4 The illustration shows a schematic diagram of a feature filtering function according to an embodiment of this application.

[0095] like Figure 4 As shown, feature exploration clarifies the basic attributes of features through statistical analysis, providing a basis for subsequent processing. Specifically, it can statistically analyze features such as missing rate, mean, median, and dictionary value distribution. Dictionary value distribution can be used for categorical features to count the frequency of occurrence of each category value, identifying outlier categories or long-tailed distributions.

[0096] For example, for risk events classified as "abnormal transactions," the focus is on analyzing "behavioral characteristics" such as the deviation of transaction amount, the distribution of the origin, the unfamiliarity of the equipment, and the concentration of transaction time periods, paying attention to the missing rate and outlier distribution of these characteristics.

[0097] Feature processing includes normalization, binarization, missing value imputation, and binning definition. Missing value imputation can fill in missing values ​​using the mean, median, or algorithms to ensure feature integrity. Binning definition discretizes continuous features into intervals, enhancing rule interpretability and avoiding model sensitivity to extreme values. These feature processing steps make training samples more suitable for model input, improving modeling performance.

[0098] For example, classification features such as "location" and "equipment type" are processed using binarization, such as assigning 1 to high-risk overseas locations and 1 to unfamiliar equipment.

[0099] Feature recommendation involves using information value calculation and / or stepwise regression algorithms to select the most valuable features for the model, reducing redundancy and improving efficiency. Information value calculation measures a feature's ability to distinguish risk; the higher the information value, the stronger the predictive power of the feature. Stepwise regression algorithms automatically select the optimal subset of features by iteratively adding or removing features, balancing model complexity and predictive performance.

[0100] For example, behavioral features can be screened based on information value calculation, with priority given to features with an information value greater than 0.1, such as device unfamiliarity, transaction time risk value, and amount deviation.

[0101] The recommended features can be used as input to the rule generation model to output at least one combination of rules, thereby simplifying the modeling process.

[0102] This embodiment first conducts statistical analysis on the features of the training samples to accurately assess the quality of the features, providing a data basis for subsequent processing. Then, through preprocessing such as normalization, missing value imputation, and binning definition, the features are adapted to the model input requirements, improving the stability and interpretability of the modeling. By using information value calculation and / or stepwise regression algorithms to filter features, core features with high discriminative power for transaction risk prediction are retained while redundant features are eliminated. This allows the transaction risk prediction model to maintain prediction accuracy while also being efficient and interpretable, comprehensively improving the model's performance and practical value.

[0103] Based on the above-mentioned transaction risk prediction method, this application also provides a method for training a transaction risk prediction model.

[0104] In some embodiments of this application, a method for training a transaction risk prediction model includes: in response to obtaining a risk event type selected by a user, determining training samples from a risk feature library based on the corresponding risk event type label, wherein the risk feature library contains training samples labeled with different risk event type labels; using a rule generation model to output at least one rule combination based on the training samples, the rule combination being used to classify the risk of the training samples based on a regression algorithm; calculating a performance index for each rule combination using the training samples, the performance index including at least one of recall, precision, discriminant ability, group stability, and accuracy; if the performance index meets preset index requirements, determining one of the rule combinations as a target rule combination; and training using the target rule combination and the training samples to obtain a transaction risk prediction model.

[0105] Figure 5 A flowchart illustrating a method for training a transaction risk prediction model according to an embodiment of this application is shown.

[0106] like Figure 5 In this embodiment, during the sample selection stage, samples that meet the modeling requirements are flexibly filtered based on the risk feature library to determine the modeling target; the risk event library automatically labels bad samples based on the event types selected by the user. After completing the initial training set construction, click Next to proceed to the feature selection stage.

[0107] During the feature selection phase, a built-in intelligent algorithm toolkit encompassing feature exploration, processing, and recommendation allows users to easily select high-quality features suitable for the current modeling objective with a single click, effectively improving modeling efficiency and lowering the modeling threshold. In response to the selected risk event type, training samples are determined from the risk feature database based on the mapping relationship between risk event types and risk feature types.

[0108] During the model building phase, diverse model building methods are employed, including rule generation models and algorithmic models. The rule generation model provides an algorithmic function for automatically recommending rule strategies, automatically recommending rule combinations using decision trees, and outputting at least one rule combination based on training samples. The algorithmic model reads the feature training set determined in the preceding steps to begin modeling, automatically generating regression model parameters, coefficients and intercepts for each feature, and providing a performance evaluation report for the regression model. It also calculates the performance metrics for each rule combination using training samples.

[0109] During the trial and validation phase, the generated model enables automatic calculation and result preview, and provides professional indicators such as recall, precision, discrimination ability, group stability, and accuracy for each combination, facilitating data validation by modelers. It can also conduct backtesting on historical data, selecting historical time points, running rules, and comparing the results with lists of defaulting customers sent at subsequent time points to calculate indicators such as risk identification rate.

[0110] If the performance indicators meet the preset requirements, one of the rule combinations is selected as the target rule combination; finally, the target rule combination and training samples are used to train and obtain the transaction risk prediction model.

[0111] Based on the above-mentioned transaction risk prediction method, this application also provides a transaction risk prediction device. The following will be combined with... Figures 6-8 The device is described in detail.

[0112] Figure 6 A schematic block diagram of a transaction risk prediction device according to an embodiment of this application is shown.

[0113] like Figure 6 As shown, the transaction risk prediction device 600 of this embodiment includes a transaction data acquisition module 610 and a transaction risk prediction module 620.

[0114] The transaction data acquisition module 610 is used to extract transaction features from the acquired transaction data in response to the acquisition of transaction data. The transaction features indicate information that affects the determination of the degree of transaction risk.

[0115] The transaction risk prediction module 620 is used to input transaction features into a pre-trained transaction risk prediction model and output transaction risk prediction results.

[0116] The trading risk prediction model is trained as follows: In response to the selection of a risk event type, training samples are determined from a risk feature library based on the mapping relationship between risk event types and risk feature types. This risk feature library contains training samples labeled with different risk feature types. Based on the training samples, a rule generation model outputs at least one rule combination, which is used to classify the risk of the training samples using a regression algorithm. Performance metrics for each rule combination are calculated using the training samples. These performance metrics include at least one of recall, precision, discriminant power, group stability, and accuracy. If the performance metrics meet preset requirements, one of the rule combinations is selected as the target rule combination. The trading risk prediction model is then trained using the target rule combination and the training samples.

[0117] According to an embodiment of this application, the transaction risk prediction device 600 further includes a risk model incubation engine module, which is used to obtain a transaction risk prediction model through training.

[0118] Figure 7 The diagram illustrates the structural block diagram of a risk model incubation engine module according to an embodiment of this application.

[0119] like Figure 7 As shown, the risk model incubation engine module includes an enterprise-level risk data foundation, containers, and a visual modeling workflow engine.

[0120] The enterprise-level risk data foundation includes a risk feature library and a risk event library. The visual modeling workflow engine can be used for sample selection, feature filtering, model building, trial verification, and automatic integration with subsequent model management processes. The containers specifically include feature filtering toolkits, model building algorithm toolkits, and model verification algorithm toolkits.

[0121] The enterprise-level risk data foundation and visual modeling workflow engine can be equipped with user permission isolation for strict control over data access permissions for head office and branch users, enabling limited data sharing across the entire bank.

[0122] Figure 8 The diagram illustrates the relationship between the risk model incubation engine and other modules according to an embodiment of this application.

[0123] like Figure 8 As shown, after modeling is completed in the risk model incubation engine module, the model enters the model process management module after approval. The model process management module is responsible for standardized control over model versions, deployment processes, and access management to ensure the model meets business specifications and risk control requirements. After model release, it enters the model operation module. During the model operation phase, the model monitoring and early warning module continuously monitors the model's operational status and optimizes it. The optimization process feeds back requirements to the risk model incubation engine module, initiating a new round of model iteration, such as updating features, adjusting rule parameters, and optimizing algorithms. The closed-loop process between the risk model incubation engine module and the model process management module, model operation module, and model monitoring and early warning module enables unified management and storage of model parameters and underlying feature data after incubation through this engine. It can be seamlessly integrated with the model process management module, model operation module, and post-investment model risk monitoring and early warning module, truly achieving full lifecycle management of risk models.

[0124] According to an embodiment of this application, the risk model incubation engine module is used to transform the target rule combination into numerical features based on the training samples; to fuse the numerical features and the transaction features of the training samples to obtain fused features; and to train a transaction risk prediction model based on a regression algorithm using the fused features.

[0125] According to an embodiment of this application, the risk model incubation engine module is further used to screen training samples using a combination of target rules, remove samples with risk values ​​exceeding a preset range, and obtain core samples; extract the transaction features of the core samples; and use the transaction features of the core samples to train a transaction risk prediction model based on a regression algorithm.

[0126] According to an embodiment of this application, the risk model incubation engine module is further configured to combine uncovered training samples using target rules, input the pre-trained risk score regression model, and output the risk score of each training sample; in response to a risk score greater than a preset threshold, supplementary rule combinations are made based on the uncovered training samples.

[0127] According to an embodiment of this application, the risk model incubation engine module is also used to perform conflict detection between the output of the transaction risk prediction model and the rule combination; if the transaction risk prediction model scores the bad sample defined by the rule combination below a preset threshold, the weight value of the feature corresponding to the bad sample is increased, wherein the risk level of the bad sample defined by the rule combination is higher than that of the normal transaction sample.

[0128] According to an embodiment of this application, the risk model incubation engine module is further configured to: filter first risk transaction details that conform to the rule combination at a first time point from the training samples; obtain second risk transaction details that actually occurred at a second time point from the training samples, wherein the second time point is later than the first time point; and obtain the risk identification rate of the rule combination based on the ratio of the number of overlaps between the second risk transaction details and the first risk transaction details to the total number of second risk transaction details.

[0129] According to embodiments of this application, the risk model incubation engine module is further configured to perform statistical analysis on the training samples based on the risk event type, and output at least one of the following: the missing rate, mean, median, or dictionary value distribution of each feature of the training samples; preprocess the features of the training samples, including at least one of normalization, binarization, missing value imputation, or binning method definition; and screen the transaction features of the training samples through information value calculation and / or stepwise regression algorithms.

[0130] According to embodiments of this application, any multiple modules among the transaction data acquisition module 610, transaction risk prediction module 620, and risk model incubation engine module can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the transaction data acquisition module 610, transaction risk prediction module 620, and risk model incubation engine module can be at least partially implemented as hardware circuitry, such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits (ASICs), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the transaction data acquisition module 610, transaction risk prediction module 620, and risk model incubation engine module can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0131] The methods and apparatus of this application significantly lower the modeling threshold through a standardized and automated risk model incubation engine, enabling business experts to build models without coding, thus achieving technology democratization. The system distills the experience of risk control experts into standardized components, unifies modeling specifications, and promotes knowledge sharing. Relying on automated feature engineering and an enterprise-level data foundation, it greatly improves model development efficiency and feature quality, while simultaneously ensuring model interpretability and full lifecycle management, effectively enhancing the efficiency and intelligence level of bank risk management.

[0132] Figure 9 A block diagram schematically illustrates an electronic device suitable for implementing a transaction risk prediction method according to an embodiment of this application.

[0133] like Figure 9 As shown, an electronic device 900 according to an embodiment of this application includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0134] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 902 and / or RAM 903. It should be noted that the programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0135] According to embodiments of this application, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the input / output (I / O) interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0136] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0137] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0138] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the transaction risk prediction method provided in the embodiments of this application.

[0139] When the computer program is executed by the processor 901, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0140] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0141] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0142] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0143] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0144] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A method for predicting transaction risk, characterized in that, include: In response to acquiring transaction data, the transaction features of the transaction data are extracted, and the transaction features indicate information that affects the determination of the degree of transaction risk; The transaction features are input into a pre-trained transaction risk prediction model, and the transaction risk prediction result is output. The transaction risk prediction model is trained in the following way: In response to obtaining the selected risk event type, training samples are determined from the risk feature library according to the mapping relationship between the risk event type and the risk feature type, wherein the risk feature library contains training samples labeled with different risk feature types; Based on the training samples, a rule generation model outputs at least one rule combination, which is used to classify the risk of the training samples based on a regression algorithm. The performance metric for each rule combination is calculated using the training samples, and the performance metric includes at least one of recall, precision, discrimination ability, population stability, and accuracy. If the performance indicators meet the preset indicator requirements, one of the rule combinations is determined as the target rule combination; The transaction risk prediction model is obtained by training the target rule combination and the training samples.

2. The method according to claim 1, characterized in that, The training using the target rule combination and the training samples includes: The target rules are combined and transformed into numerical features based on the training samples; The numerical features and the transaction features of the training samples are fused to obtain fused features; The fusion features are used to train a transaction risk prediction model based on a regression algorithm.

3. The method according to claim 1, characterized in that, The training using the target rule combination and the training samples includes: The training samples are filtered using the target rule combination to remove samples with risk values ​​exceeding a preset range, thereby obtaining core samples; Extract the transaction features of the core samples; A transaction risk prediction model is trained based on a regression algorithm using the transaction characteristics of the core samples.

4. The method according to claim 1, characterized in that, The training using the target rule combination and the training samples includes: The target rule is used to combine the uncovered training samples, which are then input into a pre-trained risk score regression model, and the risk score of each training sample is output. In response to the risk score being greater than a preset threshold, the rule combination is supplemented based on the uncovered training samples.

5. The method according to claim 1, characterized in that, The step of training the transaction risk prediction model based on a regression algorithm according to the target rule combination and the training samples includes: Conflict detection is performed between the output of the transaction risk prediction model and the rule combination; If the transaction risk prediction model scores the bad sample defined by the rule combination below a preset threshold, the weight value of the feature corresponding to the bad sample is increased, wherein the risk level of the bad sample defined by the rule combination is higher than that of the normal transaction sample.

6. The method according to claim 1, characterized in that, The calculation of the performance metric for each rule combination using the training samples includes: From the training samples, select the first risk transaction details that meet the rule combination at the first time point; Obtain details of second-risk transactions that actually occurred at a second time point in the training sample, wherein the second time point is later than the first time point; The risk identification rate of the rule combination is obtained by the ratio of the number of overlaps between the second risk transaction details and the first risk transaction details to the total number of the second risk transaction details.

7. The method according to claim 1, characterized in that, The training methods for the transaction risk prediction model include: Based on the risk event type, perform statistical analysis on the training samples and output at least one of the following: missing rate, mean, median, or dictionary value distribution for each feature of the training samples; The features of the training samples are preprocessed, including at least one of normalization, binarization, missing value imputation, or binning method definition; and The transaction characteristics of the training samples are screened by information value calculation and / or stepwise regression algorithm.

8. A method for training a transaction risk prediction model, characterized in that, include: In response to obtaining the selected risk event type, training samples are determined from the risk feature library according to the mapping relationship between the risk event type and the risk feature type, wherein the risk feature library contains training samples labeled with different risk feature types; Based on the training samples, a rule generation model outputs at least one rule combination, which is used to classify the risk of the training samples based on a regression algorithm. The performance metric for each rule combination is calculated using the training samples, and the performance metric includes at least one of recall, precision, discrimination ability, population stability, and accuracy. If the performance indicators meet the preset indicator requirements, one of the rule combinations is determined as the target rule combination; The transaction risk prediction model is obtained by training the target rule combination and the training samples.

9. A transaction risk prediction device, characterized in that, The device includes: The transaction data acquisition module is configured to, in response to acquiring transaction data, extract transaction features from the transaction data, wherein the transaction features indicate information affecting the determination of the degree of transaction risk; and The transaction risk prediction module is used to input the transaction features into a pre-trained transaction risk prediction model and output the transaction risk prediction result. The transaction risk prediction model is trained in the following way: In response to obtaining the selected risk event type, training samples are determined from the risk feature library according to the mapping relationship between the risk event type and the risk feature type, wherein the risk feature library contains training samples labeled with different risk feature types; Based on the training samples, a rule generation model outputs at least one rule combination, which is used to classify the risk of the training samples based on a regression algorithm. The performance metric for each rule combination is calculated using the training samples, and the performance metric includes at least one of recall, precision, discrimination ability, population stability, and accuracy. If the performance indicators meet the preset indicator requirements, one of the rule combinations is determined as the target rule combination; The transaction risk prediction model is obtained by training the target rule combination and the training samples.

10. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

Images