Financial risk control model self-updating method and device, storage medium and terminal

Abstract

The invention discloses a self-updating method and device of a financial risk control model, a storage medium and a terminal, relates to the technical field of data processing, can be applied to the field of financial risk control, and mainly aims at solving the problem that the model recognition accuracy is low due to the fact that an existing financial risk control model is not timely updated. The method mainly comprises the following steps: acquiring anomaly prediction scores and confidence coefficients of different newly-added samples obtained in a process of performing anomaly identification on newly-added sample data in a production environment by a financial risk control model; extracting a low-confidence sample from the newly added samples according to the abnormal prediction score and the confidence; performing clustering processing on the low-confidence samples, and constructing an updated training sample set according to target samples extracted from each cluster; and performing incremental learning update training on the financial risk control model based on the training sample set, so as to continue to execute anomaly recognition of subsequent sample data based on the financial risk control model completing update training. The method is mainly used for updating the financial risk control model so as to improve the timeliness of model updating.

Description

Technical Field

[0001] This invention relates to the field of data processing technology and can be applied to the field of financial risk control. In particular, it relates to a self-updating method and apparatus, storage medium, and terminal for a financial risk control model. Background Technology

[0002] In the financial sector, risk control models are crucial tools for preventing financial risks and ensuring financial security. With the continuous development of financial services and the emergence of financial innovations, financial risks are becoming increasingly diversified and complex. To address this challenge, financial risk control models need continuous updating and optimization to improve the accuracy and efficiency of risk detection.

[0003] Currently, self-updating methods for financial risk control models primarily rely on periodic or ad-hoc model retraining. These methods typically update model parameters and structure by retraining the model based on historical data and new data samples, thereby adapting to new risk types and changes. However, existing anomaly detection schemes based on isolated forests and prediction bias suffer from model updates that lag far behind changes in risk. The models cannot quickly respond to new risk challenges, resulting in low accuracy in identifying financial anomalies. Summary of the Invention

[0004] In view of this, the present invention provides a self-updating method, apparatus, storage medium, and terminal for a financial risk control model. The main purpose is to solve the problem of untimely model updates in existing financial risk control models, which leads to low detection accuracy.

[0005] According to one aspect of the present invention, a self-updating method for a financial risk control model is provided, comprising: The anomaly prediction scores and confidence levels of different new samples are obtained during the process of anomaly identification of new sample data in the production environment by the financial risk control model. Based on the anomaly prediction score and confidence level, low-confidence samples are extracted from the newly added samples; The low-confidence samples are clustered, and the training sample set is updated based on the target samples extracted from each cluster. The financial risk control model is incrementally learned and updated based on the training sample set, so as to continue to perform anomaly identification on subsequent sample data based on the financial risk control model that has completed the updated training.

[0006] Further, the low-confidence samples include samples with low prediction score confidence and / or samples with low self-confidence. Extracting low-confidence samples from the new samples based on the abnormal prediction score and confidence level includes: New samples whose difference between the anomaly prediction score and the model anomaly classification threshold is less than a preset difference threshold are identified as samples with low prediction score confidence. New samples with a confidence level lower than a preset confidence threshold are identified as samples with low confidence levels.

[0007] Further, the low-confidence samples include samples with low prediction score confidence. The step of clustering the low-confidence samples and constructing an updated training sample set based on the target samples extracted from the clusters includes: Samples with low prediction score confidence are clustered to obtain multiple clusters, and the first target sample is extracted from each of the clusters according to a preset extraction number. For multiple first target samples in each cluster, all first target samples under the cluster are labeled with the tag of any one of the first target samples to obtain the first updated training sample set; The low-confidence samples include samples with low self-confidence. The step of clustering the low-confidence samples and constructing an updated training sample set based on the target samples extracted from the clusters includes: Samples with low self-confidence are clustered to obtain multiple clusters, and second target samples are extracted from each cluster according to a preset extraction number. For each cluster of multiple second target samples, all second target samples under the cluster are labeled with the tag of any one of the second target samples to obtain the second updated training sample set.

[0008] Furthermore, before the financial risk control model performs anomaly identification on newly added sample data in the production environment, the method also includes: Construct a score prediction sub-model and a confidence sub-model, and obtain historical training sample sets for score prediction and confidence. The score prediction sub-model is trained based on the historical training sample set of score prediction to obtain the score prediction sub-model that has completed the initial training, and the confidence sub-model is trained based on the historical training sample set of confidence to obtain the confidence sub-model that has completed the initial training. A financial risk control model is constructed based on the score prediction sub-model and the confidence sub-model that have completed initial training, and the financial risk control model is deployed to the production environment to identify anomalies in newly added sample data in the production environment.

[0009] Furthermore, the training sample set includes a first updated training sample set and a second updated training sample set, and the incremental learning and updating training of the financial risk control model based on the training sample set includes: The score prediction sub-model that has completed the initial training is trained using incremental learning based on the first updated training sample set. The confidence sub-model that has completed the initial training is trained using incremental learning based on the second updated training sample set; The updated financial risk control model is constructed based on the updated score prediction sub-model and the updated confidence sub-model.

[0010] Furthermore, the training sample set includes a first updated training sample set or a second updated training sample set; Incremental learning and updating training of the financial risk control model based on the first updated training sample set includes: The score prediction sub-model that has completed initial training is trained using incremental learning based on the first updated training sample set. The financial risk control model that has completed updated training is then constructed based on the score prediction sub-model that has completed updated training and the confidence sub-model that has completed initial training. Incremental learning and updating training of the financial risk control model based on the second updated training sample set includes: The confidence sub-model that has completed initial training is trained using incremental learning based on the second updated training sample set. The financial risk control model that has completed updated training is then constructed based on the updated confidence sub-model and the initial score prediction sub-model.

[0011] Furthermore, the financial risk control model includes an XGBoost sub-model and a convolutional neural network sub-model. The process by which the financial risk control model identifies anomalies in newly added sample data in the production environment includes: For each new sample, the nodes in the pre-constructed financial risk knowledge graph are updated based on the sample data to obtain the updated financial risk knowledge graph. The updated financial risk knowledge graph is subjected to predictive processing to obtain statistical features of transaction behavior and topological features of transaction data; The XGBoost sub-model is used to predict the statistical features of the transaction behavior and the topological features of the transaction data to obtain anomaly prediction scores for different newly added samples. The updated financial risk knowledge graph is predicted using the convolutional neural network sub-model to obtain the confidence level of different newly added samples. Anomaly identification results for the new samples are generated based on the fusion result of the anomaly prediction score and the confidence level.

[0012] According to another aspect of the present invention, a self-updating device for a financial risk control model is provided, comprising: The acquisition module is used to acquire the anomaly prediction scores and confidence levels of different new samples obtained by the financial risk control model during the anomaly identification process of new sample data in the production environment. The extraction module is used to extract low-confidence samples from the new samples based on the anomaly prediction score and confidence level. The clustering processing module is used to cluster the low-confidence samples and construct and update the training sample set based on the target samples extracted from each cluster. The update training module is used to perform incremental learning and update training on the financial risk control model based on the training sample set, so as to continue to perform anomaly identification on subsequent sample data based on the financial risk control model that has completed the updated training.

[0013] Furthermore, the extraction module includes: The first determining unit is used to determine new samples whose difference between the anomaly prediction score and the model anomaly classification threshold is less than a preset difference threshold as samples with low prediction score confidence. The second determining module is used to determine new samples whose confidence level is less than a preset confidence threshold as samples with low confidence level.

[0014] Furthermore, the clustering processing module includes: The first clustering unit is used to cluster samples with low prediction score confidence to obtain multiple clusters, and to extract the first target sample from each cluster according to a preset extraction quantity. The first labeling unit is used to label all first target samples under the cluster with the label of any one of the first target samples in each cluster, so as to obtain the first updated training sample set. The second clustering unit is used to cluster samples with low confidence levels to obtain multiple clusters, and to extract the second target sample from each cluster according to a preset extraction quantity. The second labeling unit is used to label all second target samples under the cluster with the label of any one of the second target samples in each cluster, so as to obtain the second updated training sample set.

[0015] Furthermore, the device also includes: The first construction module is used to build the score prediction sub-model and the confidence sub-model, and to obtain the historical training sample set of score prediction and the historical training sample set of confidence. The training module is used to train the score prediction sub-model based on the historical training sample set of score prediction to obtain the score prediction sub-model that has completed the initial training, and to train the confidence sub-model based on the historical training sample set of confidence to obtain the confidence sub-model that has completed the initial training. The second construction module is used to construct a financial risk control model based on the score prediction sub-model and the confidence sub-model that have completed initial training, and to deploy the financial risk control model to the production environment to identify anomalies in newly added sample data in the production environment.

[0016] Furthermore, the updated training module includes: The first update training unit is used to train the score prediction sub-model that has completed the initial training in an incremental learning manner based on the first update training sample set. The second update training unit is used to train the confidence sub-model that has completed the initial training in an incremental learning manner based on the second update training sample set. The building unit is used to construct the updated financial risk control model based on the updated score prediction sub-model and the updated confidence sub-model.

[0017] Furthermore, the updated training module also includes: The third update training unit is used to train the score prediction sub-model that has completed the initial training in an incremental learning manner based on the first update training sample set, and to construct the financial risk control model that has completed the update training based on the score prediction sub-model that has completed the update training and the confidence sub-model that has completed the initial training. The fourth update training unit is used to train the confidence sub-model that has completed the initial training in an incremental learning manner based on the second update training sample set, and to construct the financial risk control model that has completed the update training based on the confidence sub-model that has completed the update training and the score prediction sub-model that has completed the initial training.

[0018] Furthermore, the acquisition module includes: The graph update unit is used to update the nodes in the pre-built financial risk knowledge graph based on the sample data for each new sample, so as to obtain the updated financial risk knowledge graph. The graph feature extraction unit is used to perform predictive processing on the updated financial risk knowledge graph to obtain transaction behavior statistical features and transaction data topological features. The first prediction processing unit is used to perform prediction processing on the transaction behavior statistical features and the transaction data topology features through the XGBoost sub-model to obtain the anomaly prediction scores of different newly added samples. The second prediction processing unit is used to perform prediction processing on the updated financial risk knowledge graph through the convolutional neural network sub-model to obtain the confidence level of different newly added samples. The fusion unit is used to generate anomaly identification results for the new samples based on the fusion result of the anomaly prediction score and the confidence level.

[0019] According to another aspect of the present invention, a storage medium is provided, wherein at least one executable instruction is stored therein, the executable instruction causing a processor to perform an operation corresponding to the self-updating method of the above-described financial risk control model.

[0020] According to another aspect of the present invention, a terminal is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the self-updating method of the above-mentioned financial risk control model.

[0021] By employing the above-described technical solutions, the technical solutions provided by the embodiments of the present invention have at least the following advantages: This invention provides a self-updating method, apparatus, storage medium, and terminal for a financial risk control model. In this embodiment, the invention acquires the anomaly prediction scores and confidence levels of different newly added samples obtained during the anomaly identification process of the financial risk control model on newly added sample data in a production environment. Based on the anomaly prediction scores and confidence levels, low-confidence samples are extracted from the newly added samples. These low-confidence samples are clustered, and an updated training sample set is constructed based on target samples extracted from each cluster. The financial risk control model is then incrementally trained and updated using the training sample set, allowing it to continue anomaly identification of subsequent sample data. By dynamically extracting low-confidence samples and clustering them to generate an incremental training sample set, the financial risk control model achieves adaptive updates, significantly improving the model's accuracy and reliability in identifying new risk patterns, while reducing the false positive rate and ensuring the model's continued effectiveness in dynamic financial environments. The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the specification. Furthermore, in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0022] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 The flowchart illustrates a self-updating method for a financial risk control model provided by an embodiment of the present invention. Figure 2 A flowchart of another self-updating method for a financial risk control model provided by an embodiment of the present invention is shown; Figure 3 This diagram illustrates a block diagram of a self-updating device for a financial risk control model provided in an embodiment of the present invention. Figure 4 A schematic diagram of the structure of a terminal provided in an embodiment of the present invention is shown. Detailed Implementation

[0023] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0024] To address the issue of untimely model updates in existing financial risk control models, leading to low detection accuracy, this invention provides a self-updating method for financial risk control models, such as... Figure 1 As shown, the method includes: 101. Obtain the anomaly prediction scores and confidence levels of different new samples obtained by the financial risk control model during the anomaly identification process of new sample data in the production environment.

[0025] In this embodiment of the invention, during the real-time operation of the financial transaction system, the financial risk control model deployed in the production environment continuously receives new sample data, such as transaction orders and account behavior logs. Anomaly identification is performed based on this new sample data. During the anomaly identification process, anomaly prediction scores and confidence levels for different new samples are generated as the basis for anomaly identification. The financial risk control model can have a dual-model structure, comprising two models trained on training samples with different labels. One model is trained on samples labeled with prediction scores to predict the anomaly prediction scores of new samples, and the other model is trained on samples labeled with sample confidence levels to preset the confidence level of new samples. The base models for the two models can be the same or different models; this embodiment of the invention does not impose specific limitations.

[0026] It's important to note that financial risk control models can be applied to various specific business scenarios within financial risk control, including fraud detection, cash-out detection, anti-money laundering management, and credit assessment. In fraud detection, the model can detect fraudulent transactions, such as fictitious transactions, account theft, and credit card fraud. In cash-out detection, the model can detect cash-out transactions, such as the transfer of funds between multiple accounts to convert illicit funds into legitimate funds. In anti-money laundering management, the model can assist banks and financial institutions in monitoring account fund flows and transaction behavior, promptly identifying anomalies and implementing risk control measures. In credit assessment, the model can support banks and financial institutions in evaluating customer creditworthiness, such as detecting anomalies in a customer's income and balance sheet.

[0027] 102. Based on the anomaly prediction score and confidence level, extract low-confidence samples from the newly added samples.

[0028] In this embodiment of the invention, low-confidence samples can be newly added samples with low confidence in anomaly prediction scores, or newly added samples with low confidence in model output. For example, a dynamic threshold rule (e.g., confidence < 0.7 and prediction score > 0.6) can be set to filter low-confidence samples from real-time newly added sample data. Low-confidence samples represent discrepancies in the model's anomaly judgment of the current sample (e.g., high prediction score but low confidence), and may contain novel attack patterns or samples outside the data distribution. By focusing on samples with high model uncertainty, and avoiding directly using high-confidence samples to update the model, noise data interference is prevented, thereby improving the quality of incremental learning data and reducing manual annotation costs.

[0029] 103. Cluster the low-confidence samples and construct an updated training sample set based on the target samples extracted from each cluster.

[0030] In this embodiment of the invention, unsupervised clustering is used to group low-confidence samples, dividing them into clusters based on feature similarity. Clustering can employ algorithms such as DBSCAN and graph neural networks. For example, when new sample data contains structured features such as transaction amounts and time intervals, DBSCAN clustering can be used for grouping. For sample data requiring integration with account association graphs, such as fund flow patterns, graph neural networks can be used for graph extension clustering. This embodiment of the invention does not impose specific limitations. After clustering, multiple clusters are obtained, with high business similarity among low-confidence samples within each cluster. Representative samples (such as cluster center samples or boundary samples) are extracted from each cluster to construct an updated training sample set for incremental learning, covering potential unknown risk patterns. By clustering samples, the workload of sampling low-confidence samples can be reduced, sample deduplication and pattern summarization can be achieved, thereby improving the diversity of training data and avoiding model overfitting to local noise.

[0031] 104. Based on the training sample set, the financial risk control model is incrementally learned and updated, so as to continue to perform anomaly identification of subsequent sample data based on the financial risk control model that has completed the updated training.

[0032] In this embodiment of the invention, an online learning framework is used to incrementally update the financial risk control model. Incremental learning is employed during the model update process, enabling the model to retain its memory of historical samples while effectively controlling for new samples. After updating, the model is redeployed to the production environment, forming a closed-loop iteration of "detection-feedback-optimization," thus completing the self-updating of the financial risk control model. This achieves dynamic adaptation of the model to abnormally diverse samples, maintaining risk identification accuracy while reducing false positive rates, thereby extending the model's lifespan.

[0033] In one specific instance, a bank's anti-money laundering system encountered a new sample: a cross-border transfer transaction. The financial risk control model output an anomaly prediction score of 0.88 but a confidence level of 0.45, classifying it as a low-confidence sample. Cluster analysis revealed that this sample was associated with a historical cluster of "shell company fund transfers," from which three core samples were extracted and added to the training set. After incremental learning, the model's recall rate for identifying similar abnormal cross-border transactions improved by 22%, while simultaneously reducing manual review by 40%.

[0034] In one embodiment of the present invention, for further illustration and limitation, such as Figure 2 As shown, the low-confidence samples in the step include samples with low prediction score confidence and / or samples with low confidence themselves. Extracting low-confidence samples from the newly added samples based on the abnormal prediction score and confidence includes: 201. New samples whose difference between the anomaly prediction score and the model anomaly classification threshold is less than a preset difference threshold are identified as samples with low prediction score confidence.

[0035] 202. New samples with confidence levels lower than the preset confidence threshold are identified as samples with low confidence levels.

[0036] In this embodiment of the invention, low-confidence samples are screened from two dimensions: the confidence level of the anomaly prediction score and the confidence level of the sample itself. From the dimension of the anomaly prediction score, the absolute difference between the anomaly prediction score and the model's preset anomaly classification threshold is calculated. When the difference is less than the preset difference threshold, the sample is determined to be a sample with low confidence in the prediction score. For example, a sample with an anomaly prediction score of 0.58 is marked as a low-confidence sample because |0.58-0.5|=0.08<0.1, indicating uncertainty in the model's anomaly judgment of the newly added sample. From the dimension of the sample's own confidence level, new samples with confidence scores lower than a preset confidence threshold are directly screened. For example, a sample with a confidence level of 0.65 is determined to be a sample with insufficient model prediction reliability because it is lower than the preset confidence threshold. Such samples may contain unknown risk patterns or data noise, requiring further verification; therefore, the new samples are marked as low-confidence samples. The preset difference threshold and the preset reliability threshold can be adjusted in real time according to business risk preferences or model performance monitoring. The initial value of the threshold can be customized according to business scenario requirements. This embodiment of the invention does not impose specific limitations.

[0037] It should be noted that extracting low-confidence samples through the confidence dimension of anomaly prediction scores can improve boundary case coverage, capture ambiguous samples at the model's decision boundary, and enhance sensitivity to new risk patterns. Filtering low-quality predictions based on the confidence dimension of the samples themselves, according to a confidence threshold, can capture unknown risk samples and new variations of anomalous operations, thereby improving the model's robustness.

[0038] In one embodiment of the invention, for further explanation and limitation, the low-confidence samples include samples with low prediction score confidence. The step of clustering the low-confidence samples and constructing an updated training sample set based on target samples extracted from the clusters includes: Samples with low prediction score confidence are clustered to obtain multiple clusters, and the first target sample is extracted from each of the clusters according to a preset extraction number. For multiple first target samples in each cluster, all first target samples under the cluster are labeled with the tag of any one of the first target samples to obtain the first updated training sample set; The low-confidence samples include samples with low self-confidence. The step of clustering the low-confidence samples and constructing an updated training sample set based on the target samples extracted from the clusters includes: Samples with low self-confidence are clustered to obtain multiple clusters, and second target samples are extracted from each cluster according to a preset extraction number. For each cluster of multiple second target samples, all second target samples under the cluster are labeled with the tag of any one of the second target samples to obtain the second updated training sample set.

[0039] In this embodiment of the invention, the low-confidence samples include two types: samples with low self-confidence and samples with low prediction score confidence. During the clustering process for low-confidence samples, clustering, sample extraction, and sample labeling are performed separately for different types of samples to obtain training samples for training the corresponding sub-models, namely the first updated training sample set and the second updated training sample set.

[0040] Clustering and sample set construction for samples with low prediction score confidence. Clustering algorithms (such as DBSCAN or K-Means) are used to divide the samples into multiple clusters based on sample features (such as transaction amount, time interval, account correlation, etc.). This groups low-confidence samples with similar features to facilitate the extraction of representative samples from each group. Then, first target samples are extracted from each cluster according to a preset extraction number (e.g., 10 samples per cluster). The extraction strategy can be based on the dispersion of samples within a cluster (e.g., the sample closest to the cluster center) or random sampling to ensure sample diversity. For multiple first target samples in each cluster, all first target samples in that cluster are labeled with the tag of any one of the first target samples (e.g., a manual review result or a historical model output tag). For example, if any sample in a cluster is labeled "fraud," then all first target samples in that cluster are labeled "fraud."

[0041] Clustering and sample set construction are performed for samples with low self-confidence. The clustering method is consistent with the handling of samples with low prediction score confidence, dividing the samples into multiple clusters based on sample characteristics. These samples, due to insufficient model prediction reliability, require clustering to uncover potential risk patterns. Then, a second target sample is extracted from each cluster according to a preset extraction number. The extraction strategy can be consistent with the first target sample to ensure a balanced sample distribution. For multiple second target samples in each cluster, all second target samples in that cluster are labeled with the tag of any one of the second target samples. For example, if any sample in a cluster is labeled "normal," then all second target samples in that cluster are labeled "normal." Samples with low confidence may be misjudged due to insufficient model recognition of risk patterns, and the similarity of samples within clusters can help correct the labels.

[0042] In one embodiment of the present invention, for further explanation and limitation, before the financial risk control model performs anomaly identification on newly added sample data in the production environment, the method further includes: Construct a score prediction sub-model and a confidence sub-model, and obtain historical training sample sets for score prediction and confidence. The score prediction sub-model is trained based on the historical training sample set of score prediction to obtain the score prediction sub-model that has completed the initial training, and the confidence sub-model is trained based on the historical training sample set of confidence to obtain the confidence sub-model that has completed the initial training. A financial risk control model is constructed based on the score prediction sub-model and the confidence sub-model that have completed initial training, and the financial risk control model is deployed to the production environment to identify anomalies in newly added sample data in the production environment.

[0043] In this embodiment of the invention, the financial risk control model includes a score prediction sub-model and a confidence sub-model. The score prediction sub-model outputs anomaly prediction scores, and the confidence sub-model outputs sample confidence levels. The score prediction sub-model can be constructed using machine learning algorithms (such as XGBoost, LightGBM, or deep neural networks) to quantify the degree of anomalous risk of samples based on structured features (such as transaction amount, time interval, account historical behavior labels, etc.) and output anomaly prediction scores. The confidence sub-model can be constructed based on graph neural networks (GNN), Transformers, or Bayesian neural networks to output sample confidence levels. The historical training sample set for score prediction contains structured samples labeled with anomaly / normal tags, with tags sourced from manual review results or historical risk control rule matching results. Sample features must cover known risk patterns (such as fraudulent transactions, money laundering chains). During model training, positive and negative sample labels are trained according to a predefined business approach, with all confidence labels set to 1. Subsequently, the model adds the opposite labels, setting the sample confidence level to 0, thus completing the construction of two batches of samples used for model training. By constructing a confidence sample set through a dual-label reinforcement strategy and combining it with joint training of high-confidence samples and adversarial samples, the ability of the confidence sub-model to identify uncertainty is significantly improved. This method ensures the model's accurate learning of known risk patterns while supporting adaptive optimization of the model for novel risks through a dynamically expanded sample set, providing an efficient and reliable solution for financial risk control scenarios.

[0044] In one embodiment of the present invention, for further explanation and limitation, the incremental learning and updating training of the financial risk control model based on the training sample set includes: The score prediction sub-model that has completed the initial training is trained using incremental learning based on the first updated training sample set. The confidence sub-model that has completed the initial training is trained using incremental learning based on the second updated training sample set; The updated financial risk control model is constructed based on the updated score prediction sub-model and the updated confidence sub-model.

[0045] In this embodiment of the invention, the training sample set includes both a first updated training sample set and a second updated training sample set. That is, low-confidence samples include both samples with low self-confidence and samples with low predicted score confidence. This indicates that both sub-models need to be trained. Therefore, incremental learning training is performed on the score prediction sub-model that has completed initial training based on the first updated training sample set, and incremental learning training is performed on the confidence sub-model that has completed initial training based on the second updated training sample set. Specifically, the model can be retrained multiple times based on the autorefit link to achieve the training objective. Taking the incremental learning update training process of XGBoost as an example, the update training process is explained below. During the update training of the score prediction sub-model based on the first updated training sample set, the entire model is not retrained. Instead, based on the score prediction sub-model that has completed initial training, the subsequent decision tree is trained using the first updated training sample set to capture patterns or changes in new data samples. During the training process, the knowledge gained from training on the historical data samples is retained, and the subsequent decision tree is trained to adapt to the new data samples, thereby balancing old and new knowledge and preventing the model from forgetting historical information. During incremental learning, the computer saves the current model at any time and loads the previously saved model to continue training when needed, so as to achieve continuous updating and improvement of the model.

[0046] In one embodiment of the present invention, for further explanation and limitation, the training sample set includes a first updated training sample set or a second updated training sample set; Incremental learning and updating training of the financial risk control model based on the first updated training sample set includes: The score prediction sub-model that has completed initial training is trained using incremental learning based on the first updated training sample set. The financial risk control model that has completed updated training is then constructed based on the score prediction sub-model that has completed updated training and the confidence sub-model that has completed initial training. Incremental learning and updating training of the financial risk control model based on the second updated training sample set includes: The confidence sub-model that has completed initial training is trained using incremental learning based on the second updated training sample set. The financial risk control model that has completed updated training is then constructed based on the updated confidence sub-model and the initial score prediction sub-model.

[0047] In this embodiment of the invention, the training sample set includes only one of the first updated training sample set and the second updated training sample set. That is, low-confidence samples include samples with low self-confidence or samples with low predicted score confidence. This indicates that the two sub-models do not need to be trained simultaneously; the sub-model corresponding to the sample containing the low-confidence samples is trained. For example, if the low-confidence samples include samples with low self-confidence, only the confidence sub-model that has completed initial training is updated and trained, while the score prediction sub-model that has completed initial training is not updated and trained, thereby achieving accurate model training.

[0048] In one embodiment of the present invention, for further explanation and limitation, the financial risk control model includes an XGBoost sub-model and a convolutional neural network sub-model. The process of the financial risk control model identifying anomalies in newly added sample data in the production environment includes: For each new sample, the nodes in the pre-constructed financial risk knowledge graph are updated based on the sample data to obtain the updated financial risk knowledge graph. The updated financial risk knowledge graph is subjected to predictive processing to obtain statistical features of transaction behavior and topological features of transaction data; The XGBoost sub-model is used to predict the statistical features of the transaction behavior and the topological features of the transaction data to obtain anomaly prediction scores for different newly added samples. The updated financial risk knowledge graph is predicted using the convolutional neural network sub-model to obtain the confidence level of different newly added samples. Anomaly identification results for the new samples are generated based on the fusion result of the anomaly prediction score and the confidence level.

[0049] In this embodiment of the invention, during the anomaly identification process of the financial risk control model, for each new sample in the production environment (such as transaction orders or account behavior data), its feature information is first dynamically integrated into a pre-constructed financial risk knowledge graph, updating node attributes (such as account transaction frequency, related party risk level) or topological structure (such as new fund flow paths), forming a knowledge graph containing the latest risk signals. Subsequently, two types of features are extracted through graph analysis: one is statistical features of transaction behavior based on statistical calculations (such as the mean of transaction amount and the variance of time intervals), reflecting the sample's conventional risk pattern; the other is topological features of transaction data based on graph structure mining (such as the clustering coefficient of accounts and the centrality of fund flow paths), revealing the abnormal diffusion risk of the sample in the related network. The two types of features are input into the XGBoost sub-model for prediction, outputting an anomaly prediction score (0-1 quantifying the degree of risk). At the same time, the convolutional neural network sub-model (CNN) directly performs convolution and pooling operations on the updated knowledge graph, and outputs a confidence score (0-1 assessing the reliability of the prediction) by capturing local graph structure patterns (such as dense transaction loops and abnormal node connections). Ultimately, the system integrates anomaly prediction scores and confidence scores (such as weighted summation or threshold filtering) to generate comprehensive anomaly identification results. This ensures accurate identification of known risk patterns while avoiding misjudgments of ambiguous samples through confidence assessment, thus enabling adaptive decision-making in dynamic risk environments.

[0050] This invention provides a self-updating method for a financial risk control model. In this embodiment, the method acquires the anomaly prediction scores and confidence levels of different newly added samples obtained during the anomaly identification process of the financial risk control model on newly added sample data in a production environment. Based on these anomaly prediction scores and confidence levels, low-confidence samples are extracted from the newly added samples. These low-confidence samples are then clustered, and an updated training sample set is constructed based on target samples extracted from each cluster. The financial risk control model is then incrementally updated and trained based on this training sample set, allowing it to continue anomaly identification of subsequent sample data. By dynamically extracting low-confidence samples and clustering them to generate an incremental training sample set, the financial risk control model achieves adaptive updates, significantly improving the model's accuracy and reliability in identifying new risk patterns, while reducing the false positive rate and ensuring the model's continued effectiveness in dynamic financial environments.

[0051] Furthermore, as a response to the above Figure 1 The implementation of the method shown in this embodiment of the invention provides a self-updating device for a financial risk control model, such as... Figure 3 As shown, the device includes: The acquisition module 31 is used to acquire the anomaly prediction scores and confidence levels of different new samples obtained by the financial risk control model during the anomaly identification process of new sample data in the production environment. Extraction module 32 is used to extract low-confidence samples from the new samples based on the anomaly prediction score and confidence level; Clustering processing module 33 is used to perform clustering processing on the low confidence samples and construct and update the training sample set based on the target samples extracted from each cluster. The training update module 34 is used to perform incremental learning and update training on the financial risk control model based on the training sample set, so as to continue to perform anomaly identification of subsequent sample data based on the financial risk control model that has completed the updated training.

[0052] Furthermore, the extraction module includes: The first determining unit is used to determine new samples whose difference between the anomaly prediction score and the model anomaly classification threshold is less than a preset difference threshold as samples with low prediction score confidence. The second determining module is used to determine new samples whose confidence level is less than a preset confidence threshold as samples with low confidence level.

[0053] Furthermore, the clustering processing module includes: The first clustering unit is used to cluster samples with low prediction score confidence to obtain multiple clusters, and to extract the first target sample from each cluster according to a preset extraction quantity. The first labeling unit is used to label all first target samples under the cluster with the label of any one of the first target samples in each cluster, so as to obtain the first updated training sample set. The second clustering unit is used to cluster samples with low confidence levels to obtain multiple clusters, and to extract the second target sample from each cluster according to a preset extraction quantity. The second labeling unit is used to label all second target samples under the cluster with the label of any one of the second target samples in each cluster, so as to obtain the second updated training sample set.

[0054] Furthermore, the device also includes: The first construction module is used to build the score prediction sub-model and the confidence sub-model, and to obtain the historical training sample set of score prediction and the historical training sample set of confidence. The training module is used to train the score prediction sub-model based on the historical training sample set of score prediction to obtain the score prediction sub-model that has completed the initial training, and to train the confidence sub-model based on the historical training sample set of confidence to obtain the confidence sub-model that has completed the initial training. The second construction module is used to construct a financial risk control model based on the score prediction sub-model and the confidence sub-model that have completed initial training, and to deploy the financial risk control model to the production environment to identify anomalies in newly added sample data in the production environment.

[0055] Furthermore, the updated training module includes: The first update training unit is used to train the score prediction sub-model that has completed the initial training in an incremental learning manner based on the first update training sample set. The second update training unit is used to train the confidence sub-model that has completed the initial training in an incremental learning manner based on the second update training sample set. The building unit is used to construct the updated financial risk control model based on the updated score prediction sub-model and the updated confidence sub-model.

[0056] Furthermore, the updated training module also includes: The third update training unit is used to train the score prediction sub-model that has completed the initial training in an incremental learning manner based on the first update training sample set, and to construct the financial risk control model that has completed the update training based on the score prediction sub-model that has completed the update training and the confidence sub-model that has completed the initial training. The fourth update training unit is used to train the confidence sub-model that has completed the initial training in an incremental learning manner based on the second update training sample set, and to construct the financial risk control model that has completed the update training based on the confidence sub-model that has completed the update training and the score prediction sub-model that has completed the initial training.

[0057] Furthermore, the acquisition module includes: The graph update unit is used to update the nodes in the pre-built financial risk knowledge graph based on the sample data for each new sample, so as to obtain the updated financial risk knowledge graph. The graph feature extraction unit is used to perform predictive processing on the updated financial risk knowledge graph to obtain transaction behavior statistical features and transaction data topological features. The first prediction processing unit is used to perform prediction processing on the transaction behavior statistical features and the transaction data topology features through the XGBoost sub-model to obtain the anomaly prediction scores of different newly added samples. The second prediction processing unit is used to perform prediction processing on the updated financial risk knowledge graph through the convolutional neural network sub-model to obtain the confidence level of different newly added samples. The fusion unit is used to generate anomaly identification results for the new samples based on the fusion result of the anomaly prediction score and the confidence level.

[0058] This invention provides a self-updating device for a financial risk control model. In this embodiment, the invention acquires the anomaly prediction scores and confidence levels of different newly added samples obtained during the anomaly identification process of the financial risk control model on newly added sample data in a production environment. Based on the anomaly prediction scores and confidence levels, low-confidence samples are extracted from the newly added samples. These low-confidence samples are then clustered, and an updated training sample set is constructed based on target samples extracted from each cluster. The financial risk control model is then incrementally updated and trained based on this training sample set, allowing the updated model to continue anomaly identification of subsequent sample data. By dynamically extracting low-confidence samples and clustering them to generate an incremental training sample set, the financial risk control model achieves adaptive updates, significantly improving the model's accuracy and reliability in identifying new risk patterns, while reducing the false positive rate and ensuring the model's continued effectiveness in dynamic financial environments.

[0059] According to one embodiment of the present invention, a storage medium is provided, the storage medium storing at least one executable instruction, which is capable of executing the self-updating method of the financial risk control model in any of the above method embodiments.

[0060] Figure 4 The diagram shows a structural schematic of a terminal according to an embodiment of the present invention. The specific implementation of the present invention does not limit the specific implementation of the terminal.

[0061] like Figure 4 As shown, the terminal may include: a processor 402, a communications interface 404, a memory 406, and a communications bus 408.

[0062] The processor 402, communication interface 404, and memory 406 communicate with each other via communication bus 408.

[0063] Communication interface 404 is used for network communication with other devices such as clients or other servers.

[0064] The processor 402 is used to execute program 410, specifically to execute the relevant steps in the above-described self-updating method embodiment of the financial risk control model.

[0065] Specifically, program 410 may include program code that includes computer operation instructions.

[0066] Processor 402 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The terminal may include one or more processors of the same type, such as one or more CPUs; or it may include processors of different types, such as one or more CPUs and one or more ASICs.

[0067] Memory 406 is used to store program 410. Memory 406 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0068] Specifically, program 410 can be used to cause processor 402 to perform the following operations: The anomaly prediction scores and confidence levels of different new samples are obtained during the process of anomaly identification of new sample data in the production environment by the financial risk control model. Based on the anomaly prediction score and confidence level, low-confidence samples are extracted from the newly added samples; The low-confidence samples are clustered, and the training sample set is updated based on the target samples extracted from each cluster. The financial risk control model is incrementally learned and updated based on the training sample set, so as to continue to perform anomaly identification on subsequent sample data based on the financial risk control model that has completed the updated training.

[0069] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0070] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A self-updating method for a financial risk control model, characterized in that, include: The anomaly prediction scores and confidence levels of different new samples are obtained during the process of anomaly identification of new sample data in the production environment by the financial risk control model. Based on the anomaly prediction score and confidence level, low-confidence samples are extracted from the newly added samples; The low-confidence samples are clustered, and the training sample set is updated based on the target samples extracted from each cluster. The financial risk control model is incrementally learned and updated based on the training sample set, so as to continue to perform anomaly identification on subsequent sample data based on the financial risk control model that has completed the updated training.

2. The method according to claim 1, characterized in that, The low-confidence samples include samples with low prediction score confidence and / or samples with low self-confidence. Extracting low-confidence samples from the new samples based on the abnormal prediction scores and confidence levels includes: New samples whose difference between the anomaly prediction score and the model anomaly classification threshold is less than a preset difference threshold are identified as samples with low prediction score confidence. New samples with a confidence level lower than a preset confidence threshold are identified as samples with low confidence levels.

3. The method according to claim 2, characterized in that, The low-confidence samples include samples with low prediction score confidence. The process of clustering the low-confidence samples and constructing an updated training sample set based on target samples extracted from each cluster includes: Samples with low prediction score confidence are clustered to obtain multiple clusters, and the first target sample is extracted from each of the clusters according to a preset extraction number. For multiple first target samples in each cluster, all first target samples under the cluster are labeled with the tag of any one of the first target samples to obtain the first updated training sample set; The low-confidence samples include samples with low self-confidence. The process of clustering the low-confidence samples and constructing an updated training sample set based on target samples extracted from each cluster includes: Samples with low self-confidence are clustered to obtain multiple clusters, and second target samples are extracted from each cluster according to a preset extraction number. For each cluster of multiple second target samples, all second target samples under the cluster are labeled with the tag of any one of the second target samples to obtain the second updated training sample set.

4. The method according to claim 1, characterized in that, Before the financial risk control model performs anomaly identification on newly added sample data in the production environment, the method further includes: Construct a score prediction sub-model and a confidence sub-model, and obtain historical training sample sets for score prediction and confidence. The score prediction sub-model is trained based on the historical training sample set of score prediction to obtain the score prediction sub-model that has completed the initial training, and the confidence sub-model is trained based on the historical training sample set of confidence to obtain the confidence sub-model that has completed the initial training. A financial risk control model is constructed based on the score prediction sub-model and the confidence sub-model that have completed initial training, and the financial risk control model is deployed to the production environment to identify anomalies in newly added sample data in the production environment.

5. The method according to claim 4, characterized in that, The training sample set includes a first updated training sample set and a second updated training sample set. The incremental learning and updating training of the financial risk control model based on the training sample set includes: The score prediction sub-model that has completed the initial training is trained using incremental learning based on the first updated training sample set. The confidence sub-model that has completed the initial training is trained using incremental learning based on the second updated training sample set; The updated financial risk control model is constructed based on the updated score prediction sub-model and the updated confidence sub-model.

6. The method according to claim 4, characterized in that, The training sample set includes a first updated training sample set or a second updated training sample set; Incremental learning and updating training of the financial risk control model based on the first updated training sample set includes: The score prediction sub-model that has completed initial training is trained using incremental learning based on the first updated training sample set. The financial risk control model that has completed updated training is then constructed based on the score prediction sub-model that has completed updated training and the confidence sub-model that has completed initial training. Incremental learning and updating training of the financial risk control model based on the second updated training sample set includes: The confidence sub-model that has completed initial training is trained using incremental learning based on the second updated training sample set. The financial risk control model that has completed updated training is then constructed based on the updated confidence sub-model and the initial score prediction sub-model.

7. The method according to any one of claims 1-6, characterized in that, The financial risk control model includes an XGBoost sub-model and a convolutional neural network sub-model. The process of anomaly identification in newly added sample data in the production environment includes: For each new sample, the nodes in the pre-constructed financial risk knowledge graph are updated based on the sample data to obtain the updated financial risk knowledge graph. The updated financial risk knowledge graph is subjected to predictive processing to obtain statistical features of transaction behavior and topological features of transaction data; The XGBoost sub-model is used to predict the statistical features of the transaction behavior and the topological features of the transaction data to obtain anomaly prediction scores for different newly added samples. The updated financial risk knowledge graph is predicted using the convolutional neural network sub-model to obtain the confidence level of different newly added samples. Anomaly identification results for the new samples are generated based on the fusion result of the anomaly prediction score and the confidence level.

8. A self-updating device for a financial risk control model, characterized in that, include: The acquisition module is used to acquire the anomaly prediction scores and confidence levels of different new samples obtained by the financial risk control model during the anomaly identification process of new sample data in the production environment. The extraction module is used to extract low-confidence samples from the new samples based on the anomaly prediction score and confidence level. The clustering processing module is used to cluster the low-confidence samples and construct and update the training sample set based on the target samples extracted from each cluster. The update training module is used to perform incremental learning and update training on the financial risk control model based on the training sample set, so as to continue to perform anomaly identification on subsequent sample data based on the financial risk control model that has completed the updated training.

9. A storage medium storing at least one executable instruction that causes a processor to perform an operation corresponding to the self-updating method of the financial risk control model as described in any one of claims 1-7.

10. A terminal, comprising: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the self-updating method of the financial risk control model as described in any one of claims 1-7.

Images