Case risk measurement system and method based on machine learning algorithm analysis case

Abstract

This invention relates to the field of financial risk assessment technology, specifically to a case risk assessment system and method based on machine learning algorithms. The system mainly includes a pre-training module and a prediction module. This invention is designed with the application of artificial intelligence algorithms in the risk assessment of suspicious cases as its core concept. Guided by theories such as supervised learning and unsupervised learning, it analyzes the performance of various features of cases within a fine-grained feature system through classification algorithms, anomaly detection algorithms, and statistical analysis methods. This process uncovers hidden and anomalous information, assesses the risk of cases, and assigns scores and rankings them. Through the application of AI technology, financial institutions can more quickly and accurately identify and handle high-risk cases, rationally allocate the time and effort of business personnel in handling cases, and promptly reduce risks and losses.

Description

Technical Field

[0001] This invention relates to the field of financial risk assessment technology, specifically to a case risk assessment system and method based on machine learning algorithm analysis of cases. Background Technology

[0002] As financial institutions' business volume continues to grow and money laundering methods become increasingly diversified, traditional suspicious case identification systems based on expert rules face severe challenges. While current model optimization can leverage AI technology to automate model strategy optimization, it is limited by the "rule-model" system and cannot more accurately identify the risk characteristics of entities triggering suspicious case alerts. Furthermore, it lacks objectivity and comprehensiveness, failing to meet the demands of rapid business development and regulatory oversight from financial institutions. The main shortcomings of existing model optimization technologies are as follows:

[0003] 1. Apart from a small portion of model optimization relying on AI technology, most other cases are mainly analyzed and judged manually by business experts. This not only has subjectivity, limitations, and lag, but also makes it difficult to comprehensively identify the risk characteristics of the warning subject.

[0004] 2. Traditional expert model systems are "rule-model" systems, where a single rule contains multiple suspicious features. This often leads to problems such as "missing fish" due to the "net being too big" and the inability to distinguish the "target fish".

[0005] 3. The model is not accurate enough. It can only be defined and sorted by the experience of business experts. It cannot automatically calculate, sort and score suspicious cases. Business personnel do not know which cases are high risk, and therefore cannot prioritize and manage risk cases and risk accounts.

[0006] 4. Business experts often cannot go to the site in time to optimize the model, and the model is not updated in time, which leads to a decrease in accuracy and even missed reports. Summary of the Invention

[0007] The core objective of this invention is to address the problems of coarse feature processing granularity and ambiguous decision boundaries in existing suspicious case identification systems. It proposes a case risk assessment system and method based on machine learning algorithms. This system constructs a fine-grained multi-dimensional feature analysis framework, establishing accurate risk assessment models from both the overall decision boundary and individual feature boundaries. This overcomes the limitations of the traditional "rule-model" system, enabling it to start from the case data itself and utilize supervised learning algorithms to uncover the essential differences between reported and excluded cases in the multi-dimensional feature space. Simultaneously, it combines anomaly detection technology to determine the individual anomaly thresholds for each feature. This dual analysis framework significantly improves the accuracy of identifying high-risk cases while maintaining model interpretability, allowing business personnel to prioritize suspicious cases with genuine money laundering risks and effectively reduce compliance risks for financial institutions.

[0008] According to one aspect of the present invention, a case risk assessment system based on machine learning algorithm analysis is provided, comprising: a pre-training module, including a pre-trained classification model sub-module and a pre-trained separate model sub-module, wherein the pre-trained classification model sub-module is used to find the decision boundary of important features affecting historically reported cases and excluded cases using a supervised classification algorithm, and the pre-trained separate model sub-module is used to find the upper bound of anomalies or separate upper bounds of all features of historically reported cases and excluded cases using anomaly identification methods and statistical analysis functions; and a prediction module, used to load the trained classification model and separate model, and to perform risk prediction and case risk level assessment for new cases.

[0009] Optionally, the pre-trained classification model submodule includes: a first data acquisition submodule, used to characterize the historical behavioral data of reported and excluded cases; a first feature engineering submodule, including a feature preprocessing submodule and a feature selection submodule, wherein the feature preprocessing submodule is used to preprocess the money laundering scenario features of reported and excluded cases, and the feature selection submodule is used to select features through a recursive elimination method to obtain important features affecting reported and excluded cases and construct a training feature set; and a model optimization and saving submodule, used to learn the training feature set using the XGBoost classification algorithm and optimize it using a grid search algorithm to obtain the optimal classification model.

[0010] Optionally, the feature preprocessing submodule includes: a missing value removal feature submodule, used to perform missing value statistics on money laundering scenario features and remove money laundering scenario features with a missing rate greater than or equal to a first preset threshold; a non-distinguishing feature removal submodule, used to perform variance analysis on money laundering scenario features and remove money laundering scenario features with a variance equal to 0; a duplicate feature removal submodule, used to perform correlation analysis on money laundering scenario features and retain only one money laundering scenario feature if the Pearson correlation coefficient of two money laundering scenario features is greater than or equal to a second preset threshold; a missing value filling submodule, used to fill missing values ​​in money laundering scenario features with preset default values; and a feature standardization submodule, used to standardize the feature values ​​of money laundering scenario features column by column.

[0011] Optionally, the recursive elimination method includes: merging the money laundering scenario feature dataset of reported cases and the money laundering scenario feature dataset of excluded cases to construct a first dataset, and setting the label of reported cases to 1 and the label of excluded cases to 0 to obtain a target vector set; preprocessing the first dataset and feature set S to obtain a second dataset, wherein feature set S contains p money laundering scenario features; training the XGBoost classification algorithm based on the second dataset to obtain a classification model, which is used to output the classification risk probability of new cases; based on the classification model, obtaining the features and their feature importance, reversing the order of features according to feature importance, and deleting features with a feature importance of less than 1% to obtain a new feature set S; if If the condition is met, then stop iterative training; otherwise, continue training the classification model. Let S represent the number of features in the feature set S, and k represent the feature threshold, with a value of 0.2. p; saves and outputs the features sorted by importance and their indices to obtain the training feature set.

[0012] Optionally, the step of learning the training feature set using the XGBoost classification algorithm and optimizing it using a grid search algorithm to obtain the optimal classification model includes: performing feature engineering on the first dataset to obtain a third dataset containing only training features; setting the label of reported cases to 1 and the label of excluded cases to 0 to obtain a target vector set; randomly dividing the third dataset and the target vector set into a test set and a retention set according to a certain ratio; configuring the search parameters of the XGBoost algorithm; performing a grid search on the test set using the XGBoost classification algorithm and evaluating the model performance through the AUC value of the retention set, selecting the parameter configuration with the best performance; and outputting, saving, and deploying the classification model with the best score.

[0013] Optionally, the pre-trained separate model submodule includes: a second data acquisition submodule, used to characterize the historical behavioral data of reported cases and excluded cases; an anomaly identification submodule, used to determine the anomaly upper bound value of each money laundering scenario feature based on the money laundering scenario feature dataset of excluded cases, wherein the anomaly upper bound value is calculated by the 3-sigma algorithm or the box plot algorithm; a soft separate identification submodule, used to compare and analyze the money laundering scenario feature datasets of reported cases and excluded cases in the feature dimension using the decimal analysis method to determine the fuzzy decision boundary of reported cases and excluded cases in the money laundering scenario feature dimension; and a separate model construction submodule, used to construct a separate model based on the anomaly upper bound value and the fuzzy decision boundary to identify whether each money laundering scenario feature in a new case triggers an anomaly.

[0014] Optionally, the prediction module includes: a prediction classification model submodule, used to call the trained classification model to perform risk prediction on the historical behavior data of new cases, and output and save the first type of prediction result; a prediction separation model submodule, used to call the trained separation model to perform risk prediction on the historical behavior data of new cases, and output and save the second type of prediction result; and a case risk level calculation submodule, used to align the scores of the first type of prediction result and the second type of prediction result using a consistency function, generate a comprehensive risk score through weighted fusion, sort the new cases according to the comprehensive risk score, and output a high-risk priority list.

[0015] Optionally, the prediction classification model submodule includes: a third data acquisition submodule, used to characterize the historical behavioral data of the new case; a second feature engineering submodule, used to preprocess the money laundering scenario features of the new case, the feature preprocessing including missing value imputation and feature standardization; and a first loading model and prediction submodule, used to load the trained classification model, predict the money laundering scenario features of the new case after feature standardization, and output and save the first type of prediction result.

[0016] Optionally, the prediction separate model submodule includes: a fourth data acquisition submodule, used to characterize the historical behavioral data of the new case; and a second loading model and prediction submodule, used to load the trained separate model, compare and analyze the money laundering scenario features of the new case, and output and save the second type of prediction results.

[0017] According to a second aspect of the present invention, a method for case risk assessment based on machine learning algorithm analysis is provided, comprising: using a supervised classification algorithm through a pre-trained classification model submodule to find the decision boundary of important features affecting historically reported cases and excluded cases; using an anomaly identification method and statistical analysis function through a pre-trained separate model submodule to find the upper bound of anomalies or separate upper bounds of all features of historically reported cases and excluded cases; and loading the trained classification model and separate model through a prediction module to perform risk prediction and case risk level assessment for new cases; wherein, a pre-training module is formed based on the pre-trained classification model submodule and the pre-trained separate model submodule.

[0018] The case risk assessment system and method based on machine learning algorithms provided by this invention have the following beneficial effects: This invention is designed with the application of artificial intelligence algorithms in the risk assessment of suspicious cases. Guided by theories such as supervised learning and unsupervised learning, it analyzes the performance of various features of cases within a fine-grained feature system through classification algorithms, anomaly detection algorithms, and statistical analysis methods. This process uncovers hidden and abnormal information, assesses the risk of cases, and assigns scores and rankings. Through the application of AI technology, financial institutions can more quickly and accurately identify and handle high-risk cases, rationally allocate the time and effort of business personnel in handling cases, and promptly reduce risks and losses. Furthermore, without adjusting the model, it can intelligently identify high-risk cases, which helps business personnel to rationally allocate time and effort, thereby improving efficiency and achieving cost reduction and efficiency improvement. Moreover, in terms of the accuracy of case reporting, prioritizing the analysis of high-risk cases can accurately identify suspicious cases, improving the reporting accuracy to a certain extent. Attached Figure Description

[0019] The accompanying drawings, which are provided to further illustrate this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application.

[0020] Figure 1 This is a system framework diagram of the present invention.

[0021] Figure 2 This is a structural framework diagram of the pre-trained classification model submodule of the present invention.

[0022] Figure 3 This is a structural framework diagram of the feature preprocessing submodule of the present invention.

[0023] Figure 4 This is a structural framework diagram of the pre-trained separate model sub-modules of the present invention.

[0024] Figure 5 This is a structural framework diagram of the prediction module of the present invention.

[0025] Figure 6 This is a structural framework diagram of the predictive classification model submodule of the present invention.

[0026] Figure 7 This is a structural framework diagram of the prediction model submodule of the present invention.

[0027] Figure 8 This is the overall flowchart of the present invention.

[0028] Figure 9 This is a schematic diagram of an electronic device. Detailed Implementation

[0029] The embodiments of this application will now be described in detail. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. Furthermore, the following embodiments and features can be combined with each other unless otherwise specified. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0030] Example 1

[0031] Business personnel often face two dilemmas when analyzing suspicious cases: First, besides the rules triggered by the model, there is no other analytical information for reference, forcing them to rely on AI to manually analyze customer, account, and transaction information within the transaction cycle. Second, if the model is inaccurate, there is no other way to intervene in the suspicious case analysis except by modifying the model logic; business personnel can only passively accept the inaccuracy of the cases. Modifying the model logic and implementing it requires a significant investment of time and effort from both business and technical personnel, resulting in severe delays. To address these issues, this invention uses AI technology to analyze the decision boundaries of money laundering scenario characteristics in exclusion and reporting cases at multiple levels. Without adjusting the suspicious case model, suspicious cases are scored and ranked, allowing financial institution business personnel to prioritize higher-risk cases and effectively allocate time and effort to business case analysis. Simultaneously, it provides data evidence for case ranking, offering data support for business case analysis.

[0032] In one embodiment of the present invention, please refer to Figure 1 It provides a case risk assessment system based on machine learning algorithms. The system mainly includes a pre-training module and a prediction module.

[0033] The pre-training module includes a pre-trained classification model sub-module and a pre-trained separate model sub-module. The pre-trained classification model sub-module is used to find the decision boundary of important features affecting historical reported cases and excluded cases using a supervised classification algorithm. The pre-trained separate model sub-module is used to find the upper bound of anomalies or separate upper bounds of all features of historical reported cases and excluded cases using anomaly identification methods and statistical analysis functions.

[0034] In one embodiment of the present invention, a pre-training module is used to characterize the historical behavioral data of reported and excluded cases and to find the overall decision boundary of important features and the abnormal upper bound or individual upper bound of individual features. To this end, a pre-trained classification model submodule and a pre-trained individual model submodule are designed. The pre-trained classification model submodule uses a supervised classification algorithm to find the overall decision boundary of important features affecting historical reported and excluded cases; the pre-trained individual model submodule uses anomaly identification methods and statistical analysis functions to find the abnormal upper bound or individual upper bound of all features of historical reported and excluded cases.

[0035] Reference Appendix Figure 2 The pre-trained classification model submodule includes: a first data acquisition submodule, used to characterize the historical behavioral data of reported and excluded cases; a first feature engineering submodule, including a feature preprocessing submodule and a feature selection submodule, wherein the feature preprocessing submodule is used to preprocess the money laundering scenario features of reported and excluded cases, and the feature selection submodule is used to select features through a recursive elimination method to obtain important features affecting reported and excluded cases and construct a training feature set; and a model optimization and saving submodule, used to learn the training feature set using the XGBoost classification algorithm and optimize it using the GridSearchCV algorithm to obtain the optimal classification model.

[0036] Reference Appendix Figure 3 The feature preprocessing submodule includes: a missing value removal feature submodule, used to perform missing value statistics on money laundering scenario features and remove money laundering scenario features with a missing rate greater than or equal to a first preset threshold; a non-distinguishing feature removal submodule, used to perform variance analysis on money laundering scenario features and remove money laundering scenario features with a variance equal to 0; a duplicate feature removal submodule, used to perform correlation analysis on money laundering scenario features, and if the Pearson correlation coefficient of two money laundering scenario features is greater than or equal to a second preset threshold, only one money laundering scenario feature is retained; a missing value imputation submodule, used to imput missing values ​​in money laundering scenario features with preset default values; and a feature standardization submodule, used to standardize the feature values ​​of money laundering scenario features column by column.

[0037] In one embodiment of the present invention, a pre-trained classification model submodule is used to analyze the historical behavior of reported and excluded cases, identify important influencing features, and learn based on these important features to obtain the overall decision boundary of important features for reported and excluded cases. Specific steps include data acquisition, feature engineering, model optimization, and saving.

[0038] In one embodiment of the present invention, a first data acquisition submodule is set up to characterize the historical behavioral data of reported cases and excluded cases, providing data support for analyzing their behavior. The scope of data acquisition mainly includes: reported case information and excluded case information. Specifically: 1. Reported case information mainly includes customer information, account information, case date, and money laundering scenario feature dataset, etc., that triggered a certain model during the training period. 2. Excluded case information mainly includes customer information, account information, case date, and money laundering scenario feature dataset, etc., that triggered a certain model during the training period.

[0039] In one embodiment of the present invention, a first feature engineering submodule is set up to analyze the money laundering scenario features of reported and excluded cases, remove invalid features, features with extremely high similarity, and features with many missing values, and perform feature selection through a recursive elimination method to obtain the important features affecting reported and excluded cases. Specific steps include feature preprocessing and feature selection.

[0040] In one embodiment of the present invention, the feature preprocessing step of the first feature engineering submodule is used to perform preliminary screening of money laundering scenario features. First, invalid features are removed; then, missing values ​​are filled in; and finally, the feature values ​​are standardized. Specific steps include removing features with a large number of missing values, removing indistinguishable features, removing duplicate features, filling in missing values, and standardizing the features.

[0041] 1. Remove features with a high number of missing values: For features related to money laundering scenarios, perform missing value statistics. If the missing rate (missing_rate) is greater than or equal to a first preset threshold (th_miss), remove that feature. The formula for calculating the missing rate is: Where count_ft represents the total number of samples for a certain feature, miss_count_ft represents the total number of missing samples for a certain feature, and the first preset threshold th_miss can be set to 95%.

[0042] 2. Remove indistinguishable features: Perform variance analysis on the features related to the money laundering scenario. If the variance (var) equals 0, remove that feature. The formula for calculating variance is: Where N represents the total number of samples for the feature. Let u represent the feature value of the i-th sample, and let u represent the mean of all sample feature values. The calculation formula is: .

[0043] 3. Remove duplicate features: Perform correlation analysis on the money laundering scenario features. If the Pearson correlation coefficient r of two money laundering scenario features in the sample set is greater than or equal to the second preset threshold th_r, only one money laundering scenario feature is retained. The formula for calculating the Pearson correlation coefficient is: Where N represents the total number of samples for the feature. This represents the feature value of the i-th sample. Let x represent the mean of all samples' x-features, calculated using the following formula: ; This represents the value of sample i on feature y. The mean of the y-feature of all samples is represented by the following formula: The second preset threshold th_r can be set to 0.85.

[0044] 4. Missing value imputation: Fill missing values ​​in the money laundering scenario features with default values. Since the data format used by the features is numerical, the default value can be set to 0.

[0045] 5. Feature Standardization: The feature values ​​of money laundering scenarios are standardized column by column. The standardization formula used is as follows: ,in, This represents the standardized feature value of sample i; Let represent the feature value of the i-th sample before standardization; u represents the mean of all sample feature values, calculated using the following formula: ; The characteristic standard deviation of all samples is represented by the following formula: N represents the total number of samples for a feature.

[0046] In one embodiment of the present invention, the feature selection step of the first feature engineering submodule is used to perform secondary screening of money laundering scenario features, discarding features with low information content. Feature selection is performed using Recursive Feature Elimination (RFE), which evaluates the importance of each feature by recursively removing features and retraining the model. In each iteration, the least important features are removed, and the model is retrained. This process continues until a specified number of features is reached or no more features can be removed. The algorithm steps of the recursive feature elimination method are as follows.

[0047] 1. Merge the money laundering scenario feature dataset X1 of reported cases and the money laundering scenario feature dataset X2 of excluded cases to construct the first dataset X (of shape n). p and n represent the number of case samples, p represents the total number of features in the feature set S), and the labels of the reported cases are set to 1, and the labels of the excluded cases are set to 0, to obtain the target vector set (label set) Y.

[0048] It should be noted that both the money laundering scenario feature dataset X1 for reported cases and the money laundering scenario feature dataset X2 for excluded cases require data preprocessing. Specific steps include: removing features with a large number of missing values, removing indistinguishable features, removing duplicate features, imputing missing values, and feature standardization. This data preprocessing process is the same as the feature preprocessing steps in the first feature engineering submodule and will not be repeated here.

[0049] 2. Preprocess the first dataset X on the feature set S to obtain the second dataset XN, where the feature set S contains p money laundering scenario features.

[0050] It should be noted that the feature set S represents the set of anti-money laundering business features, which is generally determined by business experts, while the first dataset X is the set of values ​​that case samples take on the feature set S. That is, the relationship between the first dataset X and the feature set S is that the feature set of the first dataset X is S. In addition, the preprocessing process in step 2 is the same as the feature preprocessing steps in the first feature engineering submodule, and will not be repeated here.

[0051] 3. Based on the second dataset XN, the XGBoost classification algorithm is used to train a classification model, which is used to output the classification risk probability of new cases.

[0052] 4. Based on the classification model, obtain the features and their importance. Sort the features in reverse order according to their importance, delete features with an importance of less than 1%, and obtain a new feature set S.

[0053] 5. If If the condition is met, then stop iterative training; otherwise, continue training the classification model. Let S represent the number of features in the feature set S, and k represent the feature threshold, with a value of 0.2. p.

[0054] 6. Save and output the features sorted by importance and their numbers to obtain the training feature set.

[0055] In one embodiment of the present invention, the XGBoost classification algorithm is used to learn the training feature set, and the grid search algorithm is used for optimization to obtain the optimal classification model. The specific steps are as follows.

[0056] 1. Merge the money laundering scenario feature dataset X1 of reported cases and the money laundering scenario feature dataset X2 of excluded cases to construct the first dataset X, and perform feature engineering to obtain the third dataset XT containing only training features; set the label of the reported cases to 1 and the label of the excluded cases to 0 to obtain the target vector set (label set) Y.

[0057] 2. The third dataset XT and the target vector set Y are randomly divided into a test set and a retention set in a ratio of 8:2.

[0058] 3. Configure the search parameters of the XGBoost algorithm as follows: set the max_depth of the XGBoost algorithm to [3, 6, 9], the min_child_weight of the XGBoost algorithm to [1, 5, 10], and the subsample of the XGBoost algorithm to [0.6, 0.8, 1.0].

[0059] 4. The XGBoost classification algorithm is used to perform a grid search on the test set for the search parameters, and the model performance is evaluated by the AUC value of the retention set. The parameter configuration with the best performance is selected.

[0060] 5. Output, save, and deploy the classification model with the best score. The saving format can be PMML or PKL.

[0061] Reference Appendix Figure 4 The pre-trained separate model submodule includes: a second data acquisition submodule, used to characterize the historical behavioral data of reported cases and excluded cases; an anomaly identification submodule, used to determine the anomaly upper bound value of each money laundering scenario feature based on the money laundering scenario feature dataset of excluded cases, wherein the anomaly upper bound value is calculated by the 3-sigma algorithm or the box plot algorithm; a soft separate identification submodule, used to compare and analyze the money laundering scenario feature datasets of reported cases and excluded cases in the feature dimension using the decimal analysis method to determine the fuzzy decision boundary of reported cases and excluded cases in the money laundering scenario feature dimension; and a separate model construction submodule, used to construct a separate model based on the anomaly upper bound value and the fuzzy decision boundary to identify whether each money laundering scenario feature in a new case triggers an anomaly.

[0062] In one embodiment of the present invention, the pre-trained separation model submodule analyzes historical behavioral data of reported and excluded cases to find anomaly upper bounds or soft separation upper bounds between the features of reported cases and the features of excluded cases. Based on the anomaly features, it analyzes to obtain the individual decision boundaries of the anomaly features of reported and excluded cases. Specific steps include data acquisition, anomaly identification, and soft separation identification.

[0063] In one embodiment of the present invention, the function of the second data acquisition submodule is the same as that of the first data acquisition submodule, which is to characterize the historical behavioral data of reported cases and excluded cases, and will not be described in detail here.

[0064] In one embodiment of the present invention, an anomaly identification submodule is set up to analyze each feature in the money laundering feature dataset of excluded cases using an anomaly identification method. After analyzing the data distribution and business understanding, only one-sided upward anomaly analysis of the feature values ​​is required. Two methods, 3-sigma algorithm and box plot algorithm, are used for analysis. It should be noted that both 3-sigma algorithm and box plot algorithm are used for calculation. If the result of either calculation is greater than the upper bound value of the anomaly, it is determined to be an anomalous feature. Further, the feature value array is set as x. , where n is the total number of eigenvalues ​​in x. The formula for the 3-sigma algorithm is: Where, ucl represents the upper bound of the money laundering scenario characteristics calculated using the 3-sigma algorithm; μ represents the sample mean; σ represents the sample standard deviation. The formula for calculating the box plot algorithm is: Where uf represents the upper bound of the money laundering scenario characteristics calculated by the box plot algorithm; sort the array x in ascending order to obtain the sorted array. ; yes The first quartile, yes The third quartile, interquartile range k is a coefficient, which can be set to 1.5.

[0065] In one embodiment of the present invention, the anomaly identification steps of the pre-trained separate model sub-modules are as follows.

[0066] 1. Extract the feature value of each feature from the money laundering scenario feature dataset X of the excluded cases, record each set of feature values ​​as array x, calculate the abnormal upper bound value of each array x using the 3-sigma algorithm, and record the feature code and abnormal upper bound value.

[0067] 2. Extract the feature value of each feature from the money laundering scenario feature dataset X of the excluded cases, record each set of feature values ​​as array x, calculate the upper bound of the outlier for each set of array x using the box plot algorithm, and record the feature code and the upper bound of the outlier.

[0068] In one embodiment of the present invention, a soft-separate identification submodule is set up to perform comparative analysis on the money laundering feature datasets of excluded cases and reported cases in terms of feature dimensions using the decile analysis method, in order to find the fuzzy decision boundary of excluded cases and reported cases in terms of money laundering features. Further, the sorted feature value array of excluded cases is set as... , , It is an array The k-th eigenvalue, where n is The total number of feature values ​​in the array; the sorted array of feature values ​​for reported cases is... , , It is an array The k-th eigenvalue, m is The total number of eigenvalues ​​in the ; Define the function ,in, It is the feature array of reported cases. The tenths digit of the i-th element takes values ​​in the range [1, 10]. It is an array The characteristic value of the i-th tenths digit has a range of values. ; for In array The upper limit of the tenths place of the middle tenths place. It can characterize the deviation of the reported case feature values ​​from the excluded case feature values, for example, when >4 indicates that the reported case feature value is within the range of 4. The scheme excludes cases by offsetting the feature value by four decimal places. By using the criterion that the reported case feature value exceeds the fourth decimal place of the excluded case, this scheme quantifies the degree of deviation of a case from a single money laundering feature, thereby identifying high-risk cases that are "indistinguishable at the rule level".

[0069] In one embodiment of the present invention, the soft identification step of the soft identification submodule includes: based on each feature in the money laundering scenario feature dataset of excluded cases and the money laundering scenario feature dataset of reported cases, sorting the money laundering scenario feature arrays of excluded cases and reported cases for a certain feature in ascending order, and then using a function Perform calculations and record them. Features >4 and their corresponding eigenvalues Among them, eigenvalues is the upper bound of the abnormal feature p.

[0070] The prediction module is used to load the trained classification model and individual models to predict the risk of new cases and calculate the risk level of the cases.

[0071] Reference Appendix Figure 5The prediction module includes: a prediction classification model submodule, used to call the trained classification model to perform risk prediction on the historical behavior data of new cases, and output and save the first type of prediction result; a prediction separation model submodule, used to call the trained separation model to perform risk prediction on the historical behavior data of new cases, and output and save the second type of prediction result; and a case risk level calculation submodule, used to align the scores of the first type of prediction result and the second type of prediction result using a consistency function, and generate a comprehensive risk score through weighted fusion, sort the new cases according to the comprehensive risk score, and output a high-risk priority list.

[0072] Reference Appendix Figure 6 The prediction classification model submodule includes: a third data acquisition submodule, used to characterize the historical behavior data of new cases; a second feature engineering submodule, used to preprocess the money laundering scenario features of new cases, the feature preprocessing including missing value imputation and feature standardization; and a first loading model and prediction submodule, used to load the trained classification model, predict the money laundering scenario features of the new cases after feature standardization, and output and save the first type of prediction results.

[0073] Reference Appendix Figure 7 The prediction model submodule includes: a fourth data acquisition submodule, used to characterize the historical behavioral data of new cases; and a second loading model and prediction submodule, used to load the trained model, compare and analyze the money laundering scenario features of new cases, and output and save the second type of prediction results.

[0074] In one embodiment of the present invention, a prediction module is used to perform risk prediction on the historical behavioral data of new cases and to score and rank the cases based on the prediction results. To this end, a prediction classification model submodule and a prediction individual model submodule are designed. Then, the scores of the two prediction results are aligned using a consistency function of the case risk level calculation submodule, and finally, the risk level of the case is calculated. Specifically, the prediction classification model submodule performs risk prediction on the historical behavioral data of new cases by loading a pre-trained classification model; the prediction individual model submodule performs risk prediction on the historical behavioral data of new cases by loading a pre-trained individual model.

[0075] In one embodiment of the present invention, a prediction classification model sub-model is used to analyze the historical behavioral data of new cases, load a pre-trained classification model and its required features, and predict whether the case is a suspicious case. Specific steps include data acquisition, feature engineering, model loading, and prediction.

[0076] In one embodiment of the present invention, a third data acquisition submodule is set up to characterize the historical behavioral data of new cases, providing data support for model prediction. The scope of data acquisition mainly includes: new case information. Specifically, the new case information data mainly includes customer information, account information, case date, and money laundering scenario feature set within T-30 days.

[0077] In one embodiment of the present invention, a second feature engineering submodule is set up to standardize and process the money laundering scenario features of new cases, thereby making them consistent with the features used in the pre-trained model in terms of dimensionality. Specific steps include missing value imputation and feature standardization. The feature engineering steps (missing value imputation and feature standardization) of this prediction classification model sub-model are the same as those of the first feature engineering submodule, and will not be described again here.

[0078] In one embodiment of the present invention, a first loading model and a prediction submodule are set up to load the features and model file of the trained classification model. Then, the money laundering scenario features of the new case after feature standardization are predicted, and the first type of prediction result is output and saved. Wherein, when the first type of prediction result is 0, it indicates no (i.e., the case is not a suspicious case), and when the first type of prediction result is 1, it indicates yes (i.e., the case is a suspicious case). The prediction score calculation formula for the new case is: ,in, This represents the total predicted score of the classification model; pred represents the first prediction result, with a value range of 1 or 0; record and save the predicted score of the new case.

[0079] In one embodiment of the present invention, the prediction-specific model submodule is used to analyze the historical behavioral data of new cases, load features and their anomaly upper bounds from the pre-trained specific model, and obtain the abnormal features and anomaly categories of the new cases by comparing the money laundering scenario feature values ​​of the new cases with the anomaly upper bounds. Specific steps include data collection, loading abnormal features and their anomaly upper bounds, and prediction.

[0080] In one embodiment of the present invention, the function of the fourth data acquisition submodule is the same as that of the third data acquisition submodule, which is to characterize the historical behavioral data of new cases, and will not be described in detail here.

[0081] In one embodiment of the present invention, by setting a second loading model and a prediction submodule, the abnormal features and their abnormal upper bound values ​​of the trained separation model are loaded. Then, the money laundering scenario feature values ​​of the new case are compared and analyzed. When the money laundering scenario feature value of the new case is greater than the abnormal upper bound value, the feature is recorded as an abnormal feature, and the type of abnormality it triggers is recorded. Here, 1 is defined as the abnormality identification type, and 2 is the soft separation type. The second type of prediction result is output and saved. The prediction score calculation formula for the new case is: Where i represents the i-th money laundering scenario feature, and anom_type represents the anomaly type, with a value ranging from 1 to 2; the score calculation formula for new cases is: in, This represents the score of the i-th money laundering scenario feature; This represents the total predicted score for each model; it also records and saves the predicted score for the new case.

[0082] It should be noted that the prediction score of each model depends on the number and types of anomalous features. The number of features can range from [value missing]. The range of the number of abnormal features is 0, 500. The predicted total score of the model ranges from 0 to 500. The predicted scores of the two models are not aligned in terms of scale [0, 1000], while the predicted total score of the classification model ranges from {0, 50}. Therefore, a consistency function is needed to align the scores of the two prediction results. Here, it is only necessary to perform a secondary scoring on the predicted total scores of each model, and the scoring formula is as follows: ,in, This represents the total predicted score of the two scoring models.

[0083] The comprehensive risk score for new cases will be calculated from the total predicted score of each model. The predicted total score of the separate models after secondary scoring The composition, and the formula are: ,in, This represents the overall risk score. To facilitate case analysis by business personnel, the overall risk score is converted into a case risk level, calculated using the following formula: In this system, 1 represents low risk, 2 represents relatively low risk, 3 represents medium risk, 4 represents relatively high risk, and 5 represents high risk.

[0084] This application utilizes a pre-trained classification model, XGBoost, to identify the joint decision boundary of multiple features, and pre-trained separate models (3-sigma + box plot + decimal offset function) to identify the upper bound of single-feature anomalies. The outputs of both models are processed by a dual-model collaborative scoring architecture to generate a unified risk score, thereby achieving automatic sorting and grading, assisting business operations in prioritizing high-risk cases. This helps business personnel to allocate time and energy more effectively, thereby improving efficiency and achieving cost reduction and efficiency improvement.

[0085] Example 2

[0086] This embodiment, based on Embodiment 1 above, provides a method for case risk assessment based on machine learning algorithm analysis. Please refer to [link to previous document]. Figure 8 The specific implementation steps of the case risk assessment system based on machine learning algorithm analysis, which is applied to Example 1, are as follows.

[0087] S1. The pre-trained classification model submodule uses a supervised classification algorithm to find the decision boundary that influences the important features of historically reported cases and excluded cases.

[0088] S2. By using anomaly identification methods and statistical analysis functions, the pre-trained model sub-modules are used to find the upper bound values ​​or separate upper bounds of all features of historically reported cases and excluded cases.

[0089] S3. By loading the trained classification model and individual model through the prediction module, risk prediction and risk level calculation are performed on new cases.

[0090] The pre-training module is formed by combining the pre-trained classification model sub-module and the pre-trained separate model sub-module.

[0091] Example 3

[0092] Based on Embodiment 2 described above, this embodiment also provides an electronic device, please refer to the appendix. Figure 9 , Figure 9 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0093] like Figure 9 As shown, an electronic device may include a processing unit (such as a central processing unit, graphics processing unit, etc.) that can perform various appropriate actions and processes based on a program stored in read-only memory (ROM) or a program loaded from a storage device into random access memory (RAM). The RAM also stores various programs and data required for the operation of the electronic device. The processing unit, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0094] Typically, the following devices can be connected to an I / O interface: input devices such as touchscreens, touchpads, keyboards, mice, and cameras; output devices such as liquid crystal displays (LCDs) and speakers; storage devices such as magnetic tapes and hard drives; and communication devices. Communication devices allow electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 9 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively. Figure 9 Each box shown can represent a device or multiple devices as needed.

[0095] In particular, according to some embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, it performs the functions defined above in the methods of some embodiments of this disclosure.

[0096] Example 4

[0097] Based on Embodiment 2 above, this embodiment also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above method.

[0098] It should be noted that, in some embodiments of this disclosure, the computer-readable medium described above may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In some embodiments of this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In some embodiments of this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), or any suitable combination thereof.

[0099] In some embodiments, the client and server may communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and may interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0100] The aforementioned computer-readable medium may be included in the aforementioned device or may exist independently without being assembled into the electronic device. The aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: use a supervised classification algorithm via a pre-trained classification model submodule to find the decision boundaries of important features influencing historically reported cases and excluded cases; use anomaly identification methods and statistical analysis functions via a pre-trained separate model submodule to find the upper bounds of all features of historically reported cases and excluded cases, or separate upper bounds; and load the trained classification model and separate model via a prediction module to perform risk prediction and risk level calculation for new cases.

[0101] Computer program code for performing operations of some embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0102] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0103] The units described in some embodiments of this disclosure can be implemented in software or hardware. The described units can also be housed in a processor; for example, a processor may be described as including a pre-training unit and a prediction unit. The names of these units do not necessarily limit the unit itself; for example, a prediction unit may also be described as "a unit that loads trained classification and separation models to perform risk prediction for new cases and calculate the risk level of the cases."

[0104] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), etc.

[0105] Obviously, those skilled in the art will understand that the various steps of the present invention described above can be performed in a manner different from that described above, and the simulation methods and experimental equipment include, but are not limited to, the above description. The steps of the present invention described above can be performed in a different order in certain circumstances, and the steps shown or described above can be performed separately. Therefore, the present invention is not limited to any particular combination of hardware and software.

[0106] The above description, in conjunction with specific embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such deductions or substitutions should be considered within the scope of protection of the present invention.

Claims

1. A case risk measurement system based on machine learning algorithm analysis of cases, characterized in that, include: The pre-training module includes a pre-trained classification model sub-module and a pre-trained separate model sub-module. The pre-trained classification model sub-module is used to find the decision boundary of important features affecting historical reported cases and excluded cases using a supervised classification algorithm. The pre-trained separate model sub-module is used to find the upper bound of anomalies or separate upper bounds of all features of historical reported cases and excluded cases using anomaly identification methods and statistical analysis functions. The pre-trained classification model submodule includes: The first data acquisition submodule is used to characterize the historical behavioral data of reported and excluded cases. The first feature engineering submodule includes a feature preprocessing submodule and a feature selection submodule. The feature preprocessing submodule is used to preprocess the money laundering scenario features of reported cases and excluded cases. The feature selection submodule is used to select features through a recursive elimination method to obtain important features that affect reported cases and excluded cases, and to construct a training feature set. The model optimization and saving submodule is used to learn the training feature set using the XGBoost classification algorithm and optimize it using the grid search algorithm to obtain the optimal classification model. The pre-trained model sub-modules include: The second data acquisition submodule is used to characterize the historical behavioral data of reported and excluded cases. The anomaly identification submodule is used to determine the anomaly upper bound value of each money laundering scenario feature based on the money laundering scenario feature dataset of excluded cases. The anomaly upper bound value is calculated by the 3-sigma algorithm or the box plot algorithm. The soft identification submodule is used to compare and analyze the money laundering scenario feature datasets of reported cases and excluded cases in the feature dimension using the decimal analysis method, and to determine the fuzzy decision boundary of reported cases and excluded cases in the money laundering scenario feature dimension. The separate model construction submodule is used to construct separate models based on the anomaly upper bound and the fuzzy decision boundary, so as to identify whether each money laundering scenario feature in the new case triggers anomalies; The prediction module is used to load the trained classification model and individual models to predict the risk of new cases and calculate the risk level of the cases.

2. The case risk assessment system based on machine learning algorithm analysis as described in claim 1, characterized in that, The feature preprocessing submodule includes: The missing value removal feature submodule is used to perform missing value statistics on money laundering scenario features and remove money laundering scenario features with a missing rate greater than or equal to a first preset threshold. The "Remove Indistinguishable Features" submodule is used to perform variance analysis on money laundering scenario features and remove money laundering scenario features with variance equal to 0. The feature removal submodule is used to perform correlation analysis on money laundering scenario features. If the Pearson correlation coefficient of two money laundering scenario features is greater than or equal to the second preset threshold, only one money laundering scenario feature is retained. The missing value filling submodule is used to fill missing values ​​in money laundering scenario features with preset default values; The feature standardization submodule is used to standardize the feature values ​​of money laundering scenario features column by column.

3. The case risk assessment system based on machine learning algorithm analysis as described in claim 1, characterized in that, The recursive elimination method includes: The data sets of money laundering scenario features of reported cases and money laundering scenario features of excluded cases are merged to construct the first dataset. The labels of reported cases are set to 1 and the labels of excluded cases are set to 0 to obtain the target vector set. The first dataset and feature set S are preprocessed to obtain the second dataset, where feature set S contains p money laundering scenario features; Based on the second dataset, the XGBoost classification algorithm was used to train a classification model, which was used to output the classification risk probability of new cases. Based on the classification model, features and their importance are obtained. The features are then sorted in reverse order according to their importance, and features with an importance of less than 1% are deleted to obtain a new feature set S. like If the condition is met, then stop iterative training; otherwise, continue training the classification model. Let S represent the number of features in the feature set S, and k represent the feature threshold, with a value of 0.

2. p; The features, sorted by importance and their numbers, are saved and output to obtain the training feature set.

4. The case risk assessment system based on machine learning algorithm analysis as described in claim 1, characterized in that, The process of learning the training feature set using the XGBoost classification algorithm and optimizing it using a grid search algorithm to obtain the optimal classification model includes: The first dataset is subjected to feature engineering to obtain a third dataset containing only training features; the labels of reported cases are set to 1 and the labels of excluded cases are set to 0 to obtain the target vector set. The third dataset and the target vector set are randomly divided into a test set and a retention set according to a certain ratio; Configure the search parameters for the XGBoost algorithm; The XGBoost classification algorithm is used to perform a grid search on the search parameters on the test set, and the model performance is evaluated by the AUC value of the retention set. The parameter configuration with the best performance is selected. Output, save, and deploy the classification model with the best score.

5. The case risk assessment system based on machine learning algorithm analysis as described in claim 1, characterized in that, The prediction module includes: The prediction classification model submodule is used to call the trained classification model, perform risk prediction on the historical behavior data of new cases, and output and save the first type of prediction result. The prediction model submodule is used to call the trained model to perform risk prediction on the historical behavior data of new cases, and output and save the second type of prediction results. The case risk level calculation submodule is used to align the scores of the first type of prediction results and the second type of prediction results using a consistency function, generate a comprehensive risk score through weighted fusion, sort new cases according to the comprehensive risk score, and output a high-risk priority list.

6. The case risk assessment system based on machine learning algorithm analysis as described in claim 5, characterized in that, The prediction classification model submodule includes: The third data acquisition submodule is used to characterize the historical behavioral data of new cases; The second feature engineering submodule is used to perform feature preprocessing on the money laundering scenario features of new cases. The feature preprocessing includes missing value imputation and feature standardization. The first loading model and prediction submodule is used to load the trained classification model, predict the money laundering scenario features of the new case after feature standardization, and output and save the first type of prediction results.

7. The case risk assessment system based on machine learning algorithm analysis as described in claim 5, characterized in that, The prediction model submodule includes: The fourth data acquisition submodule is used to characterize the historical behavioral data of new cases; The second loading model and prediction submodule is used to load the trained models, compare and analyze the money laundering scenario features of the new case, and output and save the second type of prediction results.

8. A case risk assessment method based on machine learning algorithm analysis, characterized in that, include: The pre-trained classification model submodule employs a supervised classification algorithm to find the decision boundaries that influence important features of historically reported and excluded cases; The pre-trained classification model submodule includes: The first data acquisition submodule is used to characterize the historical behavioral data of reported and excluded cases. The first feature engineering submodule includes a feature preprocessing submodule and a feature selection submodule. The feature preprocessing submodule is used to preprocess the money laundering scenario features of reported cases and excluded cases. The feature selection submodule is used to select features through a recursive elimination method to obtain important features that affect reported cases and excluded cases, and to construct a training feature set. The model optimization and saving submodule is used to learn the training feature set using the XGBoost classification algorithm and optimize it using the grid search algorithm to obtain the optimal classification model. By pre-training, the model sub-modules are used to find the upper bound values ​​or separate upper bounds of all features of historically reported cases and excluded cases by using anomaly identification methods and statistical analysis functions; The pre-trained model sub-modules include: The second data acquisition submodule is used to characterize the historical behavioral data of reported and excluded cases. The anomaly identification submodule is used to determine the anomaly upper bound value of each money laundering scenario feature based on the money laundering scenario feature dataset of excluded cases. The anomaly upper bound value is calculated by the 3-sigma algorithm or the box plot algorithm. The soft identification submodule is used to compare and analyze the money laundering scenario feature datasets of reported cases and excluded cases in the feature dimension using the decimal analysis method, and to determine the fuzzy decision boundary of reported cases and excluded cases in the money laundering scenario feature dimension. The separate model construction submodule is used to construct separate models based on the anomaly upper bound and the fuzzy decision boundary, so as to identify whether each money laundering scenario feature in the new case triggers anomalies; By loading the trained classification model and individual model into the prediction module, risk prediction and risk level calculation are performed on new cases. The pre-training module is formed by combining the pre-trained classification model sub-module and the pre-trained separate model sub-module.

Images