Anti-fraud full-link intelligent regulation and control method and device based on AI

Abstract

The invention provides an AI-based anti-fraud full-link intelligent regulation and control method and device, and the method comprises the steps: obtaining multi-source heterogeneous data, and generating a standardized tag according to the type of a data source; obtaining the configuration of the configuration personnel on the anti-fraud model on the visual arrangement interface, and packaging all the configurations into an executable model; according to a data source type of each standardized label in the executable model, a calculation source engine and a logic relation of each standardized label, respectively generating an executable statement suitable for a stream batch scene, starting operation by adopting a differential scheduling mechanism, and generating and storing an anti-fraud identification result; obtaining a three-dimensional evaluation result through the stream batch data fused three-dimensional evaluation model; and based on a three-dimensional evaluation result, automatically triggering iterative optimization of the executable model. According to the method, rapid construction, real-time operation and continuous iterative optimization of the anti-fraud model are realized, and the problems of poor timeliness, low flexibility and poor accuracy in the prior art are solved, so that anti-fraud identification can be rapidly and accurately realized.

Description

Technical Field

[0001] This invention relates to the field of communication information processing technology, and in particular to an AI-based intelligent control method and device for the entire anti-fraud chain. Background Technology

[0002] In the telecommunications industry, timely detection and handling of telecom fraud are crucial. Patent publication number CN120186262A describes a telecom fraud governance method and system based on model prediction and AI-powered outbound call evidence collection. This solution uses communication data as input, constructs a risk scoring model with fixed rules to classify users into risk levels, and then triggers corresponding shutdown operations. Patent publication number CN118780602A describes a regional fraud risk assessment method, device, equipment, medium, and program product. This solution divides the control scope into high, medium, and low-risk areas based on the density of cases in different regions, and sets differentiated shutdown ratios and handling priorities for different areas. Patent publication number CN118945262A describes a method and system for identifying fraudulent numbers based on user profiles. This solution integrates user attributes and historical communication behavior data to construct a "good Samaritan" tag database. Users marked as high-risk by the model undergo secondary screening to eliminate clearly legitimate users, thereby reducing the false shutdown rate.

[0003] However, the above-mentioned existing solutions have the following problems: 1. The number of accidental shutdowns and customer complaints remains high.

[0004] 2. Fraudulent activities are becoming increasingly similar to normal communication activities, and existing anti-fraud strategies are struggling to respond quickly to new trends in cases. Summary of the Invention

[0005] To address the aforementioned problems in existing technologies, this invention provides an AI-based intelligent control method and device for the entire anti-fraud chain, which can quickly and accurately achieve anti-fraud identification.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: In a first aspect, the present invention provides an AI-based intelligent control method for the entire anti-fraud chain, comprising: Step S1: Obtain multi-source heterogeneous data and generate standardized labels, including streaming labels and batch labels, according to the data source type. Step S2: Obtain the configuration of the anti-fraud model by the configuration personnel on the visual orchestration interface, and encapsulate all configurations into an executable model, which includes a streaming model, a hybrid model and an offline model; Step S3: Based on the data source type, computing source engine and logical relationship of each standardized tag in the executable model, generate executable statements suitable for batch processing scenarios, and use a differentiated scheduling mechanism to start and run the corresponding executable statements, generate and save anti-fraud identification results. Step S4: A three-dimensional evaluation model for batch and stream data fusion is constructed. The executable model is automatically quantified from three dimensions: accuracy, timeliness, and balance, to obtain the three-dimensional evaluation results. Step S5: Based on the three-dimensional evaluation results, automatically trigger intelligent iteration of model parameters and optimization of data links to obtain an optimized executable model.

[0007] The beneficial effects of this invention are as follows: Based on standardized tags that integrate batch processing and batch processing, this invention autonomously completes the construction, configuration, and operation of anti-fraud models through visual orchestration. By automatically converting the model configuration of visual orchestration into executable code and scheduling its execution, the invention achieves real-time response and batch concurrent processing of the model. Finally, backtracking verification is performed, enabling rapid construction, real-time operation, and continuous iterative optimization of anti-fraud models. This solves the pain points of poor timeliness, low flexibility, and poor accuracy of existing technologies, thereby enabling rapid and accurate anti-fraud identification.

[0008] Optionally, step S3 specifically includes: Step S31: Obtain the data source type, computing source engine, and logical relationship of each standardized tag in the executable model; Step S32: Generate streaming executable statements, mixed executable statements, and batch executable statements according to the data source type and the logical relationship. The streaming executable statement is bound to the real-time computing source engine, and a main label is generated from the streaming label obtained from the real-time data source and a batch label is obtained from the offline data source as an auxiliary label for determination. The mixed executable statement is based on the real-time computing source engine as the main engine and the offline computing source engine as the auxiliary engine, and a streaming label obtained from the real-time data source and a batch label obtained from the offline data source are equally associated for determination. The batch executable statement is bound to the offline computing source engine, and a main label is generated from the batch label obtained from the offline data source and a streaming label obtained from the real-time data source as an auxiliary label for determination. Step S33: Start running the streaming executable statement and the mixed executable statement through a real-time scheduling mechanism, start running the batch executable statement through a timed task scheduling mechanism, and generate and save the anti-fraud identification results.

[0009] As described above, by constructing corresponding models and processing differentiated data through streaming and batch data, a rapid response and control mechanism can be established, thereby enhancing the anti-fraud strategy's adaptability to dynamic case situations and shortening the time cycle from discovering changes in case situations to completing strategy adjustments.

[0010] Optionally, step S33 further includes: Step S331: Monitor the data throughput of the real-time data source, the CPU load of the real-time computing source engine, and the tag computing complexity in real time. Using a resource demand prediction model based on time series and load characteristics, combined with the cluster resource pool status of the real-time scheduling mechanism, dynamically allocate or reclaim computing instances, and perform resource isolation and priority scheduling for real-time streaming tasks and offline batch tasks.

[0011] Optionally, step S33 further includes: Step S332: When a real-time streaming task is detected to have failed, the streaming and batch data from the most recent preset period are automatically backtracked and reprocessed. When the data from the real-time data source is severely accumulated, the system automatically switches to a mixed streaming and batch processing mode and temporarily stores the accumulated streaming data in an offline database to start offline computing.

[0012] As described above, efficient resource utilization and stable service output are achieved to ensure the efficient concurrent execution of mixed batch and stream tasks.

[0013] Optionally, step S332 further includes: The system monitors the data quality and computing performance of standardized tags in real time, and automatically adjusts the execution status of the standardized tags in the corresponding models based on the data quality and computing performance of the standardized tags.

[0014] As described above, by adjusting the level and switching the state, adaptive optimization of the entire process from data quality to model strategy is achieved, effectively balancing anti-fraud effectiveness and user experience.

[0015] Optionally, the accuracy in step S4 is obtained by comparing real-time case-related streaming data with batch-based risk lists, the timeliness is calculated based on the time difference between streaming tag generation and disposal execution, and the balance is comprehensively judged by associating batch-based complaint data with changes in the number of cases.

[0016] Optionally, step S5 further includes: Step S51: When the analysis finds that the contribution of the first streaming label in the new type of fraud has increased to the preset contribution threshold, while the accuracy of the first batch of streaming labels associated with the first streaming label has decreased due to data update delay, the weight of the first streaming label is automatically increased according to the preset weight adjustment algorithm, and the weight of the first batch of streaming labels is reduced accordingly. Step S52: When it is detected that the anti-fraud identification result of the executable model shows an increase in the complaint rate and the number of cases involved reaches the preset number, the execution frequency or handling intensity of the executable model is reduced, and the risk numbers hit by the executable model are screened a second time. The numbers that hit the good people database will be automatically removed or downgraded. Step S53: When backtracking analysis reveals that the batch label data missing rate is consistently too high or the proportion of outliers in streaming labels exceeds the threshold, automatic data optimization and data quality management are performed. Step S54: For all optimization points discovered through backtracking, before formal deployment, the optimized executable model will be simulated and run on historical data. Only when the pre-run evaluation indicators reach the preset standards will the optimized executable model be officially released and launched for execution.

[0017] As described above, through a multi-level, automated closed-loop optimization mechanism, the anti-fraud model's identification capability can be continuously and steadily improved as fraud patterns change and data quality is purified.

[0018] Optionally, the real-time data source of the streaming tag is bound to Kafka and a database and uses Flink compute nodes as the computing source engine, while the offline data source of the computing source engine of the batch tag is bound to Redis and a database and uses Hive compute tasks as the computing source engine.

[0019] Optionally, the configuration of step S2 includes, but is not limited to: selecting batch and stream labels together, setting the rule values, weight values ​​and logical relationships of standardized labels, and setting risk judgment rules.

[0020] Secondly, the present invention provides an AI-based anti-fraud end-to-end intelligent control device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the AI-based anti-fraud end-to-end intelligent control method provided in the first aspect.

[0021] The technical effects of the AI-based anti-fraud end-to-end intelligent control device provided in the second aspect are described in the relevant description of the AI-based anti-fraud end-to-end intelligent control method provided in the first aspect. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the main process of the AI-based anti-fraud end-to-end intelligent control method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the overall architecture of the AI-based intelligent control method for the entire anti-fraud chain according to an embodiment of the present invention; Figure 3 This is a flowchart illustrating step S1 in an embodiment of the present invention; Figure 4 This is a flowchart illustrating step S2 in an embodiment of the present invention; Figure 5 This is a flowchart illustrating step S3 in an embodiment of the present invention; Figure 6 This is a flowchart illustrating steps S4 and S5 in an embodiment of the present invention; Figure 7 This is a schematic diagram of the structure of the AI-based anti-fraud end-to-end intelligent control device according to an embodiment of the present invention.

[0023] Explanation of reference numerals in the attached figures: 1: AI-based intelligent control device for the entire anti-fraud chain; 2: Processor; 3: Memory. Detailed Implementation

[0024] To better understand the above technical solutions, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present invention can be understood more clearly and thoroughly, and that the scope of the present invention can be fully conveyed to those skilled in the art.

[0025] Example 1 Given the existing technology's continued high volume of erroneous shutdowns and customer complaints, and the inability of current anti-fraud strategies to quickly respond to new crime trends, refer to Figure 2 As can be seen, this embodiment proposes a four-layer progressive architecture consisting of a data standardization layer, a visualization orchestration layer, an intelligent execution layer, and a backtracking optimization layer. Based on integrated batch and stream data, with visualization orchestration as the entry point, an intelligent engine as the core, and backtracking verification as the closed loop, it enables the rapid construction, real-time operation, and continuous optimization of the anti-fraud model, thereby solving the above-mentioned problems.

[0026] Please refer to Figures 1 to 6 AI-based intelligent control methods for the entire anti-fraud chain include: Step S1: Obtain multi-source heterogeneous data and generate standardized labels, including streaming labels and batch labels, according to the data source type.

[0027] In this embodiment, each standardized tag completes entity registration, clearly defining the associated data source type and computing engine. The registration information is synchronized to the intelligent execution layer to ensure that the corresponding data link and computing resources can be directly matched during model parsing. That is, the real-time data source for streaming tags is bound to Kafka and a database, with Flink computing nodes as the computing engine; while the offline data source for batch tags is bound to Redis and a database, with Hive computing tasks as the computing engine.

[0028] Among them, the streaming tag is a data tag generated in real time by Flink based on real-time dynamic data, used for real-time risk identification, and is the key data carrier for achieving second-level anti-fraud response in this embodiment. The batch tag is a data tag generated in batches by Hive based on offline static data, used for user feature analysis, and is the basic data component for achieving comprehensive risk profiling in this embodiment.

[0029] Entity Registration is the process of registering each standardized label to clearly associate it with a data source type and a computing engine, ensuring that the model can directly match the corresponding data link and computing resources during parsing.

[0030] like Figure 3 As shown, in step S1 above, low-frequency data such as user information and monthly bills are collected as offline static data, and high-frequency data such as signaling and call logs are collected as real-time dynamic data. The offline static data is integrated with Hive to generate batch tags and stored in relational databases and Redis. Real-time dynamic data is processed by Flink to generate streaming tags, which are pushed to Kafka and stored in the database. Finally, a standardized tag library containing two types of tags is formed to support model orchestration.

[0031] Step S2: Obtain the configuration of the anti-fraud model by the configuration personnel on the visual orchestration interface, and encapsulate all configurations into an executable model, which includes streaming model, hybrid model and offline model.

[0032] In this embodiment, the configuration of step S2 includes, but is not limited to: mixed selection of batch and stream labels, setting the rule value, weight value and logical relationship of standardized labels, and setting risk judgment rules.

[0033] Specifically, such as Figure 4As shown, this embodiment first uses fraudulent / non-fraudulent phone numbers as samples to extract standardized labels from batch and streaming tags to form a feature set. Then, business personnel complete three configuration steps through a visual interface: selecting mixed batch and streaming tags, setting rule values, weight values, and logical relationships for standardized tags, and setting risk assessment rules. Finally, the system automatically encapsulates the above configuration into an executable model. In one example, the LightGBM framework can be used, with an initial learning rate of 0.1, and the model complexity can be controlled by adjusting num_leaves and max_depth.

[0034] Step S3: Based on the data source type, computing source engine, and logical relationship of each standardized label in the executable model, generate executable statements suitable for batch processing scenarios, and use a differentiated scheduling mechanism to start and run the corresponding executable statements, generating and saving anti-fraud identification results.

[0035] In this embodiment, step S3 specifically includes: Step S31: Obtain the data source type, computation source engine, and logical relationship of each standardized tag in the executable model.

[0036] Step S32: Generate streaming executable statements, mixed executable statements, and batch executable statements based on the data source type and logical relationship. Streaming executable statements are bound to the real-time computing source engine, and the main label is generated by obtaining streaming tags from the real-time data source, and the auxiliary label is obtained from the offline data source. Mixed executable statements are based on the real-time computing source engine as the main engine and the offline computing source engine as the auxiliary engine, and the streaming tags obtained from the real-time data source and the batch tags obtained from the offline data source are equally associated for judgment. Batch executable statements are bound to the offline computing source engine, and the main label is generated by obtaining batch tags from the offline data source and the auxiliary label is obtained from the real-time data source.

[0037] Therefore, by constructing corresponding models and processing differentiated data through streaming and batch data, a rapid response and control mechanism can be established to enhance the adaptability of anti-fraud strategies to dynamic case situations and shorten the time cycle from discovering changes in case situations to completing strategy adjustments.

[0038] Step S33: Start running streaming executable statements and mixed executable statements through a real-time scheduling mechanism, start running batch executable statements through a timed task scheduling mechanism, and generate and save anti-fraud identification results.

[0039] Reference Figure 5It can be seen that the streaming model generates FlinkSQL executable statements, which are associated with the Kafka main table and Redis dimensions. The hybrid model generates FlinkSQL executable statements, which are associated with Kafka, Redis, and Hive. Both the streaming and hybrid models output results in seconds through real-time scheduling by Yarn. The batch executable statement generation model SQL queries relational databases and outputs results periodically according to scheduled tasks, ultimately outputting a risk list and audit logs for anti-fraud identification.

[0040] To achieve efficient resource utilization and stable service output, the intelligent execution layer incorporates a dynamic resource scheduling algorithm based on the characteristics of batch and stream data, as well as fault self-healing and adaptive adjustment capabilities that are tightly coupled with the batch and stream data link. Therefore, step S33 further includes: Step S331: Monitor the data throughput of the real-time data source, the CPU load of the real-time computing source engine, and the tag computing complexity in real time. Using a resource demand prediction model based on time series and load characteristics, combined with the cluster resource pool status of the real-time scheduling mechanism, dynamically allocate or reclaim computing instances, and perform resource isolation and priority scheduling for real-time streaming tasks and offline batch tasks.

[0041] In step S331, a resource demand prediction model based on time series and load characteristics is constructed by collecting Kafka Topic traffic, Flink job CPU / memory usage, and atomic tag computational complexity. Furthermore, by combining the Yarn cluster resource pool status, TaskManager instances are dynamically allocated or reclaimed, and resource isolation and priority scheduling are performed for real-time streaming tasks and offline batch tasks, thereby improving overall resource utilization and task concurrency while ensuring low-latency response.

[0042] Step S332: When a real-time streaming task is detected to have failed, the streaming and batch data from the most recent preset period are automatically backtracked and reprocessed. When the data from the real-time data source is severely accumulated, the system automatically switches to a mixed streaming and batch processing mode and temporarily stores the accumulated streaming data in an offline database to start offline computing.

[0043] The preset period is approximately one hour. When a Flink task failure is detected, the system can automatically backtrack nearly one hour of Kafka streaming data and Redis batch cache data for recalculation to ensure no data loss. If there is a severe backlog of Kafka data, the system will automatically switch to a hybrid streaming and batch processing mode, temporarily storing the backlogged data in Hive to start offline computation. The results will be synchronized after the backlog is alleviated, ensuring uninterrupted processing.

[0044] Among them, the Stream-Batch Hybrid Processing Mode is a processing mode that is automatically triggered when the Kafka data backlog exceeds 5,000 records per partition. It temporarily stores the backlogged data in Hive to start offline computing. After the backlog is relieved, the offline results are synchronized to the real-time risk list. It is an important fault self-healing mechanism to ensure the high availability of the system.

[0045] In this embodiment, the data quality and computing performance of the tags are also monitored in real time. At this time, step S332 further includes: The system monitors the data quality and computational performance of standardized tags in real time, and automatically adjusts the execution status of standardized tags in the corresponding models based on the data quality and computational performance of the standardized tags.

[0046] In this embodiment, the system monitors the data quality and computational performance of tags in real time. When a batch tag is found to have an excessively high data loss rate, or a streaming tag is found to generate a large amount of noise due to abnormal data sources, the system automatically downgrades the execution status of that tag in the model to a warning that is only recorded or triggers secondary authentication, rather than directly shutting it down. This reduces false alarms and achieves good-case filtering. Simultaneously, the system initiates a circuit breaker and switching process: if the computational latency of a tag exceeds a threshold, the system automatically switches to a backup computing link to ensure service continuity. All these downgrade and switching operations are recorded in real time and fed back to the operation analysis and management module to generate alarms and optimization suggestions, notifying management personnel to intervene and forming a management closed loop. This ensures the efficiency and accuracy of model execution in complex operating environments, achieving efficient resource utilization and stable service output, thus ensuring the efficient concurrent execution of mixed batch and streaming tasks.

[0047] Through the closed loop of evaluation, adjustment, downgrade, and switching in step S33 above, the system achieves adaptive optimization throughout the entire process from data quality to model strategy, effectively balancing anti-fraud effectiveness and user experience.

[0048] Step S4: A three-dimensional evaluation model for batch data fusion was constructed. The executable model was automatically quantified from three dimensions: accuracy, timeliness, and balance, to obtain the three-dimensional evaluation results.

[0049] Among them, the three-dimensional evaluation model is a batch data fusion evaluation system built by the backtracking optimization layer, which realizes multi-objective balance control in this embodiment.

[0050] In step S4, the accuracy is obtained by comparing real-time case-related streaming data with batch-based risk lists, the timeliness is calculated based on the time difference between streaming tag generation and disposal execution, and the balance is comprehensively judged by linking batch-based complaint data with changes in the number of cases.

[0051] Step S5: Based on the 3D evaluation results, automatically trigger intelligent iteration of model parameters and optimization of data links to obtain an optimized executable model.

[0052] like Figure 6 As can be seen, based on the three-dimensional evaluation results of step S4, the operation analysis and management module will automatically trigger intelligent iteration of model parameters and optimization of data links, forming a closed loop of evaluation, diagnosis, and control. At this point, step S5 also includes: Step S51: When the analysis finds that the contribution of the first-line tag in the new type of fraud has increased to the preset contribution threshold, while the accuracy of the first batch of tags associated with the first-line tag has decreased due to data update delay, the weight of the first-line tag is automatically increased according to the preset weight adjustment algorithm, and the weight of the first batch of tags is reduced accordingly.

[0053] If analysis reveals that a streaming label has significantly increased its contribution to new types of fraud, while the accuracy of the associated batch labels has decreased due to data update delays, the system will automatically adjust the weight of the streaming label and correspondingly decrease the weight of the batch label according to the preset weight adjustment algorithm. This enables the model's focus to shift rapidly towards high-value features, thus achieving Stream-Batch Weight Dynamic Switching. For example, if the preset contribution threshold is 15% and the accuracy drops to 10%, then the weight adjustment mechanism will be automatically triggered when the contribution of the streaming label increases by 15% and the accuracy of the batch label decreases by 10%.

[0054] Step S52: When it is detected that the anti-fraud identification results of the executable model show an increase in the complaint rate and the number of cases involved reaches the preset number, the execution frequency or handling intensity of the executable model is reduced, and the risk numbers hit by the executable model are screened a second time. Numbers that hit the good people database will be automatically removed or downgraded.

[0055] The preset number of cases is set by each region according to its actual situation, such as 20 cases, 100 cases, etc.

[0056] Specifically, when the operations analysis and management module detects an increase in the complaint rate while the number of cases is effectively controlled, it indicates that the model may be overly sensitive. The system will automatically trigger model downsampling, that is, reduce the execution frequency or intensity of the model, and simultaneously activate the secondary filtering logic of the "good Samaritan" database to re-screen the risky numbers matched by the model. Numbers matched by the "good Samaritan" database will be automatically removed or downgraded, thereby significantly improving the user experience while ensuring the effectiveness of anti-fraud measures.

[0057] Step S53: When backtracking analysis reveals that the batch label data missing rate is consistently too high or the proportion of outliers in streaming labels exceeds the threshold, automatic data optimization and data quality governance are performed.

[0058] When backtracking analysis reveals that the batch label data missing rate is consistently too high, or the proportion of outliers in streaming labels exceeds the threshold, the system will automatically push optimization instructions to the data standardization layer and trigger specific data quality governance actions, such as triggering Hive's offline data completion task or adjusting the parsing logic and outlier filtering rules in Flink stream processing jobs.

[0059] This ensures the accuracy and reliability of batch and stream data at the source, forming a virtuous cycle of model validation, data quality optimization instructions, data standardization layer execution optimization, data quality improvement, and model re-optimization.

[0060] Step S54: For all optimization points discovered through backtracking, before formal deployment, the optimized executable model will be simulated and run on historical data. Only when the pre-run evaluation indicators reach the preset standards will the optimized executable model be officially released and launched for execution.

[0061] like Figure 6 As can be seen, for all optimization points discovered through backtracking, the system utilizes the model pre-run verification function of the anti-fraud model management module to simulate and run on historical data before formal deployment, predicting the optimization effect. Only when the pre-run evaluation indicators reach the preset standards will the optimization strategy be officially released and launched, ensuring the reliability and effectiveness of each iteration.

[0062] The preset standard can be a recall rate of 90%.

[0063] Thus, through a multi-level, automated closed-loop optimization mechanism, steps S4 and S5 enable the anti-fraud model's identification capabilities to continuously and steadily improve as fraud patterns change and data quality is purified.

[0064] Therefore, in the following specific examples: (1) Real-time anti-fraud handling process: a. The data standardization layer synchronizes real-time data such as call signaling and base station location every second to generate streaming tags such as "Calls between 2 cities within 10 minutes"; b. The visual orchestration layer has been configured with a high-risk model of "streaming tags: cross-city calls + batch tags: network access <1 month"; c. The intelligent execution layer parses the model and generates FlinkSQL, which is then linked to Kafka and Redis data in real time to identify high-risk phone numbers in seconds; d. The execution layer pushes the risk list to the CRM system, triggering the "suspend call service" command, and synchronizes it to the retrospective optimization layer; e. The backtracking optimization layer calculates the model's accuracy daily. If it is >92%, the configuration is maintained; if it is <85%, a reminder is given to adjust the label threshold.

[0065] (2) Response process for new fraud patterns: a. Frontline staff have discovered a new fraudulent pattern of "mass text messaging from fake base stations," and a new label for "receiving 5 unknown text messages within 1 hour" needs to be added. b. The data standardization layer adds the streaming label via Flink, and it is synchronized to the label library within 10 minutes; c. Business personnel drag and drop to select "Unknown SMS tag + batch tag: low-cost package" in the visual interface and configure the "AND" logical relationship; d. The intelligent execution layer automatically generates execution code, completes model deployment within 1 minute, and begins real-time identification of new types of risk numbers; e. Backtrack and optimize the model by running historical data to verify its effectiveness. Once the recall rate reaches 90%, solidify the configuration.

[0066] In summary, the advantages of this invention are: 1. Outstanding end-to-end closed-loop optimization capabilities. Based on standardized tags that integrate stream and batch processing, this invention autonomously completes the construction, configuration, and operation of anti-fraud models through visual orchestration. By automatically converting the model configuration into executable code and scheduling its execution, it achieves real-time response and batch concurrent processing of the model. Finally, backtracking verification is performed, enabling rapid construction, real-time operation, and continuous iterative optimization of anti-fraud models. This addresses the pain points of existing technologies, such as poor timeliness, low flexibility, and poor accuracy, thereby achieving rapid and accurate anti-fraud identification.

[0067] 2. Significantly improved dynamic resource intelligent scheduling capabilities. This invention incorporates a dynamic resource scheduling algorithm within the intelligent execution layer. Based on three-dimensional indicators—Kafka throughput, Flink task CPU utilization, and tag computational complexity—a resource demand prediction model is established to achieve automatic scaling up and down of computing resources, thus solving the processing latency problem caused by uneven resource allocation.

[0068] 3. Breakthrough in real-time optimization capabilities for batch and stream data fusion. This invention constructs a three-dimensional evaluation model for batch and stream data fusion through a backtracking optimization layer. Based on the evaluation results, it automatically triggers model parameter iteration and label weight adjustment, and links with the data standardization layer in real time, forming a virtuous cycle of model optimization, data quality improvement, and model re-optimization.

[0069] 4. Enhanced fault self-healing and business continuity assurance capabilities. This invention features intelligent self-healing capabilities, supporting automatic backtracking of Flink task failures and automatic switching to mixed stream and batch modes for Kafka data backlog, ensuring no data loss and uninterrupted processing, significantly improving system availability.

[0070] 5. Multi-dimensional balance and regulation optimization: This invention comprehensively considers accuracy, timeliness and balance through a three-dimensional evaluation model, automatically triggers the model's frequency reduction logic, adds secondary filtering to the good people database, and effectively balances anti-fraud effect and user experience.

[0071] Example 2 Please refer to Figure 7 The AI-based anti-fraud end-to-end intelligent control device 1 includes a memory 3, a processor 2, and a computer program stored on the memory 3 and run on the processor 2. When the processor 2 executes the computer program, it implements the steps in the above embodiment 1.

[0072] Since the systems / devices described in the above embodiments of the present invention are systems / devices used to implement the methods of the above embodiments of the present invention, those skilled in the art can understand the specific structure and modifications of the systems / devices based on the methods described in the above embodiments of the present invention, and therefore will not be repeated here. All systems / devices used in the methods of the above embodiments of the present invention fall within the scope of protection of the present invention.

[0073] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0074] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions.

[0075] It should be noted that any reference numerals placed between parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention can be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In claims that enumerate several means, several of these means may be embodied by the same hardware. The use of the terms first, second, third, etc., is merely for convenience of expression and does not indicate any order. These terms can be understood as part of the component names.

[0076] Furthermore, it should be noted that in the description of this specification, the terms "one embodiment," "some embodiments," "embodiment," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0077] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the claims should be interpreted to include both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0078] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, then this invention should also include these modifications and variations.

Claims

1. An AI-based intelligent control method for the entire anti-fraud chain, characterized in that: include: Step S1: Obtain multi-source heterogeneous data and generate standardized labels, including streaming labels and batch labels, according to the data source type. Step S2: Obtain the configuration of the anti-fraud model by the configuration personnel on the visual orchestration interface, and encapsulate all configurations into an executable model, which includes a streaming model, a hybrid model and an offline model; Step S3: Based on the data source type, computing source engine and logical relationship of each standardized tag in the executable model, generate executable statements suitable for batch processing scenarios, and use a differentiated scheduling mechanism to start and run the corresponding executable statements, generate and save anti-fraud identification results. Step S4: A three-dimensional evaluation model for batch and stream data fusion is constructed. The executable model is automatically quantified from three dimensions: accuracy, timeliness, and balance, to obtain the three-dimensional evaluation results. Step S5: Based on the three-dimensional evaluation results, automatically trigger intelligent iteration of model parameters and optimization of data links to obtain an optimized executable model.

2. The AI-based intelligent control method for the entire anti-fraud chain according to claim 1, characterized in that, Step S3 specifically includes: Step S31: Obtain the data source type, computing source engine, and logical relationship of each standardized tag in the executable model; Step S32: Generate streaming executable statements, mixed executable statements, and batch executable statements according to the data source type and the logical relationship. The streaming executable statement is bound to the real-time computing source engine, and a main label is generated from the streaming label obtained from the real-time data source and a batch label is obtained from the offline data source as an auxiliary label for determination. The mixed executable statement is based on the real-time computing source engine as the main engine and the offline computing source engine as the auxiliary engine, and a streaming label obtained from the real-time data source and a batch label obtained from the offline data source are equally associated for determination. The batch executable statement is bound to the offline computing source engine, and a main label is generated from the batch label obtained from the offline data source and a streaming label obtained from the real-time data source as an auxiliary label for determination. Step S33: Start running the streaming executable statement and the mixed executable statement through a real-time scheduling mechanism, start running the batch executable statement through a timed task scheduling mechanism, and generate and save the anti-fraud identification results.

3. The AI-based intelligent control method for the entire anti-fraud chain according to claim 2, characterized in that, Step S33 further includes: Step S331: Monitor the data throughput of the real-time data source, the CPU load of the real-time computing source engine, and the tag computing complexity in real time. Using a resource demand prediction model based on time series and load characteristics, combined with the cluster resource pool status of the real-time scheduling mechanism, dynamically allocate or reclaim computing instances, and perform resource isolation and priority scheduling for real-time streaming tasks and offline batch tasks.

4. The AI-based intelligent control method for the entire anti-fraud chain according to claim 2, characterized in that, Step S33 further includes: Step S332: When a real-time streaming task is detected to have failed, the streaming and batch data from the most recent preset period are automatically backtracked and reprocessed. When the data from the real-time data source is severely accumulated, the system automatically switches to a mixed streaming and batch processing mode and temporarily stores the accumulated streaming data in an offline database to start offline computing.

5. The AI-based intelligent control method for the entire anti-fraud chain according to claim 4, characterized in that, Step S332 further includes: The system monitors the data quality and computing performance of standardized tags in real time, and automatically adjusts the execution status of the standardized tags in the corresponding models based on the data quality and computing performance of the standardized tags.

6. The AI-based intelligent control method for the entire anti-fraud chain according to any one of claims 1 to 5, characterized in that, In step S4, the accuracy is obtained by comparing real-time case-related streaming data with batch-based risk lists; the timeliness is calculated based on the time difference between streaming tag generation and disposal execution; and the balance is comprehensively judged by linking batch-based complaint data with changes in the number of cases.

7. The AI-based intelligent control method for the entire anti-fraud chain according to any one of claims 1 to 5, characterized in that, Step S5 further includes: Step S51: When the analysis finds that the contribution of the first streaming label in the new type of fraud has increased to the preset contribution threshold, while the accuracy of the first batch of streaming labels associated with the first streaming label has decreased due to data update delay, the weight of the first streaming label is automatically increased according to the preset weight adjustment algorithm, and the weight of the first batch of streaming labels is reduced accordingly. Step S52: When it is detected that the anti-fraud identification result of the executable model shows an increase in the complaint rate and the number of cases involved reaches the preset number, the execution frequency or handling intensity of the executable model is reduced, and the risk numbers hit by the executable model are screened a second time. The numbers that hit the good people database will be automatically removed or downgraded. Step S53: When backtracking analysis reveals that the batch label data missing rate is consistently too high or the proportion of outliers in streaming labels exceeds the threshold, automatic data optimization and data quality management are performed. Step S54: For all optimization points discovered through backtracking, before formal deployment, the optimized executable model will be simulated and run on historical data. Only when the pre-run evaluation indicators reach the preset standards will the optimized executable model be officially released and launched for execution.

8. The AI-based intelligent control method for the entire anti-fraud chain according to any one of claims 1 to 5, characterized in that, The real-time data source for the streaming tags is bound to Kafka and a database, and uses Flink compute nodes as the computing source engine. The offline data source for the batch tags' computing source engine is bound to Redis and a database, and uses Hive compute tasks as the computing source engine.

9. The AI-based intelligent control method for the entire anti-fraud chain according to any one of claims 1 to 5, characterized in that, The configuration of step S2 includes, but is not limited to: selecting batch and stream labels together, setting the rule values, weight values ​​and logical relationships of standardized labels, and setting risk judgment rules.

10. An AI-based intelligent control device for the entire anti-fraud chain, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that, When the processor executes the computer program, it implements the AI-based intelligent control method for the entire anti-fraud chain as described in any one of claims 1 to 9.

Images