Business auditing method and device and electronic equipment

Abstract

The invention provides a business auditing method and device and electronic equipment, and relates to the technical field of big data, and the method comprises the steps: collecting business environment data in a data business processing process, extracting risk features based on the business environment data, and calculating a first risk probability of a data business based on the risk features; determining an environment score according to the first risk probability, a preset rule and a weight corresponding to the first risk probability and the preset rule; determining auditing rules and auditing parameters according to the environment score under the condition that the business environment data meets a preset condition, and determining a first auditing strategy based on the auditing rules and the auditing parameters; and executing the first auditing strategy on the data service. According to the embodiment of the invention, the first auditing strategy is determined according to the environment score, the environment score is determined according to the risk feature and the preset rule, and the first auditing rule considers the risk condition of the actual business environment, so that the accuracy of business risk auditing can be improved.

Description

Technical Field

[0001] This application relates to the field of big data technology, and in particular to a business auditing method, apparatus and electronic equipment. Background Technology

[0002] In business audit scenarios, the audit system is the core of anomaly identification and risk prevention. Mainstream audit systems, represented by International Business Machines Corporation Regulatory Technology (IBM RegTech), generally adopt a rule-based static architecture. Its core logic is to perform pattern matching through a predefined rule base (including transaction amount thresholds, frequency limits, etc.) and compare the actual data with the preset rules to complete the anomaly determination.

[0003] However, in practical applications, there are some complex business scenarios, such as sudden changes in transaction patterns and upgraded fraud methods. The rule updates in the predefined rule base often lag behind business iterations. Using predefined static rules for business auditing results in low accuracy in identifying business risks. Summary of the Invention

[0004] This application provides a business audit method, apparatus, and electronic device to address the problem of low accuracy in business risk identification.

[0005] To solve the above-mentioned technical problems, this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a business auditing method, the method comprising:

[0007] Collect business environment data during the data service processing, extract risk features based on the business environment data, and calculate the first risk probability of the data service based on the risk features. The risk features are used to characterize the existence of risks in the data service.

[0008] An environmental score is determined based on the first risk probability and the preset rules, as well as the weights corresponding to the first risk probability and the preset rules. The environmental score is used to characterize the risk level of the data service.

[0009] If the business environment data meets the preset conditions, the audit rules and audit parameters are determined according to the environment score, and the first audit strategy is determined based on the audit rules and the audit parameters.

[0010] The first audit strategy is executed on the data service.

[0011] Secondly, embodiments of this application provide a business auditing device, the device comprising:

[0012] The data acquisition module is used to collect business environment data during the data service processing, extract risk features based on the business environment data, and calculate the first risk probability of the data service based on the risk features. The risk features are used to characterize the existence of risks in the data service.

[0013] The first determining module is used to determine an environmental score based on the first risk probability and a preset rule, as well as the weights corresponding to the first risk probability and the preset rule. The environmental score is used to characterize the risk level of the data service.

[0014] The second determining module is used to determine audit rules and audit parameters based on the environment score when the business environment data meets preset conditions, and to determine a first audit strategy based on the audit rules and audit parameters.

[0015] The first execution module is used to execute the first audit strategy on the data service.

[0016] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the business audit method described in the first aspect.

[0017] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the business auditing method described in the first aspect.

[0018] Fifthly, a computer program product is provided, including computer instructions that, when executed by a processor, implement the steps of the business audit method as described in the first aspect.

[0019] In this embodiment, business environment data during data service processing is collected. Risk features are extracted based on the business environment data, and a first risk probability of the data service is calculated based on the risk features. The risk features are used to characterize the existence of risk in the data service. An environment score is determined based on the first risk probability, preset rules, and the weights corresponding to the first risk probability and the preset rules. The environment score is used to characterize the degree of risk of the data service. When the business environment data meets preset conditions, audit rules and audit parameters are determined based on the environment score, and a first audit strategy is determined based on the audit rules and audit parameters. The first audit strategy is executed on the data service. When the preset rules are met, the audit rules and audit parameters are adjusted based on the environment score, and the first audit strategy is determined based on the audit rules and audit parameters. Since the first audit strategy is determined based on the environment score, and the environment score is jointly determined based on the risk features of the business environment data and preset rules, the first audit rule considers the risk situation of the actual business environment, which can improve the accuracy of business risk audit. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is one of the flowcharts of a business auditing method provided in the embodiments of this application;

[0022] Figure 2 This is a second flowchart of a business auditing method provided in an embodiment of this application;

[0023] Figure 3 This is a schematic diagram of the structure of a business audit device provided in an embodiment of this application;

[0024] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0025] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] This application provides a business audit method, apparatus, and electronic device to address the problem of low accuracy in business risk identification.

[0027] See Figure 1 , Figure 1 This is a flowchart of a business auditing method provided in an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0028] Step 101: Collect business environment data during the data service processing, extract risk features based on the business environment data, and calculate the first risk probability of the data service based on the risk features. The risk features are used to characterize the existence of risks in the data service.

[0029] Step 102: Determine an environmental score based on the first risk probability and the preset rule, as well as the weights corresponding to the first risk probability and the preset rule. The environmental score is used to characterize the risk level of the data service.

[0030] Step 103: If the business environment data meets the preset conditions, determine the audit rules and audit parameters according to the environment score, and determine the first audit strategy based on the audit rules and audit parameters;

[0031] Step 104: Execute the first audit strategy on the data service.

[0032] Optionally, the business environment data includes at least one of the following:

[0033] Transaction records, account information, user behavior logs, customer service call records, and risk event information.

[0034] Business environment data can be collected through the data acquisition layer. This layer can collect multi-source data (i.e., business environment data) through a data collection gateway. Specifically, this can be categorized as: structured data, such as transaction logs and account information (e.g., transaction amount, time, location); unstructured data, such as user behavior logs and customer service call records; and external data, such as third-party risk events (e.g., blacklists, public opinion monitoring information).

[0035] The data acquisition layer collects various types of data from all business nodes (such as payment gateways and risk control systems) in real time. It employs streaming data processing frameworks (such as Apache Flink / Kafka distributed stream processing frameworks / platforms) to achieve low-latency data acquisition; for unstructured data, it uses Natural Language Processing (NLP) techniques to extract key information (such as abnormal keywords).

[0036] The dynamic environment awareness layer can use the Dynamic Environment Analyzer to analyze and dynamically assess current audit requirements in real time based on the collected business environment data, and output an environment score (RiskScore).

[0037] First, the raw data from the business environment is cleaned using the Data Preprocessing Module to remove noise, outliers, and redundant information. For structured data (such as transaction records), missing values ​​are handled (e.g., filled with the mean / median), and erroneous data (e.g., abnormal amounts, incorrect timestamps) is detected and corrected. For unstructured data (such as logs, text), Natural Language Processing (NLP) techniques are used for word segmentation, stop word removal, and extraction of key entities (e.g., Internet Protocol (IP) addresses, device identifiers (IDs), transaction types). For external data (such as blacklists, public opinion information), the data is formatted (e.g., standardized timestamp format), and deduplication and validity verification are performed (e.g., checking if the IP address is in the blacklist).

[0038] Secondly, the Feature Engineering Module extracts features from the raw data that have a significant impact on audit risk; these are known as risk features. Risk features may include at least one of the following:

[0039] Transaction characteristics include: transaction frequency (e.g., the number of transactions in the past 5 minutes), transaction amount distribution (e.g., the proportion of large transactions), and transaction time distribution (e.g., whether it is concentrated outside of working hours).

[0040] User behavior characteristics include: device fingerprint (such as device ID, browser fingerprint), changes in geographical location (such as logging in across regions in a short period of time), and abnormal behavior patterns (such as suddenly changing passwords or frequently changing payment methods).

[0041] External risk characteristics include: blacklist matching (e.g., whether the IP / device is on the blacklist), public opinion monitoring (e.g., whether keywords related to fraud appear), etc.

[0042] After data preprocessing and feature extraction, a multi-model fusion approach is used to calculate the environmental score (RiskScore) to improve the robustness of the assessment.

[0043] First, the Risk Prediction Engine predicts risk trends over a future period based on historical data and current characteristics.

[0044] In some implementations, models can be used to predict future risk trends based on historical risk characteristic data and currently collected risk characteristics.

[0045] In some implementations, one model is selected for prediction, or multiple models are selected for prediction from different dimensions.

[0046] Input historical transaction data (such as transaction records of the past hour), current environmental characteristics (such as real-time transaction frequency and device distribution), and external risk intelligence (such as public opinion hotspots and blacklist updates) into the model to obtain the first risk probability (0 to 1) or risk level (low / medium / high) output by the model based on the input feature information.

[0047] The Rule Decision Module performs qualitative analysis on specific scenarios based on predefined rules. The rule definitions can include:

[0048] IP risk rules state that if the same IP initiates more than 10 transactions within 5 minutes, it is marked as high risk.

[0049] Device risk rules stipulate that if a device appears for the first time and the transaction amount exceeds a threshold, secondary verification will be triggered.

[0050] Behavioral pattern rules, such as a user suddenly changing their password and making a large transfer, will mark them as suspicious.

[0051] By monitoring transaction data in real time, the features extracted from the transaction data are matched with the above predefined rules. If the match is successful, the environmental score is adjusted accordingly (such as increasing the risk weight).

[0052] The Risk Score is calculated by combining the first risk probability output by the risk prediction engine and the qualitative analysis results from the rule decision module through the Risk Score Aggregator.

[0053] In some implementations, corresponding weights can be assigned to the first risk probability and the rule, and the environmental score can be calculated based on the weights. For example, if the first risk probability output by the machine learning model in the risk prediction engine is 0.7, and the risk weight output by the rule decision module engine is +0.2, then the final score = model probability × weight coefficient (assuming it is 0.8) + rule weight, and the Risk Score = 0.7 × 0.8 + 0.2 = 0.76.

[0054] In some implementations, weighting coefficients can be optimized based on historical data (e.g., dynamically adjusted through reinforcement learning), and rule weights can be temporarily increased in extreme cases (e.g., triggered by blacklisted IP addresses). The system calculates a score at preset intervals to ensure real-time performance; if the score suddenly changes (e.g., jumps from 30 to 80), an alarm is triggered and manual review is required. Simultaneously, the environmental score combines structured data, unstructured data, and external intelligence information to improve assessment accuracy.

[0055] When business environment data meets preset conditions, such as when the change in environment score exceeds a threshold (e.g., ±10 points), when a new risk pattern is detected (e.g., abnormal transaction behavior pattern), or when external risk intelligence is updated (e.g., blacklist changes, public opinion warnings), an audit strategy adjustment is triggered. The change in environment score can be the change in the current environment score relative to the previously calculated environment score, or the change relative to the average score.

[0056] In some implementations, the policy parser module analyzes the environmental score output by the dynamic environment awareness layer, maps the score range to a risk level (e.g., 0-30 points for low risk, 31-60 points for medium risk), and determines the current risk as low / medium / high / extremely high risk. Then, combined with the rule engine and model prediction, the risk type is further refined (e.g., fraud risk, compliance risk). Audit rules are then adjusted according to the risk level.

[0057] In some implementations, audit rules and strategies (such as rule weights, sampling ratios, and model parameters) are dynamically adjusted based on environmental scores. The first step is audit rule matching, where the corresponding audit rule is selected based on the environmental score (low risk → lenient rule; high risk → strict rule). For example, when the score is greater than 80, facial recognition plus secondary SMS verification can be mandatory.

[0058] In some implementations, a rule engine is used for optimization, dynamically adjusting the priority of each rule among multiple rules (e.g., in high-risk scenarios, the priority of fraud detection rules is increased). For example, if "uncommon device + large transfer" is detected, manual review is triggered immediately. In high-risk situations, high-risk transactions are processed first, while the review of low-risk transactions is delayed.

[0059] In some implementations, model parameters are adjusted based on environmental risks or risk levels, and risk control model thresholds are adjusted (e.g., the fraud detection threshold is reduced from 0.6 to 0.4 to reduce the false negative rate). For example, in high-risk scenarios, the model sensitivity is increased.

[0060] The first audit strategy is determined by audit rules and audit parameters, and the first audit strategy is used to audit data services.

[0061] This application embodiment collects multi-source data (transaction data, user behavior, and external risk intelligence) in real time and dynamically evaluates audit requirements based on machine learning models (such as Long Short-Term Memory (LSTM) and Extreme Gradient Boosting (XGBoost)) to output an environment score (RiskScore). A multi-source data fusion mechanism is employed to integrate structured data (transaction records), unstructured data (logs, text), and external risk intelligence, improving the comprehensiveness of the environment score. By dynamically updating the environment score, the current business risk level is dynamically reflected, and algorithms such as LSTM / XGBoost are used to predict risk trends, enabling the system to flexibly respond to sudden risks (such as escalating fraud methods or drastic changes in transaction volume), significantly improving risk control efficiency.

[0062] Optionally, before determining the first audit strategy based on the audit rules and the audit parameters, the method further includes:

[0063] Obtain the execution results of historical audit strategies, wherein the execution results include at least one of environmental score, audit rules, and audit accuracy rate;

[0064] The execution result is input into the first model, and the first strategy parameter of the historical audit strategy is adjusted with at least one of audit accuracy, processing efficiency and user complaint rate as the optimization objective to obtain the second strategy parameter output by the first model. The first strategy parameter and the second strategy parameter include at least one of audit rule weights, risk identification model parameters and sampling strategy.

[0065] The step of determining the first audit strategy based on the audit rules and the audit parameters includes:

[0066] The first audit strategy is determined based on the audit rules, the audit parameters, and the second strategy parameters.

[0067] By using a reinforcement learning optimizer (RL optimizer) to dynamically adjust the system's decision-making logic based on the execution results of historical audit strategies (i.e., the second audit strategy), continuous self-optimization is achieved. The implementation process is as follows:

[0068] State definition: The system encodes the current environmental features into a reinforcement learning state vector, which includes three key dimensions: environmental score, audit rule matching result, and audit accuracy (the proportion of violations confirmed by recent manual review).

[0069] Actions: Dynamically adjust (increase / decrease) the weight of specific audit rules, switch risk identification model parameters (e.g., select different versions of risk identification models), and modify sampling strategies (change the sampling ratio of audit samples).

[0070] Reward function: Quantifies the immediate reward of an action using a multi-objective weighted function, encouraging long-term optimal strategies. The reward function is as follows: .

[0071] Among them, audit accuracy rate: the proportion of violations confirmed in newly reviewed cases after the action is executed;

[0072] Processing efficiency is the change in the number of samples processed per unit of time.

[0073] The user complaint rate (Complaint) is the percentage of complaints caused by misjudgment.

[0074] Using the above-mentioned indicator optimization strategy, the weights can be defined or adjusted according to the actual business situation.

[0075] It adopts a hybrid mode of offline training (historical data: such as audit strategy logs from the past 3 months) and online learning (real-time feedback: such as fine-tuning the strategy every 100 audit results).

[0076] Based on environmental scoring, audit strategies are dynamically adjusted, including rule priority, model parameters, and resource allocation, and reinforcement learning is introduced to optimize strategy selection. Rule weights are automatically adjusted according to environmental scores (e.g., increasing biometric verification thresholds for high-risk scenarios), AI model parameters are dynamically adjusted to lower risk control model thresholds (e.g., reducing the fraud detection threshold from 0.6 to 0.4, lowering the false negative rate), and resources are adaptively scheduled, prioritizing high-risk transactions and delaying the review of low-risk transactions to improve the smoothness of critical business operations. This ensures that audit strategies match business needs in real time, reducing false positives and false negatives and improving the overall accuracy of the system.

[0077] The above process can be executed through an adaptive decision engine. The adaptive decision engine is responsible for dynamically adjusting the audit strategy based on the risk score provided by the dynamic environment awareness layer, ensuring that the audit system can adapt to constantly changing business environments and risk conditions. This engine employs a multi-layered decision-making mechanism combining a rule engine, a machine learning model, and reinforcement learning optimization, enabling it to automatically select the optimal audit strategy under different risk levels, thereby improving audit efficiency and accuracy.

[0078] The adaptive decision engine consists of five core modules: ① a rule repository responsible for storing predefined audit rules, such as transaction limits and identity verification requirements; ② a model repository responsible for storing artificial intelligence (AI) models used for risk prediction, such as XGBoost and LSTM; ③ a reinforcement learning optimizer that dynamically optimizes decision logic based on historical policy performance; ④ a policy execution scheduler responsible for distributing the adjusted policies to the audit execution layer; and ⑤ an A / B testing framework that verifies the effectiveness of new policies and ensures the optimization direction is correct.

[0079] In some implementations, by inputting an environment score (Risk Score) provided by the dynamic environment awareness layer, real-time transaction data, and historical audit records, the rule engine matches applicable rules based on the environment score, the machine learning model predicts risk trends to assist decision-making, and the reinforcement learning module optimizes strategy selection based on feedback. Finally, the dynamically adjusted audit strategy (such as rule weights, sampling ratios, and model parameters) is output and sent to the audit execution layer.

[0080] Through multi-strategy parallel computing, the rule engine quickly responds to known risks, uses AI models to handle complex scenarios, and leverages computational environment scoring to flexibly adjust the execution priority of rules and models.

[0081] Optionally, calculating the first risk probability of the data service based on the risk characteristics includes:

[0082] Historical transaction data, business environment data, and risk event information are input into multiple models, and the predicted risk probabilities output by the multiple models are obtained. The multiple models are used to output different types of risk probabilities based on different types of risk characteristics.

[0083] The first risk probability of the data service is determined based on the predicted risk probabilities output by the multiple models and the weights corresponding to the multiple models.

[0084] Multiple models can include: supervised learning models (such as XGBoost and Lightweight Gradient Boosting Machine (LightGBM)), which are suitable for labeled data and can predict the probability of transaction fraud; time series models (such as LSTM and Gated Recurrent Unit (GRU)), which are suitable for analyzing the time-varying trends of transaction flow; and unsupervised learning models (such as Isolation Forest and Autoencoder), which are suitable for detecting abnormal behavior (such as sudden high-frequency trading).

[0085] In some implementations, XGBoost / LSTM can be used to predict risk trends. For example, if the model predicts an increase in fraud risk over the next 10 minutes, the environmental score can be improved.

[0086] In some implementations, the XGBoost fraud risk probability is used: P XGBoost=

[0087] Among them, P XGBoost Indicates the probability of fraud risk. This represents the predicted risk probability for each decision tree. The fraud risk probability is obtained through weighted voting (logistic regression transformation) of multiple decision trees.

[0088] In some implementations, the LSTM model performs temporal modeling, controlling the flow of information through input gates, forget gates, and output gates. The memory state equals the forgotten old information plus the remembered new information, and finally outputs the fraud probability P. LSTM :

[0089] P LSTM =δ(A×γ), where A represents the hidden state and γ represents the weight. The sigmoid function is used to convert the hidden state of the LSTM at the last time step into a probability.

[0090] Since LSTM focuses on temporal data and XGBoost focuses on static features, the fraud probability of the two models is calculated by weighted averaging of the weights of each model to obtain the final predicted risk probability. If the predicted risk probability indicates high risk, the validation is strengthened; if the predicted risk probability indicates low risk, the validation is relaxed.

[0091] Optionally, determining the audit rules and audit parameters based on the environmental score includes:

[0092] Based on the environmental score, multiple audit rules are determined, and the priority of the multiple audit rules is determined.

[0093] The business environment data and the environment score are input into the risk identification model to obtain the audit parameters output by the risk identification model.

[0094] In some implementations, a rule matching engine selects multiple applicable audit rules based on environmental scores or risk levels and dynamically adjusts the priority of these rules. For example, in low-risk scenarios, only basic information is checked, reducing verification intensity and increasing throughput; in high-risk scenarios, strict rules can be enabled to enforce facial recognition and secondary SMS verification.

[0095] In some implementations, audit parameters are dynamically adjusted based on the first risk probability predicted by a machine learning model using a model inference module. Audit parameters may include: transaction sampling ratios (e.g., increasing the full audit transaction sampling ratio in high-risk scenarios from 10% to 100%); model thresholds (e.g., lowering the fraud detection threshold from 0.6 to 0.4 in a risk control model to reduce the false negative rate); and resource allocation priorities (prioritizing high-risk transactions and delaying the review of low-risk transactions).

[0096] Optionally, executing the first audit strategy on the data service includes:

[0097] Obtain the corresponding audit rule set according to the first audit strategy, and check whether the data service conforms to the audit rules in the audit rule set;

[0098] If the data service conforms to the audit rules in the audit rule set, a second risk probability is determined based on the transaction characteristics of the data service to indicate that the data service has a target risk.

[0099] If the second risk probability is greater than a preset threshold, an audit prompt message is sent to the first device to prompt the user corresponding to the first device to audit the data service.

[0100] The first audit strategy is executed through the audit task execution layer. This layer is responsible for performing real-time or batch audits of transaction data based on the first audit strategy, which is dynamically adjusted by the adaptive decision engine, and outputting the audit results. This module needs to have high concurrency processing capabilities, dynamic strategy adaptation capabilities, and anomaly detection and alerting capabilities to ensure the efficiency and accuracy of the audit process.

[0101] The audit task execution layer includes:

[0102] Task Scheduler: Responsible for receiving the first audit strategy issued by the adaptive decision engine and allocating audit tasks;

[0103] Rule Execution Engine: Executes static rules (such as transaction limits and identity verification).

[0104] AI Inference Module: Runs machine learning models (such as fraud detection models);

[0105] Data Validation Module: Verifies the integrity and legality of transaction data;

[0106] Anomaly Handling Module: Detects abnormal transactions and triggers alarms;

[0107] Result Storage & Feedback Module: Stores audit results and feeds them back to the decision engine to optimize strategies.

[0108] At the audit task execution layer, dynamic strategies (such as rule weights and sampling ratios) issued by the adaptive decision engine are input. Tasks are allocated through the task scheduler, the rule engine executes static rules, the AI ​​model inference module runs the dynamic model, the data verification module validates the data, and the anomaly handling module detects risks. Audit results (pass / reject / requires manual review) are output and stored in a database or message queue for subsequent analysis. The task execution flow is as follows:

[0109] (1) Task reception and initialization.

[0110] The Task Scheduler receives the first audit strategy from the adaptive decision engine and initializes the audit tasks. It first parses the dynamic strategy, such as rule weights, sampling ratios, and model versions. Then, it allocates tasks to different audit queues based on transaction type (e.g., payment, transfer, withdrawal). During resource allocation, it dynamically adjusts computing resources (e.g., Central Processing Unit (CPU), memory, and Graphics Processing Unit (GPU)) to ensure processing capacity under high concurrency.

[0111] (2) Data preprocessing.

[0112] The data preprocessing module cleans, standardizes, and extracts features from the transaction data. Data cleaning mainly removes invalid data (such as null values ​​and incorrect formats). Then, key features (such as transaction amount, time, location, and device fingerprint) are extracted. Finally, abnormal data is corrected (such as IP address standardization and timestamp formatting).

[0113] (3) Rule engine execution.

[0114] The Rule Execution Engine executes static rules (such as transaction limits and identity verification). First, rule matching is performed, loading the corresponding audit rule set based on the policy (e.g., mandatory facial recognition for high-risk transactions). Then, rule execution is performed, checking each transaction against the audit rules in the set (e.g., whether the transaction amount exceeds the limit). Finally, the result is determined; if the rule fails, it is marked as "rejected" and the subsequent process terminates; if it succeeds, the process proceeds to the AI ​​model inference stage.

[0115] (4) AI model reasoning.

[0116] The AI ​​Inference Module executes machine learning models (such as fraud detection models) to perform real-time risk scoring. The system selects an appropriate model version based on the strategy (e.g., XGBoost for structured feature analysis, LSTM for handling time-series transaction behavior), inputs transaction features (such as amount, geographical location, and user history), calculates the fraud probability (i.e., the probability of a second risk posing the target risk) (a standardized score of 0-1). If the fraud probability exceeds a preset threshold (e.g., 0.7), it is marked as "high risk" and triggers manual review.

[0117] During the policy distribution and execution phase, the optimized policy is synchronized to the audit execution layer through the Policy Execution Scheduler, and the execution effect is monitored. Policy updates are pushed through a message queue (such as Kafka), first testing the new policy on a small scale, and then gradually promoting it to all systems. The effects of the new and old policies are compared (A / B testing) to select the better solution.

[0118] Let's take the interception of high-risk transactions as an example.

[0119] Scenario: A user's IP address is marked as high-risk, with an environment score of 85.

[0120] Decision-making process:

[0121] The rules engine triggers mandatory face recognition;

[0122] The model predicts a 90% probability of fraud in this transaction.

[0123] The reinforcement learning module decided to freeze the account and issue an alert immediately.

[0124] The strategy execution layer immediately intercepts the transaction and notifies a human reviewer.

[0125] Optionally, the method further includes:

[0126] Perform at least one of the following verification operations on the data service, and output the audit result based on the verification operation:

[0127] Verify whether the transaction amount corresponding to the data service meets the preset conditions;

[0128] The identity of the user processing the data service is verified;

[0129] Verify whether the data service exhibits any abnormal behavior.

[0130] The data validation module and the anomaly handling module are used to verify the legality of transaction data (i.e., data business) and detect abnormal behavior.

[0131] Specifically, the following verification can be performed:

[0132] Check whether the transaction amount meets the preset conditions (such as whether a single transfer exceeds the account balance);

[0133] Verify user identity information (such as whether the ID number and mobile phone number match).

[0134] The rule engine is used to detect anomalies (such as multiple large transfers in a short period of time), and AI models are combined to identify new fraud patterns (using unsupervised learning (such as isolation forest, clustering); detecting unknown fraud patterns (such as money laundering features of dispersed transfers in and concentrated transfers out); and combining supervised models (such as gradient boosting decision tree (GBDT) and graph neural networks) to predict new fraud behaviors (such as the network of linked accounts in social engineering fraud)).

[0135] The Result Storage & Feedback Module stores audit results and feeds them back to the decision engine to optimize strategies. First, results are stored by writing the audit results (pass / reject / requires manual review) to the database. Then, abnormal transaction data is fed back to the knowledge base for optimizing rules and models. If a high-risk transaction is detected, an alert is triggered (e.g., SMS or email notification).

[0136] The knowledge base and model library are stored by the Knowledge Manager module, which stores historical audit rules, machine learning models, and external risk intelligence. During system initialization and policy updates, version control is used to manage rules and models to ensure traceability, support online model updates (such as hot deployment of new version risk control models), and regularly clean up expired data to optimize storage efficiency.

[0137] As a specific embodiment of this application, such as Figure 2 As shown, the business audit method includes the following steps:

[0138] Step 1: The data acquisition layer is responsible for collecting business environment data.

[0139] It can obtain transaction records (such as amount, time, location, device information) and account information from payment gateways and banking systems; user behavior logs: record user operation logs (login IP, device fingerprint, behavior sequence); external risk events: access third-party blacklists and public opinion monitoring data; it can also obtain relevant information such as customer service call records.

[0140] Step 2: The dynamic environment awareness layer is responsible for analyzing the current business environment and assessing audit requirements.

[0141] The main function of the dynamic environment awareness layer is to analyze the current business environment, dynamically assess audit requirements, and output an environment score (Risk Score). This layer mainly includes four key modules: "data preprocessing," "machine learning model prediction," "rule engine analysis," and "multi-source data fusion." The "data preprocessing" part mainly cleans the raw data (denoising and imputing missing values) and extracts key features (such as transaction frequency and equipment risk level); the machine learning model prediction module uses XGBoost / LSTM to predict risk trends, and the "rule engine analysis" module performs qualitative analysis based on predefined rules.

[0142] Step 3: The adaptive decision engine is responsible for dynamically adjusting the audit strategy.

[0143] The adaptive decision engine dynamically adjusts audit strategies (such as rule weights, sampling ratios, and model parameters) based on environmental scores.

[0144] The first step is strategy matching. Based on the environmental score, the corresponding strategy is selected (low risk → lenient strategy; high risk → strict strategy). For example, when the score is greater than 80, facial recognition + secondary SMS verification can be mandatory.

[0145] Secondly, the rules engine is optimized, and the priority of rules is dynamically adjusted (such as increasing the priority of fraud detection rules in high-risk scenarios). For example, if "uncommon device + large amount of transfer" is detected, manual review is triggered immediately.

[0146] Next comes model parameter adjustment, including adjusting risk control model thresholds (e.g., lowering the fraud detection threshold from 0.6 to 0.4 to reduce the false negative rate). For example, in high-risk scenarios, the model's sensitivity is increased. Finally, resources are dynamically allocated; in high-risk situations, high-risk transactions are processed first, while the review of low-risk transactions is delayed.

[0147] Step 4: The audit execution layer is responsible for carrying out audit tasks and providing feedback on the results.

[0148] The audit task execution layer is used to execute dynamically adjusted audit strategies, including rule verification, AI model inference, and data validation. Specifically, audit tasks are first assigned; for example, high-risk transactions enter the "emergency audit queue," and low-risk transactions enter the "batch processing queue." Then, static rules (such as transaction limits and identity verification) are executed; for example, if the transaction amount exceeds a target value, manual review is triggered. After executing static rules, a machine learning model (such as a fraud detection model) is run to calculate a risk score. If the model predicts a fraud probability greater than a preset value, the transaction can be directly rejected. Transaction data is validated, checking for completeness (such as whether required fields are missing). If abnormal transactions are detected (such as multiple large transfers within a short period), an alarm is triggered (which can freeze the account). Finally, the audit results (pass / reject / require manual review) are stored in the database and fed back to the decision engine.

[0149] Step 5: Store historical audit rules, machine learning models, and external risk intelligence through a knowledge base and model library.

[0150] The execution results of audit strategies can serve as input for the model, continuously optimizing rules and the model to improve system intelligence. Optimization mechanisms include: rule optimization, analyzing historical audit data to identify false positive / false negative patterns and optimize rule logic (e.g., if a rule causes a large number of legitimate transactions to be falsely rejected, its priority is lowered); model retraining, periodically retraining the AI ​​model with new data to improve prediction accuracy (e.g., updating the fraud detection model monthly to adapt to new fraud methods); and A / B testing, comparing the effects of different strategies and selecting the optimal solution (e.g., testing "forced facial recognition" and "SMS verification" to select the solution with a lower false positive rate). Through these methods, a closed loop of "perception → decision → execution → feedback" is formed, adapting to constantly changing fraud methods and business needs, and avoiding risk control failures caused by rigid rules.

[0151] This application employs a multi-source data fusion method to collect transaction data, user behavior logs, and external risk intelligence (such as blacklists and public opinion monitoring) in real time, constructing a comprehensive perception data source. Through machine learning-driven risk scoring, models such as LSTM / XGBoost are used to predict risk trends, dynamically calculating and updating the environment score in real time. NLP analysis of abnormal keywords and device fingerprinting are used to promptly identify potential risks. Rules no longer rely on human experience but are dynamically adjusted based on data priority (e.g., requiring two-factor authentication for high-risk transactions and simplifying processes for low-risk transactions). When encountering fraudsters switching IP addresses to launch attacks, the system can quickly identify new risk patterns and adjust its strategies accordingly.

[0152] The rules are weighted according to environmental scoring, such as increasing the biometric verification threshold during high-risk periods. Risk control model thresholds are dynamically modified using AI models, prioritizing high-risk transactions and delaying the review of low-risk transactions to ensure the smooth operation of critical business. High-risk transactions are precisely blocked, while normal transactions are not excessively affected. Rules and models are automatically optimized, reducing the frequency of manual adjustments.

[0153] Optimization is achieved through A / B testing, which compares the effects of different rule combinations to automatically select the optimal solution. Simultaneously, the AI ​​model is periodically retrained with new data to improve prediction accuracy. By analyzing anomalies and based on historical audit data, rule vulnerabilities are automatically identified and optimized. Continuous improvement of strategies and models adapts to new risks, avoiding outdated technology and enabling data-driven optimization rather than manual adjustments, thus reducing manual parameter tuning costs.

[0154] Multi-strategy collaborative processing improves system throughput. Driven by a dual-engine approach combining a rules engine and an AI model, the rules engine rapidly responds to known risks, while the AI ​​model handles complex scenarios. This collaborative approach prioritizes high-risk transactions and delays the review of low-risk transactions, thereby enhancing system performance.

[0155] See Figure 3 , Figure 3 This is a schematic diagram of the structure of a business audit device provided in an embodiment of this application, as shown below. Figure 3 As shown, the business audit device 300 includes:

[0156] The acquisition module 301 is used to acquire business environment data during the data service processing, extract risk features based on the business environment data, and calculate the first risk probability of the data service based on the risk features. The risk features are used to characterize the existence of risks in the data service.

[0157] The first determining module 302 is used to determine an environmental score based on the first risk probability and the preset rules, as well as the weights corresponding to the first risk probability and the preset rules. The environmental score is used to characterize the risk level of the data service.

[0158] The second determining module 303 is used to determine audit rules and audit parameters based on the environment score when the business environment data meets the preset conditions, and to determine a first audit strategy based on the audit rules and audit parameters.

[0159] The first execution module 304 is used to execute the first audit strategy on the data service.

[0160] Optionally, the device further includes:

[0161] The acquisition module is used to acquire the execution results of historical audit strategies, and the execution results include at least one of environmental score, audit rules, and audit accuracy rate;

[0162] The adjustment module is used to input the execution result into the first model and adjust the first strategy parameters of the historical audit strategy with at least one of audit accuracy, processing efficiency and user complaint rate as optimization objectives to obtain the second strategy parameters output by the first model. The first strategy parameters and the second strategy parameters include at least one of audit rule weights, risk identification model parameters and sampling strategies.

[0163] The second determining module is specifically used for:

[0164] The first audit strategy is determined based on the audit rules, the audit parameters, and the second strategy parameters.

[0165] Optionally, the acquisition module is specifically used for:

[0166] Historical transaction data, business environment data, and risk event information are input into multiple models, and the predicted risk probabilities output by the multiple models are obtained. The multiple models are used to output different types of risk probabilities based on different types of risk characteristics.

[0167] The first risk probability of the data service is determined based on the predicted risk probabilities output by the multiple models and the weights corresponding to the multiple models.

[0168] Optionally, the second determining module is specifically used for:

[0169] Based on the environmental score, multiple audit rules are determined, and the priority of the multiple audit rules is determined.

[0170] The business environment data and the environment score are input into the risk identification model to obtain the audit parameters output by the risk identification model.

[0171] Optionally, the first execution module is specifically used for:

[0172] Obtain the corresponding audit rule set according to the first audit strategy, and check whether the data service conforms to the audit rules in the audit rule set;

[0173] If the data service conforms to the audit rules in the audit rule set, a second risk probability is determined based on the transaction characteristics of the data service to indicate that the data service has a target risk.

[0174] If the second risk probability is greater than a preset threshold, an audit prompt message is sent to the first device to prompt the user corresponding to the first device to audit the data service.

[0175] Optionally, the device further includes:

[0176] The second execution module is used to perform at least one of the following verification operations on the data service, and output the audit result based on the verification operation:

[0177] Verify whether the transaction amount corresponding to the data service meets the preset conditions;

[0178] The identity of the user processing the data service is verified;

[0179] Verify whether the data service exhibits any abnormal behavior.

[0180] Optionally, the business environment data includes at least one of the following:

[0181] Transaction records, account information, user behavior logs, customer service call records, and risk event information.

[0182] Business auditing devices can achieve Figure 1 The various processes implemented in the method embodiments can achieve the same technical effect, and will not be described again here to avoid repetition.

[0183] It should be noted that the electronic device provided in this application embodiment is a device capable of executing the above-described business audit method. Therefore, all implementation methods in the above-described business audit method embodiments are applicable to this electronic device and can achieve the same or similar beneficial effects. To avoid repetition, this embodiment will not elaborate further.

[0184] See Figure 4As shown in the figure, this application embodiment also provides an electronic device, including a bus 601, a transceiver 602, an antenna 603, a bus interface 604, a processor 605, and a memory 606.

[0185] Processor 605, used for:

[0186] Collect business environment data during the data service processing, extract risk features based on the business environment data, and calculate the first risk probability of the data service based on the risk features. The risk features are used to characterize the existence of risks in the data service.

[0187] An environmental score is determined based on the first risk probability and the preset rules, as well as the weights corresponding to the first risk probability and the preset rules. The environmental score is used to characterize the risk level of the data service.

[0188] If the business environment data meets the preset conditions, the audit rules and audit parameters are determined according to the environment score, and the first audit strategy is determined based on the audit rules and the audit parameters.

[0189] The first audit strategy is executed on the data service.

[0190] exist Figure 4 In this document, a bus architecture (represented by bus 601) is used. Bus 601 may include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 605 and memory represented by memory 606. Bus 601 may also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 604 provides an interface between bus 601 and transceiver 602. Transceiver 602 may be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 605 is transmitted over a wireless medium via antenna 603, which further receives data and transmits data to processor 605.

[0191] Processor 605 manages bus 601 and general processing, and also provides various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 606 can be used to store data used by processor 605 during operation.

[0192] Alternatively, the processor 605 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD).

[0193] Optionally, before executing the determination of the first audit strategy based on the audit rules and the audit parameters, the processor 605 is further configured to execute:

[0194] Obtain the execution results of historical audit strategies, wherein the execution results include at least one of environmental score, audit rules, and audit accuracy rate;

[0195] The execution result is input into the first model, and the first strategy parameter of the historical audit strategy is adjusted with at least one of audit accuracy, processing efficiency and user complaint rate as the optimization objective to obtain the second strategy parameter output by the first model. The first strategy parameter and the second strategy parameter include at least one of audit rule weights, risk identification model parameters and sampling strategy.

[0196] The step of determining the first audit strategy based on the audit rules and the audit parameters includes:

[0197] The first audit strategy is determined based on the audit rules, the audit parameters, and the second strategy parameters.

[0198] Optionally, the processor 605 performs the calculation of the first risk probability of the data service based on the risk characteristics, including:

[0199] Historical transaction data, business environment data, and risk event information are input into multiple models, and the predicted risk probabilities output by the multiple models are obtained. The multiple models are used to output different types of risk probabilities based on different types of risk characteristics.

[0200] The first risk probability of the data service is determined based on the predicted risk probabilities output by the multiple models and the weights corresponding to the multiple models.

[0201] Optionally, the processor 605 executes the process of determining audit rules and audit parameters based on the environmental score, including:

[0202] Based on the environmental score, multiple audit rules are determined, and the priority of the multiple audit rules is determined.

[0203] The business environment data and the environment score are input into the risk identification model to obtain the audit parameters output by the risk identification model.

[0204] Optionally, the processor 605 executes the first audit policy on the data service, including:

[0205] Obtain the corresponding audit rule set according to the first audit strategy, and check whether the data service conforms to the audit rules in the audit rule set;

[0206] If the data service conforms to the audit rules in the audit rule set, a second risk probability is determined based on the transaction characteristics of the data service to indicate that the data service has a target risk.

[0207] If the second risk probability is greater than a preset threshold, an audit prompt message is sent to the first device to prompt the user corresponding to the first device to audit the data service.

[0208] Optionally, the processor 605 is also used to perform:

[0209] Perform at least one of the following verification operations on the data service, and output the audit result based on the verification operation:

[0210] Verify whether the transaction amount corresponding to the data service meets the preset conditions;

[0211] The identity of the user processing the data service is verified;

[0212] Verify whether the data service exhibits any abnormal behavior.

[0213] Optionally, the business environment data includes at least one of the following:

[0214] Transaction records, account information, user behavior logs, customer service call records, and risk event information.

[0215] It should be noted that the electronic device provided in this application embodiment is a device capable of executing the above-described business audit method. Therefore, all implementation methods in the above-described business audit method embodiments are applicable to this electronic device and can achieve the same or similar beneficial effects. To avoid repetition, this embodiment will not elaborate further.

[0216] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described business audit method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0217] This application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above-described... Figure 1 The various processes of the method embodiments shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0218] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0219] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0220] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A business auditing method, characterized in that, include: Collect business environment data during the data service processing, extract risk features based on the business environment data, and calculate the first risk probability of the data service based on the risk features. The risk features are used to characterize the existence of risks in the data service. An environmental score is determined based on the first risk probability and the preset rules, as well as the weights corresponding to the first risk probability and the preset rules. The environmental score is used to characterize the risk level of the data service. If the business environment data meets the preset conditions, the audit rules and audit parameters are determined according to the environment score, and the first audit strategy is determined based on the audit rules and the audit parameters. The first audit strategy is executed on the data service.

2. The method according to claim 1, characterized in that, Before determining the first audit strategy based on the audit rules and the audit parameters, the method further includes: Obtain the execution results of historical audit strategies, wherein the execution results include at least one of environmental score, audit rules, and audit accuracy rate; The execution result is input into the first model, and the first strategy parameter of the historical audit strategy is adjusted with at least one of audit accuracy, processing efficiency and user complaint rate as the optimization objective to obtain the second strategy parameter output by the first model. The first strategy parameter and the second strategy parameter include at least one of audit rule weights, risk identification model parameters and sampling strategy. The step of determining the first audit strategy based on the audit rules and the audit parameters includes: The first audit strategy is determined based on the audit rules, the audit parameters, and the second strategy parameters.

3. The method according to claim 1, characterized in that, The calculation of the first risk probability of the data service based on the risk characteristics includes: Historical transaction data, business environment data, and risk event information are input into multiple models, and the predicted risk probabilities output by the multiple models are obtained. The multiple models are used to output different types of risk probabilities based on different types of risk characteristics. The first risk probability of the data service is determined based on the predicted risk probabilities output by the multiple models and the weights corresponding to the multiple models.

4. The method according to claim 1, characterized in that, The process of determining audit rules and audit parameters based on the environmental score includes: Based on the environmental score, multiple audit rules are determined, and the priority of the multiple audit rules is determined. The business environment data and the environment score are input into the risk identification model to obtain the audit parameters output by the risk identification model.

5. The method according to any one of claims 1 to 4, characterized in that, The execution of the first audit strategy on the data service includes: Obtain the corresponding audit rule set according to the first audit strategy, and check whether the data service conforms to the audit rules in the audit rule set; If the data service conforms to the audit rules in the audit rule set, a second risk probability is determined based on the transaction characteristics of the data service to indicate that the data service has a target risk. If the second risk probability is greater than a preset threshold, an audit prompt message is sent to the first device to prompt the user corresponding to the first device to audit the data service.

6. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Perform at least one of the following verification operations on the data service, and output the audit result based on the verification operation: Verify whether the transaction amount corresponding to the data service meets the preset conditions; The identity of the user processing the data service is verified; Verify whether the data service exhibits any abnormal behavior.

7. The method according to any one of claims 1 to 4, characterized in that, The business environment data includes at least one of the following: Transaction records, account information, user behavior logs, customer service call records, and risk event information.

8. A business auditing device, characterized in that, include: The data acquisition module is used to collect business environment data during the data service processing, extract risk features based on the business environment data, and calculate the first risk probability of the data service based on the risk features. The risk features are used to characterize the existence of risks in the data service. The first determining module is used to determine an environmental score based on the first risk probability and a preset rule, as well as the weights corresponding to the first risk probability and the preset rule. The environmental score is used to characterize the risk level of the data service. The second determining module is used to determine audit rules and audit parameters based on the environment score when the business environment data meets preset conditions, and to determine a first audit strategy based on the audit rules and audit parameters. The first execution module is used to execute the first audit strategy on the data service.

9. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the business audit method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the business audit method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the business audit method as described in any one of claims 1 to 7.

Images