Machine learning and expert rule fused anti-fraud method and system for public account

Abstract

The invention discloses a machine learning and expert rule fused anti-fraud method and system for a public account. The method comprises the steps of obtaining multi-source heterogeneous data and performing feature extraction; based on the risk feature wide table, performing feature optimization by adopting a dual-stage feature screening algorithm; a mixed risk assessment framework is constructed, the optimized features are converted into a scoring system rule and a triggering system rule, the scoring system rule calculates a dynamic risk score through multi-dimensional risk feature weighting, and the triggering system rule sets an instant early warning threshold value for the high-risk features; and dynamically adjusting rule parameters in the hybrid risk assessment architecture according to a regional risk portrait, matching a regional risk mode through a localized feature library, automatically updating a score weight and a trigger condition, and forming a closed-loop iteration rule system adapted to risk features of different regions or industries. According to the method, the precision and the real-time performance of anti-fraud detection of the public account can be remarkably improved, rapid evolution of fraud means can be effectively dealt with, the false alarm rate is reduced, and the risk scene coverage range is expanded.

Description

Technical Field

[0001] This invention relates to the field of intelligent risk control model technology that integrates machine learning and expert rules, and in particular to a method and system for anti-fraud of corporate accounts that integrates machine learning and expert rules. Background Technology

[0002] With the number of telecommunications and online fraud cases continuing to rise, banking and financial institutions are facing severe challenges. Criminals are increasingly turning to corporate accounts for their crimes, as these accounts are more deceptive, involve larger transaction amounts, and have more complex financial chains, increasing the difficulty of investigation. To address this trend, banking and financial institutions are implementing in-depth anti-telecom fraud measures, strengthening risk control and early warning management, and improving the timeliness and effectiveness of in-process rule models, which have become key strategies.

[0003] Expert Rule Models: Currently, the industry widely adopts expert rule models to address the challenges of combating telecom fraud involving corporate accounts. These models are based on in-depth business understanding and historical case analysis, extracting a series of risk characteristics and behavioral patterns, and then converting them into specific rules. These rules cover various abnormal transaction patterns, from small-amount tests through special channels and at special times to small-amount tests before transitioning funds. Through a combination of indicators, operators, thresholds, and logical relationships, these rules form a risk monitoring system capable of quickly identifying potential telecom fraud risks when transactions occur.

[0004] Optimization of Scoring-Based Rules: While traditional trigger-based rule models offer immediate responses, they suffer from limitations in flexibility and coverage. To address this, some banks are beginning to transform their rule models into scoring-based systems, converting single-rule trigger-based alerts into alerts based on cumulative risk scores. This approach allows banks to flexibly adjust the rule's control and coverage by modifying the alert scoring threshold, while also reducing the need for frequent rule maintenance. Scoring-based rules improve the ability to identify complex telecom fraud by capturing the cumulative effect of multiple anomalous features, but they also require more refined rule design to adapt to the rapid evolution of fraud methods.

[0005] Construction and Optimization of the Scoring System Rule Model: The closest technical solution to this model is an anti-telecom fraud solution that integrates a scoring system rule model. It first extracts a series of risk indicators through case characterization, feature ruleization, and rule indexing. Then, these indicators are integrated into the scoring system rules, and by setting reasonable weights and thresholds, a quantitative assessment of account risk is achieved. Compared to simple trigger-based rules, the scoring system model can better reflect the complexity and dynamism of risk, and is particularly suitable for scenarios such as unit accounts with diverse transaction patterns and intertwined risk characteristics.

[0006] At the implementation level, the scheme emphasizes the continuous expansion and optimization of the rule base, aiming to enhance the model's adaptability and predictive accuracy by constantly absorbing newly emerging telecom fraud methods and risk characteristics. Simultaneously, it proposes the concept of risk delay retention, meaning that once an account triggers a rule, even if it is not triggered again subsequently, the rule's impact will persist for a certain period, thus compensating for the risk inertia that trigger-based rules may easily overlook.

[0007] Existing technologies have the following drawbacks: Insufficient accuracy in identifying risky transactions: Traditional systems rely on simple rules or thresholds, leading to high false alarm rates and misclassifying normal transactions as suspicious. Difficulty in quickly adapting to new fraud patterns: Criminal methods change frequently, and static rule systems require manual intervention for updates, failing to respond promptly to emerging fraud trends. Limited coverage of risk scenarios: Older models may not fully cover complex money laundering and other risk scenarios conducted through corporate accounts. Insufficient integration of localized risk features: Existing models lack customization based on regional risk profiles, ignoring unique local fraud behaviors and reducing monitoring effectiveness. Difficulty in balancing accuracy and coverage: Traditional methods struggle to achieve both high accuracy (low false alarms) and broad coverage (high fraud detection), easily resulting in missed detections or excessive invalid investigations. Rule optimization relies on manual intervention: Rule adjustments require significant professional manpower, limiting the scalability and efficiency of model maintenance. Summary of the Invention

[0008] The main objective of this invention is to provide a method for combating fraud in corporate accounts that integrates machine learning and expert rules. By enhancing detection capabilities, reducing customer interference, expanding coverage and adaptability, optimizing the rule system, integrating multi-source data, improving processing efficiency, and supporting localized analysis, this method aims to overcome the limitations of existing technologies.

[0009] Another objective of this invention is to propose an anti-fraud system for corporate accounts that integrates machine learning and expert rules.

[0010] To achieve the above objectives, a first aspect of the present invention proposes a method for combating fraud in corporate accounts that integrates machine learning and expert rules, comprising: S1. Acquire multi-source heterogeneous data and extract features. The multi-source heterogeneous data includes regulatory laws and regulations, media reports, black sample transaction records and branch feedback information. Generate a risk feature wide table through data cleaning, format standardization and business logic verification. S2, based on the aforementioned risk feature wide table, a two-stage feature selection algorithm is used for feature optimization. The two-stage feature selection algorithm includes: in the first stage, data is processed in blocks and redundant features are iteratively eliminated through a dynamic resource allocation strategy; in the second stage, multiple feature importance evaluation methods are integrated to calculate feature contribution and retain the Top N high-value features. S3. Construct a hybrid risk assessment architecture, which transforms the optimized features into scoring rules and triggering rules. The scoring rules calculate dynamic risk scores by weighting multi-dimensional risk features, and the triggering rules set real-time warning thresholds for high-risk features, thereby achieving synergy between quantitative risk assessment and real-time interception of key features. S4. Based on the regional risk profile, the rule parameters in the hybrid risk assessment architecture are dynamically adjusted. By matching regional risk patterns through a localized feature library, the scoring weights and triggering conditions are automatically updated to form a closed-loop iterative rule system that adapts to the risk characteristics of different regions or industries.

[0011] In one embodiment of the present invention, step S2, based on the risk feature wide table, employs a two-stage feature selection algorithm for feature optimization, and further includes: S21, the risk feature wide table is divided into Each data block contains [number] data blocks. 1 sample, of which The total number of samples, Hyperparameters for controlling block granularity; S22 eliminates features through multiple rounds of iteration, randomly selecting features in each iteration. Each data block is evaluated, and the top 50% of features are retained for the next iteration until a feature set with positive incremental value scores is output.

[0012] In one embodiment of the present invention, the S3 construction of the hybrid risk assessment architecture further includes: S31, the scoring system rules are calculated using a formula. The rules are scored, among which The number of iterations for ranking importance evaluation. For the first Predicted value after randomly arranging 10 feature values; S32, the triggering rule sets a risk delay retention algorithm for high-risk characteristics. When an account triggers a specific rule, the impact of that rule is... It remains in effect for hours, among which This is the preset delay retention time parameter.

[0013] In one embodiment of the present invention, step S4, which dynamically adjusts the rule parameters in the hybrid risk assessment architecture based on the regional risk profile, further includes: S41 automatically increases the scoring weight of specific regional features by matching regional risk patterns with a localized feature library. S42, based on a branch-level rule template library, enables rapid migration and deployment of regional features, generating rule parameter update schemes adapted to the risk characteristics of different regions or industries.

[0014] In one embodiment of the present invention, it further includes: S5, dynamically adjust the scoring threshold of the hybrid risk assessment architecture based on historical early warning effects, and set the scoring threshold to [value] by statistically analyzing the difference in feature quantiles between black samples and white samples. When a low-risk warning is triggered, A medium-risk warning was triggered at that time. A high-risk warning is triggered at this time.

[0015] To achieve the above objectives, a second aspect of the present invention proposes a corporate account anti-fraud system that integrates machine learning and expert rules, comprising: The data acquisition and feature extraction module is used to acquire multi-source heterogeneous data from regulatory regulations, media reports, black sample transaction records and branch feedback information, and generate a risk feature wide table through data cleaning, format standardization and business logic verification. The two-stage feature selection module is used to optimize features based on the risk feature wide table using a two-stage feature selection algorithm. The two-stage feature selection algorithm includes: a first stage of processing data in blocks and iteratively eliminating redundant features through a dynamic resource allocation strategy; and a second stage of integrating multiple feature importance assessment methods to calculate feature contribution and retaining the Top N high-value features. The hybrid risk assessment architecture construction module is used to transform optimized features into scoring rules and triggering rules. The scoring rules calculate dynamic risk scores by weighting multi-dimensional risk features. The triggering rules set real-time warning thresholds for high-risk features, realizing the synergy between quantitative risk assessment and real-time interception of key features. The regional risk profile dynamic adjustment module is used to dynamically adjust the rule parameters in the hybrid risk assessment architecture based on the regional risk profile. It matches regional risk patterns through a localized feature library, automatically increases the scoring weight of specific regional features, and quickly migrates and deploys regional features based on a branch-level rule template library to generate rule parameter update schemes adapted to risk characteristics of different regions or industries.

[0016] The anti-fraud method and system for corporate accounts that integrates machine learning and expert rules in this invention can significantly improve the accuracy and real-time performance of anti-fraud detection for corporate accounts, effectively cope with the rapid evolution of fraud methods, reduce false alarm rate, and enhance the coverage and adaptability to new and regional fraud behaviors.

[0017] In summary, the anti-fraud method for corporate accounts that integrates machine learning and expert rules, as described in this invention, can solve the following technical problems: Improving detection accuracy and timeliness: Existing technologies struggle to accurately identify fraudulent transactions in a timely or near-real-time manner, especially as criminals shift their focus to corporate accounts due to stricter regulations on personal accounts.

[0018] Reduce false alarms and minimize customer disruption: Existing systems have a high false alarm rate, leading to unnecessary customer inconvenience and potential relationship damage. This model aims to reduce false alarms while maintaining a high detection rate.

[0019] Expanding the scope of fraud coverage: Traditional methods rely on historical data and known patterns, which may miss new types of fraud. Models cover a wider range of fraud scenarios by continuously learning from new cases.

[0020] Adapting to rapidly evolving criminal methods: Fraudsters often change their methods quickly in response to new regulations or detection methods, making it difficult for existing technologies to keep up effectively.

[0021] Optimize rule system performance: Existing rule systems lack flexibility and struggle to adjust thresholds or rules according to changes in risk. The model improves its adaptability through continuous optimization.

[0022] Enhanced analytics through multi-source data integration: Existing systems may not fully utilize data from regulatory updates, media reports, police records, and more. This solution aims to integrate diverse data to support more comprehensive decision-making.

[0023] Improving post-detection processing efficiency: Existing systems may lack a rapid response mechanism after detecting potential fraud. The model will optimize processes such as account freezing, reporting, and customer communication.

[0024] Support for localized risk profiling: National or global models may overlook region- or industry-specific risk factors. The new model optimizes the risk assessment algorithm by incorporating localized insights.

[0025] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0026] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart illustrating a corporate account anti-fraud method integrating machine learning and expert rules, provided as an embodiment of the present invention; Figure 2 This invention provides a data processing logic diagram for a corporate account anti-fraud method that integrates machine learning and expert rules, as provided in an embodiment of the invention. Figure 3 This is a logic diagram of the trigger control rules provided in an embodiment of the present invention; Figure 4 Example diagram of feature derivation results provided in embodiments of the present invention; Figure 5 A logic diagram of the scoring system rules provided in this embodiment of the invention; Figure 6A table of scoring system rules provided for embodiments of the present invention; Figure 7 The scoring system + trigger system modeling logic diagram provided in the embodiments of the present invention; Figure 8 This is a structural diagram of a corporate account anti-fraud system that integrates machine learning and expert rules, provided as an embodiment of the present invention. Detailed Implementation

[0027] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0029] The following description, with reference to the accompanying drawings, describes a method and system for combating fraud in corporate accounts that integrates machine learning and expert rules, according to an embodiment of the present invention.

[0030] Example 1 This embodiment provides a method for preventing fraud in corporate accounts that integrates machine learning and expert rules. For example... Figure 1 As shown, it includes: S1. Acquire multi-source heterogeneous data and extract features. The multi-source heterogeneous data includes regulatory laws and regulations, media reports, black sample transaction records and branch feedback information. Generate a risk feature wide table through data cleaning, format standardization and business logic verification.

[0031] Specifically, the step of "acquiring multi-source heterogeneous data and extracting features" is a fundamental step in building a corporate account anti-fraud model. Its technical implementation involves several key processes, including data integration, cleaning, standardization, and feature engineering. In some implementations, the system collects raw data from multiple data sources, including regulatory laws, media reports, black-sample transaction records, and branch feedback information. This data is characterized by heterogeneous structure, inconsistent formats, and diverse sources. To ensure the accuracy and consistency of subsequent model training and rule construction, the system first performs data cleaning, removing invalid records, duplicate data, and incorrectly formatted content. For example, it uses the regular expression `^\d{17}[\dXx]$` to validate the format of ID card fields, or uses `[0-9A-Z]{18}` to match specific encoding rules.

[0032] During the format standardization phase, the system maps data from different sources to a unified field structure. For example, the "Transaction Amount" field is standardized to the `DECIMAL(18,2)` type, and the "Transaction Time" field is standardized to the `YYYY-MM-DD HH:MM:SS` format to ensure data comparability and operability in subsequent processing. Furthermore, the system verifies the data through business logic to check whether it conforms to actual business scenarios. For example, it verifies whether the "Account Opening Time" is earlier than the "First Transaction Time," or checks whether the "Counterparty Type" has a reasonable correlation with the "Transaction Amount."

[0033] Feature extraction is performed on the cleaned data, extracting key risk indicators such as transaction frequency, amount distribution, time patterns, and counterparty account attributes. For example, for "account testing" behavior, the system can extract the time-series feature that "an account engages in either a type B or type C transaction immediately after a type A transaction," and convert it into rule indicators, such as "the account has engaged in type A transactions ≥ * times in the past N months" or "the account has made ≥ 5 transactions in the past 24 hours." These features constitute a wide risk feature table, providing structured input for subsequent expert rule construction and machine learning model training.

[0034] This step plays a core supporting role in the entire technical solution, and its output directly affects the coverage and early warning accuracy of the rule model. By fusing multi-source heterogeneous data, the system can capture more comprehensive risk signals and improve its ability to identify new types of fraudulent behavior. At the same time, the standardized wide table structure provides a unified data foundation for the coordinated operation of scoring and trigger-based rules, enhancing the interpretability and maintainability of the model.

[0035] S2, based on the aforementioned risk feature wide table, a two-stage feature selection algorithm is used for feature optimization. The two-stage feature selection algorithm includes: in the first stage, data is processed in blocks using a dynamic resource allocation strategy and redundant features are iteratively eliminated; in the second stage, multiple feature importance assessment methods are integrated to calculate feature contribution and retain the Top N high-value features.

[0036] Specifically, the step of "optimizing features using a two-stage feature selection algorithm based on the aforementioned risk feature wide table" in this invention is a key step in building an efficient and accurate anti-fraud model. This step effectively reduces feature dimensionality and improves the model's generalization ability and computational efficiency through a phased feature selection mechanism.

[0037] This two-stage feature selection algorithm consists of two core stages: the first stage is the coarse screening stage, which uses the FeatureBoost algorithm combined with a dynamic resource allocation strategy to iteratively prune candidate features. Specifically, this stage divides the original feature wide table data into... Data blocks, of which The block index parameter controls the balance between the number of blocks and memory usage. In each iteration, the algorithm randomly selects... Use data blocks (i is the iteration number) to construct the current evaluation subset. Incremental importance assessment is performed on each feature within this subset. Predictions are then fitted using the base model. With real labels Calculate the loss function based on the residuals between them. ,in This is a lightweight model trained on the new features. After each iteration, only the top 50% of features are retained, redundant features are gradually eliminated, and the final output is a feature set with positive incremental contributions. For further optimization, this stage also performs deduplication on features with completely identical values ​​to eliminate redundant information.

[0038] The second stage is the fine screening stage, which employs a feature importance ensemble algorithm to weight and score features using multiple evaluation methods (such as Gini impurity reduction, permutation importance, null importance, etc.). For example, the formula for calculating feature importance based on Gini impurity reduction is:

[0039] in Representation of features At the node The amount of impurity reduction on the surface The total number of trees. The importance of the permutation is assessed by evaluating its contribution to the model's performance decline after randomly shuffling the feature values; the formula is as follows:

[0040] in For the number of permutations, For the first The model's predicted values ​​after the permutation. By integrating the above methods, the algorithm can comprehensively evaluate the stability and discriminative power of features, and finally retain the Top N high-value features for subsequent rule construction and model training.

[0041] In application scenarios, this step is suitable for corporate account anti-fraud systems with high feature dimensionality, large sample size, and limited computing resources. Through block processing and iterative elimination, the system can process millions of samples with limited memory while ensuring that key features are not missed. Given the complexity of corporate account transaction behavior and the variability of fraud patterns, this algorithm can effectively identify typical risk behavior characteristics such as "account testing" and "small-amount testing before transferring funds," improving the model's adaptability to new types of fraud.

[0042] The technical advantage of this step lies in significantly improving the quality of the feature set and the training efficiency of the model. The first-stage coarse screening reduces the number of features from over 2400 to several hundred, while the second-stage fine screening further selects 100 optimal features, providing high-quality input for subsequent rule construction and scoring models. Simultaneously, the algorithm supports dynamic updates and localized feature fusion, laying a solid foundation for continuous model optimization and adaptive improvement.

[0043] S3. Construct a hybrid risk assessment architecture, transforming optimized features into scoring rules and trigger-based rules. The scoring rules calculate a dynamic risk score through multi-dimensional risk features weighting, while the trigger-based rules set immediate warning thresholds for high-risk features, achieving synergy between quantitative risk assessment and immediate interception of key features. Specifically, constructing a hybrid risk assessment architecture is a key step in achieving efficient and accurate identification of corporate account anti-fraud systems in this invention. This architecture integrates scoring-based rules and trigger-based rules, achieving quantitative risk assessment and rapid interception of key features through weighted calculation of multi-dimensional risk characteristics and an instant warning mechanism for high-risk characteristics, thereby achieving a balance between the breadth and depth of risk identification.

[0044] The scoring system uses a weighted calculation based on multi-dimensional risk characteristics to form a dynamic risk score. Specifically, the system extracts risk features from multiple dimensions, including account transaction history, customer information, counterparty account attributes, and time window behavior. These features are then filtered and weighted using expert experience and machine learning algorithms (such as FeatureBoost, Gini impurity reduction, and permutation importance). Each feature is assigned a different weight based on its predictive ability for fraudulent behavior, and the final real-time risk score is calculated through linear weighting or a non-linear combination. For example, if an account makes multiple small test transactions within the past 24 hours, and the counterparty is a high-risk associated account, the account's risk score will increase significantly.

[0045] Trigger-based rules set immediate warning thresholds for high-risk characteristics, enabling rapid interception of fraudulent activities. For example, if an account engages in bulk transfers at night (e.g., between 10 PM and 6 AM the next day), or has a direct transaction relationship with an account involved in a case reported by the police, the system will immediately trigger an alert without waiting for scoring results. This mechanism is suitable for high-confidence, high-risk scenarios, ensuring risk interception is completed in the shortest possible time to prevent fund loss.

[0046] The weighting coefficients of the scoring system rules are usually determined by ranking the feature importance of historical samples, such as using gain-based feature importance (e.g., Gini impurity reduction in random forests) or permutation importance for quantitative evaluation. The thresholds for trigger-based rules are set based on business feedback and sample statistics. For example, "≥2 Class A transactions in the last N hours" can filter 90% of normal accounts while covering 70% of the accounts involved in the case.

[0047] This hybrid architecture is widely deployed in banks' real-time transaction monitoring systems, particularly suitable for scenarios such as high-frequency transactions and abnormal behavior identification of corporate accounts. Its technical value lies in two aspects: firstly, the scoring system enhances the model's stability and adaptability, effectively identifying complex fraudulent behaviors with multiple overlapping features; secondly, the trigger-based system ensures immediate response to high-risk behaviors, forming a dual protection mechanism of "broad coverage + strong interception." The synergistic effect of these two mechanisms significantly improves the accuracy and response speed of fraud identification while reducing the false alarm rate, providing a solid foundation for banks to build intelligent and localized anti-fraud systems.

[0048] S4. Based on the regional risk profile, the rule parameters in the hybrid risk assessment architecture are dynamically adjusted. By matching regional risk patterns through a localized feature library, the scoring weights and triggering conditions are automatically updated to form a closed-loop iterative rule system that adapts to the risk characteristics of different regions or industries.

[0049] Specifically, this step involves dynamically adjusting the rule parameters in the hybrid risk assessment architecture based on regional risk profiles, matching regional risk patterns through a localized feature library, and automatically updating scoring weights and triggering conditions, thereby constructing a closed-loop iterative rule system adapted to the risk characteristics of different regions or industries. This process is a key link in achieving "localized risk identification" and "adaptive optimization of the rule system" in this invention, and has significant technical innovation and practicality.

[0050] This step first relies on the construction of a regional risk profile. The regional risk profile is based on the fusion of multi-source data, including account transaction data within branches, information on accounts involved in cases reported by the public security bureau, external media intelligence, industry regulatory documents (such as People's Bank of China documents No. 85 and No. 138), and abnormal transaction scenarios reported by branches. By performing feature extraction and cluster analysis on this data, the system can identify typical risk behavior patterns within a specific region or industry, such as high-frequency trading at night, abnormal channel combinations, and excessive capital flows. These patterns are encoded into feature vectors in a localized feature library for subsequent rule matching and parameter adjustment.

[0051] The system employs a hybrid architecture combining scoring and trigger-based mechanisms. The scoring weights are updated based on feature importance assessment results, such as calculating the incremental contribution of features to risk prediction using the FeatureBoost algorithm, and selecting the Top N most discriminative features based on Gini impurity reduction and permutation importance ensemble methods. The trigger conditions are adjusted based on the frequency and severity of behaviors in the regional risk profile. For example, a trigger condition might be set as "≥3 abnormal transfers within the last 24 hours," or the time window (e.g., from 24 hours to 12 hours) and amount threshold (e.g., from ≥50,000 yuan to ≥20,000 yuan) might be dynamically adjusted according to regional crime trends.

[0052] The system supports multi-dimensional parameter configuration, including time windows (e.g., 1 hour, 6 hours, 24 hours), transaction frequency (e.g., ≥2 transactions / hour), transaction amount (e.g., ≥50,000 yuan / transaction), transaction channel combination (e.g., ATM + online banking + counter), and counterparty attributes (e.g., proportion of unfamiliar accounts ≥30%). These parameters can be dynamically calibrated based on the statistical distribution in the regional risk profile. For example, quantile analysis (e.g., P90, P95) can be used to determine a reasonable threshold range to ensure coverage of high-risk accounts while reducing false alarm rates.

[0053] In application scenarios, this step is widely applicable to anti-fraud systems for corporate bank accounts, especially in scenarios involving deployment across multiple regions and industries. For example, in response to the prevalence of "transitional fund testing" in a particular region, the system can automatically identify transaction patterns in that area and adjust the weights and triggering conditions of relevant rules, thereby improving localized identification capabilities. Furthermore, this mechanism can also be used to address regionally high-risk activities such as cross-border gambling and money laundering, achieving more precise and localized risk identification.

[0054] By employing a dynamic parameter adjustment mechanism, the rule system gains adaptive capabilities, enabling it to quickly respond to changes in regional or industry risk characteristics and improve model coverage and accuracy. Simultaneously, through matching with a localized feature library, the system can effectively identify regional risks that traditional global models struggle to cover, thereby enhancing the overall effectiveness and flexibility of the anti-fraud system.

[0055] The anti-fraud method for corporate accounts that integrates machine learning and expert rules in this invention improves the accuracy and real-time performance of corporate account fraud detection, reduces the false alarm rate, and enhances the adaptability to new fraud methods.

[0056] Example 2 This invention proposes another anti-fraud method for corporate accounts that integrates machine learning and expert rules. Based on a wide risk feature table, a two-stage feature selection algorithm is used for feature optimization, including the following steps: S21, the risk feature wide table is divided into Each data block contains [number] data blocks. 1 sample, of which The total number of samples, This is a hyperparameter for controlling the granularity of the blocks.

[0057] Specifically, in some implementations, the risk feature wide table is divided into... Each data block contains [number] data blocks. The sample selection step is a crucial preprocessing step in the FeatureBoost algorithm's feature selection process. The core principle of this step lies in achieving efficient and progressive evaluation of large-scale feature sets through data partitioning, thereby completing the initial screening of high-value features with limited computing resources.

[0058] The specific implementation method is as follows: First, control the hyperparameters according to the preset block granularity. The original feature wide table is uniformly divided into sample dimensions. Each sub-block contains [number] sub-blocks. 1 sample, of which This represents the total number of samples. This block-based strategy ensures that memory usage remains within a controllable range during each round of feature evaluation, while gradually improving the stability and accuracy of the evaluation through multiple iterations. In practical applications, The value of is usually in The data is divided into 2 to 32 data blocks, and the specific values ​​need to be adjusted according to the system memory capacity, the number of features and the sample size.

[0059] This step is commonly used for anti-fraud modeling tasks of corporate accounts with a large number of features and a sample size of millions. Through block processing, the system can execute feature evaluation tasks in parallel within distributed computing frameworks (such as Spark or Flink), significantly improving processing efficiency. Furthermore, this method supports online learning and real-time feature updates, making it suitable for dynamic monitoring and risk identification of corporate account transaction behavior in bank risk control systems.

[0060] By controlling the particle size Achieving a balance between computational efficiency and evaluation accuracy. Smaller Larger values ​​can speed up feature selection, but may sacrifice evaluation stability; While increasing the value improves the accuracy of the assessment, it also places higher demands on computing resources. Therefore, this step provides a high-quality, low-redundancy candidate feature set for subsequent feature importance assessment and rule optimization, which is an important foundation for achieving efficient and accurate risk modeling.

[0061] S22 eliminates features through multiple rounds of iteration, randomly selecting features in each iteration. Each data block is evaluated, and the top 50% of features are retained for the next iteration until a feature set with positive incremental value scores is output.

[0062] Specifically, in this invention, "features are eliminated through multiple rounds of iteration, and random selection is made in each iteration." The step of "evaluating each data block and retaining the top 50% of features for the next iteration until a feature set with positive incremental value scores is a feature selection mechanism based on the FeatureBoost algorithm. It aims to efficiently identify risk features with significant incremental contributions in a large-scale data environment, thereby improving the accuracy and generalization ability of the anti-fraud model for corporate accounts.

[0063] This step employs a progressive feature pruning strategy, which involves dividing the original feature set into... A data block is randomly selected in each iteration. The data blocks constitute the evaluation subset. ,in This indicates the current iteration round. As the iteration progresses, The value increases gradually, meaning the amount of data used in each evaluation round grows exponentially, thus progressively improving the stability and accuracy of feature evaluation with limited computing resources. In each round, the FeatureBoost algorithm is used to perform incremental value evaluation on the current candidate features, with the objective function being:

[0064] in, These are predictions from existing basic models. For the new set of features to be evaluated, For the model trained on the new features, For real labels, The loss function is denoted by . This method avoids retraining the entire model by fitting the residuals, significantly reducing computational overhead.

[0065] Regarding parameter settings, To control the initial number of blocks, it is usually set to To ensure controllable memory usage and statistically representative evaluation, features are sorted by incremental value score in each iteration, with only the top 50% retained for the next round, gradually eliminating redundant or inefficient features. The final output feature set consists of all features with positive incremental value scores, i.e., features that positively improve the model's prediction results.

[0066] This step is applicable to the feature engineering optimization stage of corporate account anti-fraud models in practical applications, especially when facing millions of samples and thousands of candidate features, effectively alleviating memory pressure and improving feature selection efficiency. Its technical value lies in two aspects: firstly, achieving a balance between computational efficiency and accuracy in feature evaluation through a dynamic resource allocation strategy; secondly, providing high-quality input for subsequent rule-based indexing and scoring model construction by retaining high-value features, thereby improving the overall model's risk identification capability and response speed. This method is particularly suitable for the rapid identification and iterative optimization of new types of fraudulent activities in corporate account anti-fraud scenarios.

[0067] Example 3 This invention proposes another anti-fraud method for corporate accounts that integrates machine learning and expert rules. The method involves constructing a hybrid risk assessment architecture, including the following steps: S31, the scoring system rules are calculated using a formula. The rules are scored, among which The number of iterations for ranking importance evaluation. For the first The predicted value after randomly arranging the feature values.

[0068] Specifically, in this invention, the scoring mechanism of the scoring system rules adopts the permutation importance algorithm, the core formula of which is:

[0069] in, Indicates the first The importance score of each feature in the order of importance. To evaluate the number of iterations, This represents the loss function value of the model under the original features. Indicates the first In the next iteration, the first The loss function value of the model is obtained by randomly permuting the values ​​of a feature. This method evaluates the contribution of a feature to the model's prediction by measuring the degree of performance degradation after the feature value is corrupted.

[0070] This step first evaluates feature importance based on a trained machine learning model (such as random forest, gradient boosting tree, etc.). For each feature... In each iteration, its original feature columns will be randomly shuffled to form The original predictions are then re-input into the model for prediction. By comparing the difference in the loss function between the original predictions and the predictions after shuffling the features, the contribution of each feature to the model's predictions can be quantified. Loss function Mean squared error (MSE) or cross-entropy loss is typically used, with the specific choice depending on the model type and task objective.

[0071] Number of iterations The number of trials is typically set to 50 to 200 to ensure the stability of the evaluation results. In this invention, The value of is dynamically adjusted based on the data scale and computing resources to achieve a balance between computational efficiency and evaluation accuracy. Furthermore, to avoid evaluation bias caused by differences in feature distribution, each permutation operation is performed while maintaining a consistent feature distribution; that is, only the feature values ​​are randomly rearranged without changing their distribution pattern.

[0072] This step plays a crucial role in this invention. By arranging importance assessments, the model can identify features that significantly impact fraud detection, thus providing a quantitative basis for assigning scores to the scoring rules. In practical applications, this method is used in real-time risk scoring systems for corporate account transaction data. Particularly in identifying novel fraudulent activities, it can dynamically adjust rule weights based on feature importance, enhancing the model's adaptability to complex risk scenarios. For example, when detecting "account testing" type fraud, if a feature (such as transaction time distribution) causes a significant increase in model loss after arranging, it indicates high value in identifying this type of behavior and can be assigned a higher scoring weight.

[0073] In summary, this step, through rigorous mathematical evaluation methods, achieves scientific scoring of the scoring system rules, providing solid technical support for building a high-precision, low-false-report, and scalable anti-fraud system for corporate accounts.

[0074] S32, the trigger-based rule sets a risk delay retention algorithm for high-risk characteristics. When an account triggers a specific rule, the impact of that rule is... It remains in effect for hours, among which This is the preset delay retention time parameter.

[0075] Specifically, the technical implementation of the "trigger-based rule setting risk delay retention algorithm for high-risk features" in this invention aims to solve the problem that traditional trigger-based rules lack sustained impact after risk identification, thereby improving the continuous monitoring capability of fraudulent accounts. The core principle of this step is that when an account triggers a high-risk feature rule, the system not only immediately generates an alert, but also extends the impact of the rule within a preset delay window. It remains in effect for hours to capture the inertial behavior of fraudulent activities after they are triggered, preventing short-term actions from masking long-term risks.

[0076] In its implementation, the system uses a rules engine to make real-time or near-real-time judgments on account behavior. Once an account... If a high-risk rule is triggered (such as bulk transfers at night, transactions through abnormal channels, etc.), the system will record the triggering event and track it in subsequent events. The rule's judgment logic is continuously applied to the account's trading activity within the hour. During this period, even if the account does not trigger the rule again, its risk status remains maintained, thus preventing fraudsters from escaping monitoring due to temporary adjustments in their behavior. Delay time These are configurable parameters, typically set based on the duration of historical fraudulent activities, for example... Hours or Hours, to cover the majority of fraudulent accounts during the active window after triggering.

[0077] This technology plays a crucial role in a risk control system that integrates scoring and trigger-based mechanisms. On one hand, it overcomes the limitations of trigger-based rules, which only report and clear transactions immediately upon triggering, thus enhancing the continuous identification of fraudulent accounts. On the other hand, it complements scoring rules, allowing high-risk behaviors to be reflected in the scoring model for a longer period, thereby improving the overall model's stability and coverage. In practical applications, this mechanism is widely used for scenarios such as nighttime transactions of corporate accounts, high-frequency small-amount testing, and abnormal counterparty transactions, and is particularly suitable for scenarios where fraudulent behavior exhibits short-term concentrated characteristics. Through delayed risk retention, the system can more effectively identify potential money laundering and fraudulent accounts, improving banks' response efficiency and interception capabilities in the anti-fraud field.

[0078] Example 4 This invention proposes another anti-fraud method for corporate accounts that integrates machine learning and expert rules. The method dynamically adjusts the rule parameters in the hybrid risk assessment architecture based on regional risk profiles, including the following steps: S41 automatically increases the scoring weight of specific regional features by matching regional risk patterns with a localized feature library, such as increasing the weight of abnormal cash withdrawal features of corporate accounts in a certain region by 30%.

[0079] Specifically, this step involves matching regional risk patterns with a localized feature library to automatically increase the weight of specific regional features in the scoring. This is a key technical means of localizing risk identification in this invention. Its technical implementation principle is based on the identification and modeling of specific regional risk behaviors, combined with a risk scoring mechanism, dynamically adjusting feature weights to enhance the model's sensitivity to regional fraudulent activities. For example, regarding abnormal cash withdrawals from corporate accounts in a certain region, the system identifies high-risk behavioral patterns in that region through feature matching and automatically increases the weight of this feature by 30%, thus reflecting its higher suspiciousness in the risk scoring.

[0080] In terms of specific implementation, the localized feature library consists of branch or regional risk features, covering dimensions such as transaction channels, time windows, amount distribution, and counterparty account attributes. The system compares real-time transaction behavior with patterns in the localized feature library using feature matching algorithms (such as similarity-based feature matching or rule-based pattern recognition). If the matching degree exceeds a preset threshold (e.g., ...), the system will detect the pattern. If a feature is found to be a match, a weight adjustment mechanism is triggered. This mechanism, based on a scoring rule engine, dynamically assigns scores to the matched features, and its weight adjustment formula is as follows:

[0081] in, These are the original feature weights. Weighting coefficients for regional risk characteristics (e.g.) (This indicates an increase of 30%) These are the adjusted feature weights. This adjustment process can be dynamically optimized by combining historical false positive rates and hit rates to ensure that weight increases do not lead to misjudgments of normal transactions.

[0082] This step applies to regional anti-fraud monitoring systems for corporate bank accounts. For example, after multiple cases of corporate accounts transferring illicit funds through unusual withdrawals have occurred in a certain area, the system can automatically identify the "unusual withdrawal" characteristics of that area and assign a higher weight to this characteristic in subsequent transactions, thereby improving its ability to identify similar behaviors. This mechanism is particularly suitable for scenarios where criminals shift to regional high-risk activities after stricter regulations, helping to achieve "localized" risk identification.

[0083] This embodiment significantly improves the model's accuracy and response speed in identifying regional fraud. By automatically adjusting scoring weights, the system can quickly adapt to changes in regional risks, reducing reliance on manual rule tuning while enhancing its coverage of new and covert fraudulent activities. Combining a dual-track mechanism of scoring and triggering, this step further strengthens the model's dynamic adaptability and localized prevention capabilities, providing key technical support for achieving "localized risk detection."

[0084] S42, based on a branch-level rule template library, enables rapid migration and deployment of regional features, generating rule parameter update schemes adapted to the risk characteristics of different regions or industries.

[0085] Specifically, the step in this invention of "rapidly migrating and deploying regional features based on a branch-level rule template library to generate rule parameter update schemes that adapt to the risk characteristics of different regions or industries" aims to achieve efficient adaptation and dynamic optimization of risk rules across different regions or industries, thereby improving the localization response capability and deployment efficiency of the anti-fraud model.

[0086] This step first relies on a structured, modular, branch-level rule template library. This library consists of multiple standardized rule units, each containing feature definitions, operators, thresholds, logical relationships, and a risk scoring mechanism. During deployment, the system uses feature matching and rule mapping mechanisms to compare the risk characteristics of the target region or industry with the general rules in the template library, identifying rule templates highly correlated with local characteristics. Subsequently, the system dynamically adjusts parameters such as thresholds, time window lengths, and feature combination logic in the rules based on the statistical distribution of local data (such as transaction frequency, amount distribution, and time window characteristics). For example, if accounts involved in a case in a certain region prefer to engage in Category A transactions within the past 6 hours before the transfer of illicit funds, the "past 24 hours" window in the original template can be adjusted to "past 6 hours," and the threshold can be set to ≥2 transactions to improve the accuracy of localized identification.

[0087] Key parameters involved in the migration and deployment process include time window length (e.g., 1 hour, 6 hours, 12 hours, 24 hours), transaction frequency threshold (e.g., ≥2 transactions), transaction amount threshold (e.g., ≥5000 yuan), and risk score weight (e.g., 0.5~1.0 range). These parameters are adjusted based on quantile analysis results from local samples to ensure maximum coverage of fraudulent accounts while minimizing false positives. For example, by statistically analyzing the distribution difference of "the number of Type A transactions occurring N hours before the current transaction" between black and white samples, the optimal threshold can be determined to be ≥2, thereby filtering 90% of normal accounts while covering 70% of the accounts involved in the fraud.

[0088] This step is applicable when bank branches deploy anti-fraud systems in different regions or industries (such as cross-border trade, virtual asset transactions, etc.) to quickly adapt to local risk characteristics. For example, when processing cross-border gambling fund flows, a branch can adjust the "high-frequency small-amount test" rule based on the template library, combined with the local transaction time distribution characteristics, to "nighttime high-frequency small-amount test" and assign it a higher risk score, thereby enhancing its ability to identify high-incidence risks in the local area.

[0089] By employing a structured design of rule templates and a dynamic parameter adaptation mechanism, the deployment efficiency and recognition accuracy of the model in different regions or industries are significantly improved. Its innovation lies in combining expert rules with localized data features, enabling rapid rule migration and parameter optimization, thereby enhancing the model's adaptability and practicality.

[0090] Example 5 Another anti-fraud method for corporate accounts that integrates machine learning and expert rules, proposed in this invention, may further include the following steps: S5, dynamically adjust the scoring threshold of the hybrid risk assessment architecture based on historical early warning effects, and set the scoring threshold to [value] by statistically analyzing the difference in feature quantiles between black samples and white samples. When a low-risk warning is triggered, A medium-risk warning was triggered at that time. A high-risk warning is triggered at this time.

[0091] Specifically, this step involves dynamically adjusting the scoring threshold in the hybrid risk assessment framework based on historical early warning effects. Its core lies in accurately classifying different risk levels by statistically analyzing the differences in characteristic quantiles between black and white samples. Specifically, this method, based on the differences in the characteristic distribution of corporate account transaction behavior, uses statistical analysis to identify characteristic quantiles with significant discriminative power, thereby setting reasonable early warning thresholds for the scoring model. In some implementations, this step first extracts the characteristic distributions of black and white samples from historical early warning data, calculating their quantile differences on key risk indicators, such as transaction frequency, transaction amount, and transaction time distribution. Through comparative analysis, it determines within which quantile intervals the distribution differences between black and white samples are greatest, thus providing data support for setting the scoring thresholds.

[0092] This step divides the rating threshold into three levels: when the account is rated... When a low-risk warning is triggered, A medium-risk warning was triggered at that time. High-risk warnings are triggered at certain times. These thresholds are set based on statistical analysis of historical warning data to ensure good differentiation between different risk levels. For example, by calculating the quantile distribution of the feature "an account experiences a type B or C transaction immediately after a type A transaction" in black and white samples, it was found that the cumulative probability of this feature in black samples is significantly higher than that in white samples, thus supporting the inclusion of this feature in the scoring system and the setting of corresponding thresholds.

[0093] In practical applications, this step is typically deployed within the rule engine of an anti-fraud system, integrated with real-time or near real-time transaction monitoring processes. When an account's cumulative score reaches a set threshold within a certain time window, the system automatically triggers the corresponding level of alert and pushes the account information to the manual verification or automatic control module. This method is particularly suitable for complex transaction scenarios involving corporate accounts, such as abnormal fund flows, high-frequency small-amount tests, and nighttime transactions, and can effectively identify potential telecommunications and online fraud.

[0094] This step improves the model's accuracy and response speed in identifying fraudulent behavior by dynamically adjusting the scoring threshold. On the one hand, it avoids the failure of static thresholds when faced with new fraud patterns; on the other hand, through quantile difference analysis, it ensures that the scoring model has good distinguishing ability between different risk levels, thereby reducing the false positive rate while increasing the detection rate of fraudulent accounts. This mechanism is a key component of the integrated scoring and trigger-based architecture, providing a quantitative basis for achieving multi-level early warning and differentiated control of risks.

[0095] The anti-fraud method for corporate accounts that integrates machine learning and expert rules in this invention improves the accuracy and real-time performance of corporate account fraud detection, reduces the false alarm rate, and enhances the adaptability to new fraud methods.

[0096] Example 6 This invention proposes another anti-fraud method for corporate accounts that integrates machine learning and expert rules. The data processing logic is as follows: Figure 2 As shown, the specific data flow of this invention is as follows: In one embodiment of the present invention, data collection and processing are performed: based on an understanding of the business, relevant raw tables and external data are acquired, including but not limited to data on accounts involved in cases reported by public security bureaus, lists of internally controlled accounts, account transaction records, external media intelligence, and branch feedback information. The data table structure is familiarized, the relationships between data tables are explored, and code tables for relevant fields are compiled. Business data is analyzed, including three aspects: first, assessing data quality, such as completeness, uniqueness, and accuracy, and preprocessing the data, cleaning invalid records, removing duplicate data, and standardizing formats to ensure data quality; second, verifying the raw data based on business experience to explore whether the data conforms to business logic; and third, extracting meaningful features from the raw data, such as transaction frequency, amount, time pattern, and counterparty account attributes.

[0097] In one embodiment of the present invention, rule design and model construction: For the construction of near real-time rules for corporate accounts, the risk is first characterized using an expert rule triggering system, resulting in a final list of warning accounts for review and control. The expert rule triggering model constructs a rule system through a process of case characterization, feature ruleization, and rule indexing, as well as monitoring methods for triggering and issuing warnings. The specific details are as follows: Among its key features, the case characterization approach fully integrates multi-dimensional information sources to comprehensively identify fraud-related risk characteristics during feature construction and rule design. Firstly, based on regulatory documents such as the People's Bank of China's No. 85 and No. 138, it systematically extracts typical behavioral patterns and key regulatory concerns related to telecommunications and online fraud cases. Secondly, through in-depth analysis of typical cases reported in the media (such as cases cracking down on cross-border online gambling), it extracts representative modus operandi and fund flow characteristics. Simultaneously, it conducts special analysis of black samples, focusing on corporate accounts involved in cases reported by the branch's public security bureau in the past two years. It portrays the risk profile of fraudulent accounts from multiple dimensions, including account opening time, transaction amount, number of transaction days, number of transactions, transaction channels, and AUM distribution, clarifying their main behavioral patterns and providing empirical support for the construction and optimization of the rule model. Furthermore, it dynamically expands the feature variable library by combining new risk scenarios reported by frontline branches during the verification process. It also actively draws on the advanced experiences of peer institutions and other provinces to identify common high-risk crime characteristics and incorporate them into the model's feature system. The aforementioned multi-source information collaboration mechanism effectively enhances the foresight, accuracy, and adaptability of risk identification, laying a solid foundation for building a scientific and efficient in-process risk control system.

[0098] Among them, feature rule-based approach: Focus on the characteristics of risk links in key scenarios, such as frequent large-amount transfers or unusual transaction times, and use rules to characterize their modus operandi, patterns, and abnormal transaction behaviors.

[0099] Among these, rule-based metrics involve further refining rules into specific metrics and optimizing existing metrics through combinations of operators, thresholds, and logical relationships. These metrics include multiple time window indicators, such as trading indicators for the past 1 hour, 6 hours, 12 hours, and 24 hours; and composite ratio indicators, such as the loan-to-deposit ratio of trading amount.

[0100] In one example: Based on black sample analysis and regulatory guidance, the feature type is extracted as "account testing". Further anomalous features are extracted, such as "the account experiences B or C type transactions immediately after an A type transaction", "the account experiences a surge in transaction volume after an A type transaction", and "a new account enters a dormant period after experiencing an A type transaction within a few days of opening". After feature rulemaking, the rule "frequent B type transactions occur after A type transactions" is formed. Further rule indexing results in the indicators "account has experienced A type transactions in the past N months" (threshold: transaction amount ≥ * yuan), "account has accumulated the number of transactions in the past N months" (threshold: number of transactions ≥ * transactions), and "account has accumulated the transaction amount in the past N months" (threshold: transaction amount ≥ * yuan).

[0101] Through the above three steps, key indicators generated by rule-based metrics are combined and adjusted to form a trigger-based model for expert rules. Strict trigger conditions are then set, such as small-scale testing through special channels, to trigger an immediate alert. This model can continuously analyze the reasons and abnormal characteristics of black samples not covered by single or several rules, increasing the number of rules to maximize coverage while maintaining accuracy, achieving a balance between effectiveness and performance. A key feature is its ability to iterate quickly and deploy rapidly for missed black samples and newly emerging features. Figure 3 This is the trigger control rule logic diagram of the present invention.

[0102] In one embodiment of this invention, machine learning feature optimization involves prioritizing features with high fraud risk through feature engineering, feeding back into the trigger rule model construction, and integrating artificial intelligence technology with expert experience to further enhance the risk warning capability of the in-process rule system. The term "feature" refers to the risk characterized by the "indicators" commonly used in this invention. Based on cutting-edge artificial intelligence innovation, this invention first uses the RFM method to construct a basic feature set. The cleaned feature wide table data exhibits structural similarities, with each data set containing a unique primary key, time-type data, categorical data, numerical data, and identifying data. Subsequently, the following two-stage algorithm was explored in feature engineering: Phase 1: Coarse Screening Phase (Continuous Feature Pruning Algorithm): In automatic feature generation scenarios, the number of candidate features to be evaluated is enormous, with sample sizes exceeding one million, making it impossible to load the feature matrix into memory for full evaluation at once. To address this challenge, the FeatureBoost algorithm combined with a dynamic resource allocation strategy is used in the coarse screening stage to efficiently filter features through gradual elimination. The core of this strategy is to quickly eliminate redundant or low-value features through multiple iterations within a controllable memory footprint, while ensuring that high-potential features are not overlooked. The FeatureBoost algorithm is a fast incremental feature importance evaluation method based on residual fitting. Its core idea originates from gradient boosting: training a model using only new features to fit the residual between the base model prediction and the true label. The objective function of this method is:

[0103] in: : Base model prediction; X: New feature set; g: Model trained on the new features; y: True label; L: Loss function.

[0104] By directly fitting the residuals, FeatureBoost avoids global model retraining, requiring only lightweight training on new features to efficiently estimate their incremental contributions. The specific process is as follows: First, data partitioning: the complete dataset is evenly divided into... Each block contains [number] blocks. Each sample. The hyperparameter q is used to control the block granularity, which is essentially a trade-off between memory constraints and evaluation stability.

[0105] Secondly, iterative elimination: the algorithm runs in multiple iterations, with each iteration aiming to eliminate approximately half of the candidate features. In the i-th iteration: Dynamic sampling: random selection These data blocks constitute the current evaluation subset. As iterations progress, more data is used to evaluate the retained features, enabling dynamic and efficient allocation of computing resources.

[0106] Incremental evaluation: For each candidate feature currently retained, the FeatureBoost algorithm is used in a subset. The incremental value score (i.e. the amount of loss reduction caused by the fitting residual) is calculated.

[0107] Selective Retention: Based on scores, only the top half of the features are retained for the next round. This step sustainably and rapidly reduces the size of the candidate set.

[0108] Furthermore, output and deduplication: After the iteration, all features with positive incremental value scores are retained. To further streamline the feature set, features with identical values ​​are deduplicated to eliminate redundancy.

[0109] Second stage: Fine screening stage (feature importance ensemble algorithm): Unlike the coarse first stage, the second stage considers the finer-grained interaction effects between candidate features and base features. Feature importance attribution methods can attribute importance scores to each feature. Popular methods include calculating native feature importance based on gain and number, as well as four feature importance algorithms: Permutation and Null Importance. This invention integrates these multiple importance judgment methods, ultimately retaining the Top N important features to ensure the model's performance and accuracy. Through this method, this invention can accurately evaluate the contribution of each feature to model performance and select the most influential features, thereby making the algorithm more adaptable and accurate when processing various types of data. The calculation formula is as follows.

[0110] Based on Gini impurity reduction (random forest): =

[0111] in = ; Based on the importance of the permutation: =

[0112] in It is the prediction after the j-th feature value is randomly arranged.

[0113] Finally, through the above machine learning algorithms and expert experience screening, more than 2,400 features were explored and constructed, and 100 of the best-performing features were selected. These features have three main advantages: first, they can be used to improve the stability of new rules for project construction; second, they can be used to optimize existing rules and improve their effectiveness; and third, the features explored and constructed through machine learning can be incorporated into the bank's indicator library. In the future, as the risk characteristics of corporate accounts change, they can be retrained using machine learning algorithms, combining "machine learning" and "expert experience" to explore new features and continuously contribute to the construction of the corporate account anti-fraud risk control system. Figure 4 The image shown is an example of the feature derivation results.

[0114] In one embodiment of the present invention, a scoring system rule is introduced: Since the scoring system has better stability and risk feature aggregation properties compared to the trigger system, and is also compatible with the trigger system rule, the present invention introduces a comprehensive scoring strategy on the basis of the trigger system, which superimposes the effects of multiple rules, and flexibly adjusts the rule control rate and coverage by adjusting the early warning scoring threshold.

[0115] Typically, black samples possess multiple anomalous features, and each rule represents one of these features. Normal transactions of white samples may resemble anomalous features (but will not accumulate multiple anomalous features). Therefore, the first step is to use a rule-based scoring method to select the top-performing rule to distinguish between black and white samples. Secondly, since the core of the scoring system lies in risk accumulation, all scoring systems require more risk dimensions to better demonstrate their effectiveness. Therefore, the first key optimization point is to increase the number of rules and add more dimensions of risk characterization. Simultaneously, by optimizing the logic for identifying unfamiliar trading counterparties, combining the scoring system with trigger mechanisms, and using methods such as delayed retention of single-rule risk triggers, a more accurate risk warning model is constructed. The specific steps are as follows: The first step is to output the latest transaction records of the accounts reported by the public security authorities, and analyze and summarize the abnormal behaviors involved in the new report samples.

[0116] The second step is to output the transaction records of suspicious accounts alerted by other models, analyze and summarize whether these accounts have any new abnormal behaviors.

[0117] The third step is to characterize the summarized abnormal behaviors using indicators.

[0118] The fourth step is to construct an initial rule list, which combines the trigger rules and the newly identified abnormal behaviors to form an initial rule list.

[0119] The fifth step is to enrich the initial rule list by combining abnormal behavior of accounts involved in the case across the entire industry, and then form the rule list.

[0120] The sixth step is to optimize the trigger-based rules. Since the core of the trigger-based system is accuracy, the trigger-based rules will contain particularly complex logical indicators to characterize risky behaviors. Rules that can bring back the trigger effect will be given a direct warning score. For rules that are not effective, they will be reconstructed according to the risk scenarios they correspond to. First, the core indicators of the fixed risk scenarios will be used to ensure that the samples filtered by the core indicators are all samples under the scenario. Then, other indicators will be combined to help characterize the risk scenarios, thereby improving the effectiveness of the rules.

[0121] The seventh step is to construct new rules. The construction logic is the same as in the sixth step: first, characterize the core indicators, and then supplement them with other indicators to improve the effectiveness of the rules.

[0122] Step 8: Rule scoring. Rules are scored based on "risk occurrence frequency and risk severity." If a rule has a particularly high historical accuracy rate and a high risk severity, this invention can directly assign a warning score. If a rule has a low historical accuracy rate but the account in the scenario is 100% suspicious in terms of business operations, a warning score is also directly assigned. If the severity of the business risk in the scenario is not high, scores are assigned according to a gradient based on the rule's accuracy rate. Figure 5 The diagram shown is a logic diagram of the scoring system rules.

[0123] In one embodiment of the present invention, model optimization involves threshold and indicator adjustment: model optimization not only focuses on the coverage of a feature for black samples, but also on its ability to distinguish between black and white samples at different thresholds, thereby constructing indicator thresholds that can effectively distinguish between black and white samples. By analyzing the investigation results and feedback from business departments, existing rules are adjusted by adding or removing indicators and adjusting thresholds to increase coverage of risky accounts while reducing the probability of false triggers for normal accounts. For example, thresholds for indicators such as amount or number of transactions may be adjusted, or a rule consisting of two indicators may be changed to three indicators, thereby achieving better early warning results.

[0124] like Figure 6 As shown, by statistically analyzing the number of Type A transactions occurring N hours before the current transaction at different quantiles in the black and white samples, we can conclude that, compared to normal accounts, illicit accounts are more likely to engage in Type A transactions before the transfer of illicit funds, while normal accounts rarely exhibit such behavior. Therefore, setting the threshold for this indicator to ≥2 can filter out 90% of normal accounts while covering 70% of the illicit accounts.

[0125] Rule iteration: The rule system is continuously updated based on the latest information on cases reported by the public security authorities and new scenarios reported by branches during business operations, and new features are added to improve coverage.

[0126] Scoring Adjustment: Adjust the rule weights and assign scores based on the severity and frequency of risk occurrence.

[0127] In one embodiment of the present invention, the risk level assessment and early warning strategy is as follows: This solution constructs a complete real-time risk early warning and control system: Each account is dynamically risk-scored through a real-time scoring mechanism, and different risk levels (including no risk, low risk, medium risk, and high risk) are set based on multi-level early warning lines; differentiated control strategies are implemented for different risk levels. Accounts with high accuracy scores are automatically controlled and investigated directly, while accounts with medium accuracy scores are investigated first before a decision is made on whether to control them; the entire judgment and execution logic is driven by a rule engine, supporting flexible switching between trigger-based and scoring-based rules; to ensure timely response, an efficient data flow transmission scheme is designed to ensure that the list of risky accounts can be promptly pushed to the anti-fraud system for processing; simultaneously, an online early warning account screening system for employee channels is constructed to improve the real-time performance and operability of early warning list processing; finally, the early warning results are summarized and visualized through a data application platform to provide decision support for management.

[0128] In one embodiment of the present invention, the model deeply mines risk characteristics through case characterization, feature ruleization, and rule indexation, transforming them into actionable rules. This involves the comprehensive application of regulatory laws, media reports, black sample analysis, and branch feedback to extract modus operandi and abnormal behavior patterns, forming an expert rule system. A combination of scoring and triggering mechanisms is employed: a dual-track parallel architecture of "scoring + triggering" is adopted to form an offensive and defensive system. The scoring system serves as the rule foundation, assigning scores to sub-scenarios such as real-time transactions, unfamiliar counterparties, and bill payment on behalf of others based on business risk weights and data risk performance. The model's total score is calculated through dynamic accumulation, and warning lines and multi-level thresholds (30-40-50+) are set to finely classify low, medium, and high risk levels, achieving quantitative assessment of routine risks. The triggering mechanism focuses on high-risk characteristics, adopting a veto mechanism for specific extremely high-risk business rules such as nighttime bulk transactions and police blacklists. Once triggered, high risk is directly determined, and the control list is rapidly iterated for quick interception. The two complement each other: the former covers a wide range and provides precise stratification, while the latter focuses on depth and offers rapid response, together building a dynamic risk control defense line that balances efficiency and security. Figure 7 Modeling a logic diagram for a scoring system + trigger system.

[0129] This solution introduces an advanced risk warning and control strategy, with its core being a dynamic optimization mechanism. This mechanism optimizes rule parameter thresholds, adjusts the number of rules, and evaluates rule effectiveness through methods such as single-indicator quantile analysis, overall warning volume analysis, and rule warning volume rationality checks, continuously improving the model's effectiveness and stability. Furthermore, considering the actual account characteristics and local conditions of each branch, it achieves localization and personalized customization of risk identification rules, improving the targeting and effectiveness of risk prevention and control measures. Technically, the bank actively explores the application possibilities of real-time machine learning models, utilizing multiple data sources such as financial transaction logs, account tables, and customer tables. It uses cutting-edge machine learning algorithms to rank the importance of fraud-related risk characteristics and integrates these findings into rule model construction. Combining artificial intelligence technology and expert experience, it constructs composite ratio indicators and time window indicators, thereby enhancing the risk warning capability of the in-process rule system. For post-warning control strategies, differentiated risk control measures are adopted based on the rule hit rate, ensuring efficient risk prevention and control while maintaining customer experience. It supports real-time or near-real-time monitoring modes, enabling suspicious transactions to be quickly intercepted shortly after they occur, effectively reducing the loss of funds involved in the case. Finally, by establishing a cross-departmental collaboration mechanism, we achieved cooperation and sharing with the head office business departments, the big data intelligence center, and other institutions, including in terms of systems, technical support, and data transmission, which jointly improved the overall efficiency of model construction and application.

[0130] In summary, the key features of the corporate anti-gambling and anti-fraud model lie in in-depth risk feature identification, a combination of flexible and efficient scoring and triggering systems, dynamic optimization strategies, localization and personalization, multi-dimensional data fusion, early warning and control strategies, real-time and near-real-time monitoring capabilities, and innovative sharing mechanisms. The aim is to protect financial institutions from telecommunications network fraud and improve the effectiveness and response speed of corporate account anti-telecom fraud management.

[0131] This invention presents a corporate account anti-fraud method that integrates machine learning and expert rules. First, the model effectively identifies and accurately characterizes risk features by combining expert rules with machine learning techniques. It can extract key risk features from a large number of historical cases, regulatory regulations, and media reports, and transform them into actionable monitoring rules. This not only improves the model's coverage but also enhances its adaptability and flexibility in the face of new fraud methods. Second, it adopts a scoring-based + trigger-based early warning mechanism, which has higher stability and adjustability compared to traditional trigger-based rules. The scoring system allows for flexible control of the rule's control rate and coverage by adjusting the early warning score threshold, thus finding the optimal balance between accuracy and coverage. This mechanism reduces the reliance on the accuracy of individual rules, enabling the model to respond more quickly to new risk scenarios and maintain a high level of early warning effectiveness. Simultaneously, it allows for agile iteration for missed black samples and newly emerging features, and can be quickly deployed when the system supports it. Furthermore, the model design incorporates localized features, fully considering the actual business environment and specific risk scenarios of branches, improving the targeting and efficiency of anti-gambling and anti-fraud governance. For example, targeted monitoring of new risk scenarios such as abnormal cash withdrawals at specific locations helps prevent problems before they occur, building a firewall against potential risks. Finally, the model implementation emphasizes overall coordination and innovation sharing, forming a continuously optimized and improved cyclical system. Through continuous data exploration, rule optimization, and strategy adjustments, the risk prevention and control mechanism has been intelligently upgraded, effectively enhancing the comprehensive management capabilities and market competitiveness of banking financial institutions in the field of anti-telecom fraud for corporate accounts. This multi-dimensional, multi-layered risk management system can better adapt to the complex and ever-changing landscape of telecom and online fraud, protecting the funds of banks and customers.

[0132] Example 7 To implement the methods of the above embodiments, the present invention also provides a corporate account anti-fraud system that integrates machine learning and expert rules, such as... Figure 8 As shown, it includes: The data acquisition and feature extraction module 100 is used to acquire multi-source heterogeneous data from regulatory regulations, media reports, black sample transaction records and branch feedback information, and generate a risk feature wide table through data cleaning, format standardization and business logic verification. The dual-stage feature screening module 200 is used to optimize features based on the risk feature wide table using a dual-stage feature screening algorithm. The dual-stage feature screening algorithm includes: a first stage of processing data in blocks and iteratively eliminating redundant features through a dynamic resource allocation strategy; and a second stage of integrating multiple feature importance evaluation methods to calculate feature contribution and retaining Top N high-value features. The hybrid risk assessment architecture construction module 300 is used to transform optimized features into scoring rules and triggering rules. The scoring rules calculate dynamic risk scores by weighting multi-dimensional risk features. The triggering rules set real-time warning thresholds for high-risk features, realizing the synergy between quantitative risk assessment and real-time interception of key features. The regional risk profile dynamic adjustment module 400 is used to dynamically adjust the rule parameters in the hybrid risk assessment architecture according to the regional risk profile. It matches regional risk patterns through a localized feature library, automatically increases the scoring weight of specific regional features, and quickly migrates and deploys regional features based on a branch-level rule template library to generate rule parameter update schemes adapted to risk features in different regions or industries.

[0133] Furthermore, the two-stage feature filtering module is also used for: The risk characteristic wide table is divided into Each data block contains [number] data blocks. 1 sample, of which The total number of samples, Hyperparameters for controlling block granularity; By eliminating features through multiple rounds of iteration, random selection is made in each iteration. Each data block is evaluated, and the top 50% of features are retained for the next iteration until a feature set with positive incremental value scores is output.

[0134] Furthermore, the hybrid risk assessment architecture building block is also used for: Through calculation formula The rules are scored, among which The number of iterations for ranking importance evaluation. For the first Predicted value after randomly arranging 10 feature values; A risk-delayed retention algorithm is set up for high-risk characteristics. When an account triggers a specific rule, the impact of that rule is... It remains in effect for hours, among which This is the preset delay retention time parameter.

[0135] Furthermore, the regional risk profile dynamic adjustment module is also used for: By matching regional risk patterns with a localized feature library, the scoring weight of specific regional features is automatically increased; Based on a branch-level rule template library, regional features can be quickly migrated and deployed to generate rule parameter update schemes that are adapted to the risk characteristics of different regions or industries.

[0136] Furthermore, it also includes: The scoring threshold dynamic adjustment module is used to dynamically adjust the scoring threshold of the hybrid risk assessment architecture based on historical early warning effects. It sets the scoring threshold by statistically analyzing the difference in feature quantiles between black samples and white samples. When a low-risk warning is triggered, A medium-risk warning was triggered at that time. A high-risk warning is triggered at this time.

[0137] The corporate account anti-fraud system that integrates machine learning and expert rules in this invention can significantly improve the accuracy and real-time performance of corporate account anti-fraud detection, effectively cope with the rapid evolution of fraud methods, reduce false alarm rate and expand the coverage of risk scenarios, and enhance the system's adaptability through dynamic feature screening and localized risk profiling.

[0138] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0139] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0140] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A method for preventing fraud in corporate accounts that integrates machine learning and expert rules, characterized in that, include: S1. Acquire multi-source heterogeneous data and extract features. The multi-source heterogeneous data includes regulatory laws and regulations, media reports, black sample transaction records and branch feedback information. Generate a risk feature wide table through data cleaning, format standardization and business logic verification. S2, based on the aforementioned risk feature wide table, a two-stage feature selection algorithm is used for feature optimization. The two-stage feature selection algorithm includes: in the first stage, data is processed in blocks and redundant features are iteratively eliminated through a dynamic resource allocation strategy; in the second stage, multiple feature importance evaluation methods are integrated to calculate feature contribution and retain the Top N high-value features. S3. Construct a hybrid risk assessment architecture, which transforms the optimized features into scoring rules and triggering rules. The scoring rules calculate dynamic risk scores by weighting multi-dimensional risk features, and the triggering rules set real-time warning thresholds for high-risk features, thereby achieving synergy between quantitative risk assessment and real-time interception of key features. S4. Based on the regional risk profile, the rule parameters in the hybrid risk assessment architecture are dynamically adjusted. By matching regional risk patterns through a localized feature library, the scoring weights and triggering conditions are automatically updated to form a closed-loop iterative rule system that adapts to the risk characteristics of different regions or industries.

2. The method as described in claim 1, characterized in that, S2, based on the risk feature wide table, employs a two-stage feature selection algorithm for feature optimization, and further includes: S21, the risk characteristic wide table is divided into Each data block contains [number] data blocks. 1 sample, of which The total number of samples, Hyperparameters for controlling block granularity; S22 eliminates features through multiple rounds of iteration, randomly selecting features in each iteration. Each data block is evaluated, and the top 50% of features are retained for the next iteration until a feature set with positive incremental value scores is output.

3. The method as described in claim 1, characterized in that, The S3 architecture for constructing a hybrid risk assessment also includes: S31, the scoring system rules are calculated using a formula. The rules are scored, among which The number of iterations for ranking importance evaluation. For the first Predicted value after random permutation of eigenvalues; S32, the triggering rule sets a risk delay retention algorithm for high-risk characteristics. When an account triggers a specific rule, the impact of that rule is... It remains in effect for hours, among which This is the preset delay retention time parameter.

4. The method as described in claim 1, characterized in that, The S4 method, which dynamically adjusts the rule parameters in the hybrid risk assessment architecture based on the regional risk profile, also includes: S41 automatically increases the scoring weight of specific regional features by matching regional risk patterns with a localized feature library. S42, based on a branch-level rule template library, enables rapid migration and deployment of regional features, generating rule parameter update schemes adapted to the risk characteristics of different regions or industries.

5. The method as described in claim 1, characterized in that, Also includes: S5, dynamically adjust the scoring threshold of the hybrid risk assessment architecture based on historical early warning effects, and set the scoring threshold to [value] by statistically analyzing the difference in feature quantiles between black samples and white samples. When a low-risk warning is triggered, A medium-risk warning was triggered at that time. A high-risk warning is triggered at this time.

6. A corporate account anti-fraud system integrating machine learning and expert rules, characterized in that, include: The data acquisition and feature extraction module is used to acquire multi-source heterogeneous data from regulatory regulations, media reports, black sample transaction records and branch feedback information, and generate a risk feature wide table through data cleaning, format standardization and business logic verification. The two-stage feature selection module is used to optimize features based on the risk feature wide table using a two-stage feature selection algorithm. The two-stage feature selection algorithm includes: a first stage of processing data in blocks and iteratively eliminating redundant features through a dynamic resource allocation strategy; and a second stage of integrating multiple feature importance assessment methods to calculate feature contribution and retaining the Top N high-value features. The hybrid risk assessment architecture construction module is used to transform optimized features into scoring rules and triggering rules. The scoring rules calculate dynamic risk scores by weighting multi-dimensional risk features. The triggering rules set real-time warning thresholds for high-risk features, realizing the synergy between quantitative risk assessment and real-time interception of key features. The regional risk profile dynamic adjustment module is used to dynamically adjust the rule parameters in the hybrid risk assessment architecture based on the regional risk profile. It matches regional risk patterns through a localized feature library, automatically increases the scoring weight of specific regional features, and quickly migrates and deploys regional features based on a branch-level rule template library to generate rule parameter update schemes adapted to risk characteristics of different regions or industries.

7. The system as described in claim 6, characterized in that, The two-stage feature filtering module is also used for: The risk characteristic wide table is divided into Each data block contains [number] data blocks. 1 sample, of which The total number of samples, Hyperparameters for controlling block granularity; By eliminating features through multiple rounds of iteration, random selection is made in each iteration. Each data block is evaluated, and the top 50% of features are retained for the next iteration until a feature set with positive incremental value scores is output.

8. The system as described in claim 6, characterized in that, The hybrid risk assessment architecture building module is also used for: Through calculation formula The rules are scored, among which The number of iterations for ranking importance evaluation. For the first Predicted value after random permutation of eigenvalues; A risk-delayed retention algorithm is set up for high-risk characteristics. When an account triggers a specific rule, the impact of that rule is... It remains in effect for hours, among which This is the preset delay retention time parameter.

9. The system as described in claim 6, characterized in that, The regional risk profile dynamic adjustment module is also used for: By matching regional risk patterns with a localized feature library, the scoring weight of specific regional features is automatically increased; Based on a branch-level rule template library, regional features can be quickly migrated and deployed to generate rule parameter update schemes that are adapted to the risk characteristics of different regions or industries.

10. The system as described in claim 6, characterized in that, Also includes: The scoring threshold dynamic adjustment module is used to dynamically adjust the scoring threshold of the hybrid risk assessment architecture based on historical early warning effects. It sets the scoring threshold by statistically analyzing the difference in feature quantiles between black samples and white samples. When a low-risk warning is triggered, A medium-risk warning was triggered at that time. A high-risk warning is triggered at this time.

Images