Risk early warning method, device, equipment, medium and program product

Abstract

This application provides a risk warning method applicable to the field of artificial intelligence technology. The method includes: responding to a transaction operation initiated by a target object, acquiring transaction information generated by the execution of the transaction operation; inputting the transaction information into multiple risk detection models with different hit types to determine the risk level of the target object based on the detection results output by each model; if the risk level is the target level, constructing a transaction graph of the target object based on the transaction information; performing a risk assessment on the transaction links between the target object and the trading objects in the transaction graph to obtain the assessment result; and generating a risk warning strategy for the target object and the trading objects based on the assessment result. This application also provides a risk warning device, equipment, storage medium, and program product.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, specifically to a risk warning method, apparatus, device, medium, and program product. Background Technology

[0002] With the rapid development of digital businesses, the need for risk detection during user transactions is becoming increasingly prominent. Related technologies primarily involve analyzing user profile characteristics and historical transaction behavior data to build risk warning models, enabling real-time identification and early warning of transaction risks.

[0003] In the process of realizing the concept of this invention, it was found that the related technologies have at least the following problems: judging the risk of the current transaction operation based solely on user profile characteristics and historical transaction behavior data has low accuracy and makes it difficult to generate a comprehensive risk response plan in a timely manner, resulting in low overall risk control efficiency. Summary of the Invention

[0004] In view of the above problems, this application provides a risk warning method, apparatus, equipment, medium and program product.

[0005] According to a first aspect of this application, a risk warning method is provided, comprising: in response to a transaction operation initiated by a target object, acquiring transaction information generated by executing the transaction operation; inputting the transaction information into multiple risk detection models with different hit types to determine the risk level of the target object based on the detection results output by each of the risk detection models; if the risk level is the target level, constructing a transaction graph of the target object based on the transaction information; performing a risk assessment on the transaction links between the target object and the transaction objects in the transaction graph to obtain an assessment result; and generating a risk warning strategy for the target object and the transaction objects based on the assessment result.

[0006] According to an embodiment of this application, the transaction information is sequentially input into multiple risk detection models for risk feature detection based on the priority order of the hit types of each of the aforementioned risk detection models. After determining the risk level based on the detection result output by any of the aforementioned risk detection models, the detection process is terminated. The multiple hit types include high hit type, medium hit type, and low hit type.

[0007] According to an embodiment of this application, the above-mentioned input of the transaction information into multiple risk detection models with different hit types to determine the risk level of the target object based on the detection results output by each of the risk detection models includes: inputting the transaction information into multiple risk detection models sequentially for risk feature detection according to the priority order of the hit types of each of the risk detection models, and terminating the detection process after determining the risk level based on the detection results output by any of the risk detection models, wherein the multiple hit types include high hit type, medium hit type and low hit type.

[0008] According to an embodiment of this application, the above-mentioned inputting the transaction information into multiple risk detection models with different hit types to determine the risk level of the target object based on the detection results output by each of the risk detection models further includes: sequentially inputting the transaction information into multiple risk detection models; if the detection results output by the high-hit-type risk detection model indicate that the transaction information has risk characteristics, determining the risk level as a warning level, wherein the warning level indicates that the transaction has risk and the transaction operation must be terminated immediately; if the detection results output by the medium-hit-type risk detection model indicate that the transaction information has risk characteristics, determining the risk level as the target level; and if the detection results output by the low-hit-type risk detection model indicate that the transaction information has risk characteristics, determining the risk level as an observation level, wherein the observation level indicates that the transaction has risk but the transaction operation is allowed to continue.

[0009] According to an embodiment of this application, the above-mentioned risk assessment of the transaction links between the target objects and transaction objects in the transaction graph to obtain assessment results includes: using a graph algorithm model to perform anomaly detection analysis on the connection patterns of the transaction links in the transaction graph to obtain analysis results; obtaining attribute feature data of each of the transaction objects in the transaction graph, wherein the attribute feature data includes location information, transaction frequency, and active time periods; determining risk values ​​corresponding to the analysis results and the attribute feature data respectively based on a preset risk scoring mapping relationship; and integrating and calculating multiple risk values ​​through a weighted fusion algorithm to obtain the assessment result of the transaction graph.

[0010] According to an embodiment of this application, the above-mentioned generation of risk warning strategies for the target object and the transaction object based on the above-mentioned evaluation results includes: when it is determined that the above-mentioned evaluation result is greater than a preset threshold, determining a corresponding warning strategy template based on the abnormal type of the transaction link in the above-mentioned analysis results; generating a risk warning strategy for suspending transaction permissions for the target object and the transaction object based on the above-mentioned warning strategy template; when it is determined that the above-mentioned evaluation result is less than or equal to the above-mentioned preset threshold, generating a risk warning strategy for triggering a manual review mechanism for the target object; and generating a risk warning strategy for sending a prompt message for the transaction object.

[0011] According to an embodiment of this application, the method further includes: obtaining a test sample set from a business system based on a preset period, the test sample set including multiple test objects and test transaction information corresponding to each test object; inputting the test sample set into each of the aforementioned risk detection models for detection, and determining the hit rate of each of the aforementioned risk detection models for the test objects; determining the current hit type of each of the aforementioned risk detection models based on a preset mapping relationship between the hit type and the hit rate; and dynamically updating the hit type of the corresponding aforementioned risk detection model based on the current hit type.

[0012] According to an embodiment of this application, the method further includes: for each of the risk detection models that have completed the above-mentioned hit type update, based on a preset sliding step size and a preset window length, using the above-mentioned test sample set to perform rolling detection on the risk detection model, continuously determining the hit rate of the risk detection model within the above-mentioned preset window length, until the above-mentioned test sample set has been traversed; calculating the mean of the hit rate within each above-mentioned preset window length, so as to determine the actual hit type of the risk detection model based on the calculated mean; and dynamically optimizing the parameters of the risk detection model based on the above-mentioned mean when it is determined that the updated hit type is consistent with the above-mentioned actual hit type.

[0013] A second aspect of this application provides a risk warning device, comprising: an information acquisition module, configured to acquire transaction information generated by executing a transaction operation initiated by a target object in response to such transaction operation; a risk detection module, configured to input the transaction information into multiple risk detection models with different hit types, and determine the risk level of the target object based on the detection results output by each of the risk detection models; a graph construction module, configured to construct a transaction graph of the target object based on the transaction information when the risk level is the target level; a risk assessment module, configured to assess the risk of the transaction links between the target object and the transaction object in the transaction graph, and obtain an assessment result; and a strategy generation module, configured to generate a risk warning strategy for the target object and the transaction object based on the assessment result.

[0014] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0015] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0016] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0017] According to embodiments of this application, by inputting the transaction information of the target object into multiple risk detection models with different hit types, and determining the risk level of the target object based on the detection results output by the models, the accuracy of risk level determination is effectively improved. When the risk level reaches the target level, a transaction graph is constructed based on the transaction information and the transaction chain is evaluated. Then, a risk warning strategy for the target object and the transaction object is generated based on the evaluation results. By combining the risk assessment of the transaction chain, in-depth analysis and scenario-based early warning of the target level risk are realized. Through the linkage mechanism between the risk detection model and the transaction graph analysis, the collaborative generation of risk level determination and accurate early warning strategy is realized, supporting intelligent processing of the entire process from transaction information acquisition to risk warning strategy generation, effectively improving the accuracy of risk identification and the effectiveness of early warning response. Attached Figure Description

[0018] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0019] Figure 1 The illustrations depict application scenarios of risk warning methods, apparatus, devices, media, and program products according to embodiments of this application.

[0020] Figure 2 A flowchart illustrating a risk warning method according to an embodiment of this application is shown schematically.

[0021] Figure 3 The diagram illustrates a transaction graph in a risk warning method according to an embodiment of this application.

[0022] Figure 4 This illustration schematically shows a data interaction diagram in a risk warning method according to an embodiment of this application;

[0023] Figure 5 This schematically illustrates a structural block diagram of a risk warning device according to an embodiment of this application; and

[0024] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a risk warning method according to an embodiment of this application. Detailed Implementation

[0025] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0026] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0027] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0028] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0029] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0030] This application provides a risk warning method that, in response to a transaction operation initiated by a target object, acquires transaction information generated by executing the transaction operation; inputs the transaction information into multiple risk detection models with different hit types to determine the risk level of the target object based on the detection results output by each risk detection model; if the risk level is the target level, constructs a transaction graph of the target object based on the transaction information; performs a risk assessment on the transaction links between the target object and the transaction objects in the transaction graph to obtain an assessment result; and generates a risk warning strategy for the target object and the transaction objects based on the assessment result.

[0031] Figure 1 The illustration shows application scenarios of risk warning methods, apparatus, devices, media, and program products according to embodiments of this application.

[0032] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, and a server 105. Network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0033] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0034] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0035] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0036] It should be noted that the risk warning method provided in this application embodiment can generally be executed by server 105. Correspondingly, the risk warning device provided in this application embodiment can generally be set in server 105. The risk warning method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the risk warning device provided in this application embodiment can also be set in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0037] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0038] The following will be based on Figure 1 The described scene, through Figures 2-4 The risk warning method according to the embodiments of this application will be described in detail.

[0039] Figure 2 A flowchart illustrating a risk warning method according to an embodiment of this application is shown.

[0040] like Figure 2 As shown, the risk warning method includes operations S210 to S250.

[0041] In operation S210, in response to a transaction operation initiated by the target object, the transaction information generated by executing the transaction operation is obtained.

[0042] In operation S220, transaction information is input into multiple risk detection models with different hit types to determine the risk level of the target object based on the detection results output by each risk detection model.

[0043] When operating S230, with the risk level set at the target level, a transaction graph of the target object is constructed based on transaction information.

[0044] In operation S240, a risk assessment is performed on the transaction link between the target object and the transaction object in the transaction graph, and the assessment result is obtained.

[0045] When operating S250, risk warning strategies are generated based on the assessment results for the target and trading objects.

[0046] When a target object initiates a transaction, the transaction information generated by that transaction is captured in real time through the transaction interface. This transaction information includes key details such as the target object's identity, relevant information about the transaction object, transaction amount, transaction time, transaction type, transaction channel, and operating device information, to ensure the integrity of the data required for subsequent analysis. In embodiments of this application, the target object's consent or authorization can be obtained before acquiring the transaction information.

[0047] The collected transaction information is standardized according to a preset data format and then input into multiple risk detection models with different hit types. These risk detection models each focus on different risk dimensions: for example, some models emphasize identifying obvious risk characteristics (such as unusually large transfers), some focus on analyzing behavioral patterns (such as frequent transactions across time zones), and others are responsible for monitoring potential associated risks. Each risk detection model independently calculates and outputs corresponding detection results based on the input transaction information; these results may be in the form of risk scores, risk labels, etc. Subsequently, by comprehensively analyzing these detection results, the current risk level of the target object is finally determined.

[0048] If the risk level reaches the preset target level, it means that a more in-depth risk assessment is needed. At this point, a transaction graph of the target object will be constructed based on the acquired transaction information and related historical transaction data. During the construction process, the target object is used as the core node, and all its transaction objects are used as related nodes. Connections between nodes are established through transaction records to form transaction chains. At the same time, specific attributes of the transactions, such as transaction amount, transaction time, and number of transactions, are labeled on the connection edges, thereby generating a visual transaction relationship network.

[0049] Figure 3 The diagram illustrates a transaction graph in a risk warning method according to an embodiment of this application.

[0050] like Figure 3 As shown, the transaction map consists of two distinct geographical regions: Region 330 and Region 340. In Region 330, target object 310 is designated as the core node, and transaction objects 320 that have transactions with target object 310 are designated as associated nodes. A complete transaction chain is formed by constructing connections between these nodes. This visualization method not only clearly displays the transaction relationship network of target objects but also intuitively presents the capital flow paths between various transaction objects, providing effective visualization support for transaction risk assessment and behavioral analysis.

[0051] For the constructed transaction graph, the system automatically identifies and extracts all transaction links between the target object and each other, including direct transaction links and multi-level indirect transaction links formed through other transaction objects. Subsequently, a graph algorithm model is used to assess the risk of these transaction links. Specifically, the assessment includes the length of the transaction link, the risk characteristics of the involved transaction objects, the flow pattern of transaction amounts, and the complexity of the transaction link. By comprehensively analyzing these factors, the risk level of each transaction link is determined, and a quantitative or qualitative assessment result is ultimately generated.

[0052] Based on the assessment results of the transaction chain, a risk warning strategy generation mechanism is activated. For target entities, if the assessment results indicate a high risk, risk warning strategies may be generated, such as restricting some of their trading permissions, requiring secondary identity verification, or suspending trading. For trading entities, if they are identified as risk sources or key risk nodes in the transaction chain, risk warning strategies may be generated, such as marking them as high-risk users, restricting their trading interactions with other users, or notifying relevant regulatory authorities. Furthermore, the risk warning strategies will include specific execution times, triggering conditions, and corresponding processing procedures to ensure that they accurately and effectively address identified risks.

[0053] By inputting the transaction information of the target object into multiple risk detection models with different hit types, and determining the risk level of the target object based on the model output, the accuracy of risk level determination is effectively improved. When the risk level reaches the target level, a transaction graph is constructed based on the transaction information, and the transaction chain is evaluated. Then, based on the evaluation results, a risk warning strategy for the target object and the transaction object is generated. Combined with the risk assessment of the transaction chain, in-depth analysis and scenario-based early warning of the target level risk are achieved. Through the linkage mechanism between the risk detection model and the transaction graph analysis, the collaborative generation of risk level determination and accurate early warning strategy is realized, supporting intelligent processing of the entire process from transaction information acquisition to risk warning strategy generation, effectively improving the accuracy of risk identification and the effectiveness of early warning response.

[0054] According to an embodiment of this application, transaction information is input into multiple risk detection models with different hit types to determine the risk level of the target object based on the detection results output by each risk detection model. This includes: inputting transaction information into multiple risk detection models sequentially for risk feature detection according to the priority order of the hit types of each risk detection model, and terminating the detection process after determining the risk level based on the detection results output by any risk detection model. The multiple hit types include high hit type, medium hit type, and low hit type.

[0055] The priority order of different risk detection models' hit types is pre-set, arranged in the order of high hit type, medium hit type, and low hit type, ensuring that high-hit-type risk detection models participate in the detection process first. Once the transaction information of the target object is obtained, the transaction information is first input into the high-hit-type risk detection model. High-hit-type risk detection models typically perform precise detection of known high-risk characteristics, such as scenarios involving large-scale abnormal fund transfers or direct transactions with blacklisted accounts, which clearly indicate high risk.

[0056] If the high-hit-rate risk detection model outputs a result that clearly defines the risk level of the target object, such as directly determining it as high risk, then the entire detection process will terminate immediately, and the transaction information will no longer be input into the subsequent medium-hit-rate and low-hit-rate models. Conversely, if the high-hit-rate model fails to determine the risk level of the target object, then the transaction information will be passed to the medium-hit-rate risk detection model. The medium-hit-rate model mainly focuses on medium-risk characteristics, such as transaction frequency exceeding the normal range, transaction regions not matching the user's usual regions, etc., which indicate potential risks but do not reach the high-risk level.

[0057] Similarly, the detection process terminates when the risk level is determined by the output of the hit-type risk detection model. If it cannot be determined, the transaction information is then input into the low-hit-type risk detection model. The low-hit-type risk detection model primarily detects low-risk characteristics, such as transaction amounts slightly higher than the user's historical average or transactions occurring during inactive periods. Once the low-hit-type model's output clearly identifies the risk level of the target object, the detection process terminates immediately.

[0058] If none of the three risk detection models mentioned above detect any risk characteristics in the transaction information, it indicates that the transaction operation is risk-free, and the detection process ends. This method of detecting risks sequentially based on priority and terminating promptly improves detection efficiency and reduces unnecessary model computation while ensuring the accuracy of risk identification.

[0059] According to embodiments of this application, transaction information is input into multiple risk detection models with different hit types to determine the risk level of the target object based on the detection results output by each risk detection model. The method further includes: sequentially inputting transaction information into multiple risk detection models; determining a warning level when the detection results output by a high-hit-type risk detection model indicate that the transaction information has risk characteristics; indicating that the transaction has risk and the transaction operation must be terminated immediately; determining a target level when the detection results output by a medium-hit-type risk detection model indicate that the transaction information has risk characteristics; and determining an observation level when the detection results output by a low-hit-type risk detection model indicate that the transaction information has risk characteristics, indicating that the transaction has risk but the transaction operation is allowed to continue.

[0060] When performing risk detection on transaction information, the transaction information is input into the corresponding risk detection model in a priority order of high hit rate, medium hit rate, and low hit rate. These risk detection models all run based on pre-deployed rule model code, and their parameters are automatically adjusted to achieve preset hit rate thresholds. The risk detection models are classified according to their hit rate: high hit rate models have a hit rate above 60%, medium hit rate models have a hit rate between 20% and 60%, and low hit rate models have a hit rate below 20%. Simultaneously, the risk detection models combine the target object's attribute feature data and unstructured data obtained through text mining (such as behavioral logs and transfer notes in the transaction information) to enrich the feature dimensions.

[0061] When transaction information is input into a high-hit-rate risk detection model, if the model's output indicates that the transaction information exhibits risk characteristics, the risk level is directly determined to be a warning level. A warning level clearly indicates that the transaction carries risk, and because the high-hit-rate risk detection model has a high accuracy rate, the corresponding risk requires immediate attention. Therefore, it will trigger the immediate termination of the transaction to prevent the risk from escalating.

[0062] If a high-hit-rate risk detection model fails to detect risk characteristics, the transaction information will be input into a medium-hit-rate risk detection model. When the output of the medium-hit-rate risk detection model indicates that the transaction information contains risk characteristics, the risk level is determined as the target level. If the risk level corresponding to the target level is moderate, it needs to proceed to a more in-depth risk screening process, such as constructing a transaction graph and assessing the risks of the transaction chain.

[0063] If the risk detection model with a medium hit rate also fails to detect any risk characteristics, the transaction information will be further input into the risk detection model with a low hit rate. When the detection result output by the risk detection model with a low hit rate indicates that the transaction information contains risk characteristics, the risk level is determined to be the observation level. The observation level means that the risk level of the transaction is low, allowing the transaction to continue, but the transaction and related trading objects will be continuously monitored, and subsequent transaction dynamics will be recorded to keep track of any possible changes in risk.

[0064] This tiered detection mechanism can efficiently identify transactions of different risk levels, ensuring that high-risk transactions are blocked in a timely manner, medium-risk transactions are thoroughly investigated, and low-risk transactions are conducted safely under monitoring, thereby improving the accuracy of risk identification and processing efficiency.

[0065] According to embodiments of this application, a risk assessment is performed on the transaction links between target objects and transaction objects in a transaction graph to obtain assessment results. This includes: using a graph algorithm model to perform anomaly detection analysis on the connection patterns of transaction links in the transaction graph to obtain analysis results; acquiring attribute feature data of each transaction object in the transaction graph, wherein the attribute feature data includes location information, transaction frequency, and active time periods; determining risk values ​​corresponding to the analysis results and attribute feature data respectively based on a preset risk scoring mapping relationship; and integrating and calculating multiple risk values ​​through a weighted fusion algorithm to obtain the assessment results of the transaction graph.

[0066] When using graph algorithm models to perform anomaly detection and analysis on the connection patterns of transaction links in a transaction graph, the focus is on identifying abnormal paths such as high-frequency cross-account transfers, multi-level transfers within a short period of time, and closed-loop transactions (such as the fund return pattern A→B→C→A). The graph algorithm model is used to quantitatively analyze the topology, flow frequency, and fund flow of these connection patterns, ultimately outputting analysis results that include anomaly path markers and anomaly types, providing a foundation for subsequent risk assessment.

[0067] When conducting risk assessment, we obtain attribute characteristic data of each trading object in the transaction map, including key dimensions such as the location information of the trading object (to reflect the geographical span), the frequency of transactions with other objects, and the active periods of daily transactions, to ensure the comprehensiveness of the assessment dimensions.

[0068] Based on a pre-defined risk scoring mapping relationship, the analysis results output by the graph algorithm model are matched with corresponding risk values ​​for the attribute feature data of each trading object. The analysis results will correspond to different risk scores based on the type of anomaly (e.g., closed-loop trading may correspond to a higher score, while high-frequency cross-account transfers correspond to a medium score). For attribute feature data, the greater the geographical span of the location information, the more the trading frequency exceeds the normal range, and the more significant the deviation between the active period and historical habits, the higher the corresponding risk value will be.

[0069] The aforementioned multiple risk values ​​are integrated and calculated using a weighted fusion algorithm. This algorithm weights each risk dimension according to its influence in historical risk events (e.g., the weight of anomaly connection patterns may be higher than that of a single attribute feature), ultimately yielding a comprehensive risk score. This score serves as the evaluation result for the trading graph, providing a quantitative basis for the generation of subsequent risk warning strategies. This comprehensive analysis method can accurately identify abnormal patterns and risk characteristics in the trading graph, and through quantitative analysis and the weighted fusion algorithm, effectively improve the accuracy and reliability of risk warnings.

[0070] According to an embodiment of this application, a risk warning strategy is generated for the target object and the transaction object based on the evaluation results, including: when the evaluation result is determined to be greater than a preset threshold, determining a corresponding warning strategy template based on the anomaly type of the transaction link in the analysis results; generating a risk warning strategy for suspending transaction permissions for the target object and the transaction object based on the warning strategy template; when the evaluation result is determined to be less than or equal to a preset threshold, generating a risk warning strategy for the target object that triggers a manual review mechanism; and generating a risk warning strategy for the transaction object that sends a notification message.

[0071] When the assessment result exceeds a preset threshold, a corresponding early warning strategy template is matched based on the anomaly type of the transaction chain in the analysis results (such as high-frequency cross-account transfers, short-term multi-level transfers, closed-loop transactions, etc.). Different anomaly types correspond to pre-set control rules adapted to the risk characteristics of that type. Based on the matched early warning strategy template, risk warning strategies are generated for the target object and the transaction object. Specific measures include suspending their trading permissions and prohibiting them from purchasing and transferring large-denomination negotiable certificates of deposit. This approach is consistent with the measures taken for high-hit-type risk detection models to quickly curb the continued occurrence of high-risk transactions. At the same time, it is verified whether the target object and the transaction object are on a preset list. If they belong to special users, protective measures are activated to prevent them from being mistakenly controlled.

[0072] When the assessment result is less than or equal to a preset threshold, a risk warning strategy triggering a manual review mechanism is generated for the target object. Specifically, when the target object purchases or transfers large-denomination negotiable certificates of deposit through over-the-counter channels, a manual risk screening process is triggered. For the transaction object, a risk warning strategy sending a notification message is generated, pushing relevant transaction risk characteristics to management personnel for continuous monitoring. This is similar to the processing logic of a low-hit-type risk detection model providing risk alerts to management. During this process, a preset list mechanism is also used to protect special target objects and transaction objects, preventing unnecessary control or notifications.

[0073] This tiered early warning strategy can accurately address transactions of different risk levels, effectively curbing high-risk transactions while reducing unnecessary interference to low-risk or special users, thus improving the accuracy and flexibility of risk warnings.

[0074] According to an embodiment of this application, the risk warning method further includes: obtaining a test sample set from a business system based on a preset period, the test sample set including multiple test objects and test transaction information corresponding to each test object; inputting the test sample set into each risk detection model for detection, and determining the hit rate of each risk detection model for the test object; determining the current hit type of each risk detection model based on a preset mapping relationship between the hit type and the hit rate; and dynamically updating the hit type of the corresponding risk detection model based on the current hit type.

[0075] Based on a preset period (e.g., a fixed period of 30 days), a test sample set is automatically retrieved from the business system. The test sample set contains multiple test objects and their corresponding test transaction information. Among them, the test objects are users involved in the transfer of negotiable large-denomination certificates of deposit, and the test transaction information includes financial attribute data such as transaction history, account characteristics, and service activation status.

[0076] The obtained test sample set is input into each risk detection model. Each risk detection model analyzes the test transaction information according to its own parameter configuration and generates a corresponding list of suspicious test objects. The hit rate of each risk detection model is obtained by calculating the intersection ratio between the list of suspicious test objects output by each risk detection model and the list of known test objects in the test sample set, thereby quantifying the model's ability to identify risky objects. The calculation method is shown in formula (1).

[0077] y1 = ((x1∩z1) / z1) (1)

[0078] Where x1 represents the list of suspicious test objects, z1 represents the list of known test objects, and y1 represents the hit rate.

[0079] Based on a pre-defined mapping between hit type and hit rate (high hit type corresponds to a hit rate of 60% or higher, medium hit type corresponds to a hit rate of 20%-60%, and low hit type corresponds to a hit rate below 20%), the current hit type of each risk detection model is determined according to the hit rate calculated by each model. After determining the current hit type of each risk detection model, the results are synchronized to the model management module for dynamic updates to the hit types of the corresponding risk detection models. By dynamically updating the hit types of the risk detection models, the performance changes of the models can be reflected in real time, ensuring that the models can accurately identify risks at different stages, thereby improving the adaptability and accuracy of risk detection.

[0080] According to an embodiment of this application, the risk warning method further includes: for each risk detection model that has completed the hit type update, based on a preset sliding step size and a preset window length, using a test sample set to perform rolling detection on the risk detection model, continuously determining the hit rate of the risk detection model within the preset window length, until the test sample set has been traversed; calculating the mean of the hit rate within each preset window length, so as to determine the actual hit type of the risk detection model based on the calculated mean; and dynamically optimizing the parameters of the risk detection model based on the mean when it is determined that the updated hit type is consistent with the actual hit type.

[0081] For each risk detection model that has completed the hit type update, rolling detection is performed on the risk detection model using a test sample set, according to a preset sliding step size (daily sliding) and a preset window length (30-day rolling window). Within each sliding window, the corresponding test sample set is input into the risk detection model. The risk detection model generates a list of suspicious test objects based on the current parameter configuration (e.g., high-frequency trading parameters N, M, etc. in model A), and compares it with the list of known test objects within the sliding window to calculate the hit rate within that sliding window. Subsequently, the sliding window is moved according to the preset sliding step size, and the above detection process is repeated to continuously determine the hit rate within each preset window length until all test sample sets have been traversed.

[0082] After completing the rolling detection, the mean hit rate is calculated for each preset window length. Simultaneously, the standard deviation is calculated based on the hit rate within each preset window length. Then, the dynamic threshold of the risk detection model within the current window period is determined using the threshold adjustment formula in the sliding window algorithm. The calculation method is shown in formula (2).

[0083]

[0084] Where α represents the sensitivity coefficient (determined through historical backtesting), β represents the risk level influence weight (default 0.1), RISKLEVEL represents the risk correction factor, μ represents the mean hit rate, σ represents the standard deviation of the hit rate, and Y represents the dynamic threshold.

[0085] Based on the pre-defined mapping relationship between hit type and hit rate, the actual hit type of the risk detection model is determined according to the average hit rate calculated. If the updated hit type is found to be consistent with the actual hit type, the model parameters of the risk detection model are dynamically optimized based on the average hit rate. During the optimization process, the model parameters (such as N, M, etc.) involved in the risk detection model are adjusted to bring the size of the suspicious object list generated by the risk detection model and the hit rate closer to the target threshold, while adhering to the upper bound constraint (Y≤95%, to prevent false negatives) and the lower bound constraint (Y≥70%, to prevent false positives).

[0086] If a sliding window is detected to have a sudden drop in hit rate (e.g., to 60%) due to system failure or other reasons, and the data skewness is greater than the preset value (e.g., 2), an outlier removal mechanism will be triggered. The data will be supplemented using linear interpolation, and the exponential decay weight allocation (with higher weight for recent data) and moving average method will be used for smoothing to suppress short-term fluctuations.

[0087] After optimization, the false positive rate and false negative rate under the new and old model parameters are compared through testing, and the new model parameters are applied to historical high-risk events for backtesting and verification to calculate the improvement in hit rate. At the same time, the verification results are input into the reinforcement learning model to optimize the α and β parameters in formula (2), thereby combining the back-labeled data of false positive cases reviewed by humans for the retraining of the risk detection model, and finally feeding the optimized model parameters back to the model parameter library to form an automated closed loop. By dynamically adjusting the model parameters and combining rolling detection and mean analysis, the hit rate of the risk detection model can be accurately controlled, thereby improving the accuracy of real-time interception and reducing false positive and false negative rates.

[0088] like Figure 4 As shown, after the target object initiates a transaction operation on client 410, the resulting transaction information (including transaction amount, transaction time, transaction object, etc.) is transmitted to server 420 in real time. Server 420 deploys a multi-level risk detection model, covering three types of risk detection models: high-hit, medium-hit, and low-hit, used to comprehensively analyze transaction information and assess risk levels. Based on the detection results output by each risk detection model, differentiated risk warning strategies are dynamically formulated, such as implementing real-time interception or triggering a manual review mechanism for high-risk transactions.

[0089] To continuously optimize risk detection capabilities, business system 421 regularly verifies and fine-tunes various risk detection models using test sample sets during its interaction with server 420. This closed-loop optimization mechanism effectively identifies transaction risks, promptly executes early warning measures, and significantly improves transaction security, minimizing potential losses from risky transactions.

[0090] Based on the above-mentioned risk warning method, this application also provides a risk warning device. The following will combine... Figure 5 The device is described in detail.

[0091] Figure 5 A schematic block diagram of a risk warning device according to an embodiment of this application is shown.

[0092] like Figure 5 As shown, the risk warning device 500 in this embodiment includes an information acquisition module 510, a risk detection module 520, a map construction module 530, a risk assessment module 540, and a strategy generation module 550.

[0093] The information acquisition module 510 is used to acquire transaction information generated by executing a transaction operation initiated by a target object. In one embodiment, the information acquisition module 510 can be used to execute the operation S210 described above, which will not be repeated here.

[0094] The risk detection module 520 is used to input transaction information into multiple risk detection models with different hit types, so as to determine the risk level of the target object based on the detection results output by each risk detection model. In one embodiment, the risk detection module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0095] The graph construction module 530 is used to construct a transaction graph of the target object based on transaction information when the risk level is the target level. In one embodiment, the graph construction module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0096] The risk assessment module 540 is used to assess the risk of the transaction link between the target object and the transaction object in the transaction graph, and obtain the assessment result. In one embodiment, the risk assessment module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0097] The strategy generation module 550 is used to generate risk warning strategies for target objects and trading objects based on the evaluation results. In one embodiment, the strategy generation module 550 can be used to perform the operation S250 described above, which will not be repeated here.

[0098] According to an embodiment of this application, the risk detection module 520 includes a risk detection submodule.

[0099] The risk detection submodule is used to input transaction information into multiple risk detection models in sequence according to the priority order of the hit types of each risk detection model for risk feature detection. After determining the risk level based on the detection result output by any risk detection model, the detection process is terminated. The multiple hit types include high hit type, medium hit type and low hit type.

[0100] According to an embodiment of this application, the risk detection module 520 further includes an information input submodule, an early warning determination submodule, a target determination submodule, and an observation determination submodule.

[0101] The information input submodule is used to sequentially input transaction information into multiple risk detection models. If the detection results of the high-hit-type risk detection model indicate that the transaction information has risk characteristics, the risk level is determined to be the warning level. The warning level indicates that the transaction is risky and the transaction operation must be terminated immediately.

[0102] The early warning determination submodule is used to determine the risk level as the target level when the detection results output by the risk detection model of the hit type indicate that the transaction information has risk characteristics.

[0103] The observation and determination submodule is used to determine the risk level as the observation level when the detection results output by the low-hit type risk detection model indicate that the transaction information has risk characteristics. The observation level indicates that the transaction has risk but allows the transaction operation to continue.

[0104] According to an embodiment of this application, the risk assessment module 540 includes a link analysis submodule, a feature acquisition submodule, a risk determination submodule, and a result determination submodule.

[0105] The link analysis submodule is used to perform anomaly detection and analysis on the connection patterns of transaction links in the transaction graph using a graph algorithm model, and obtain the analysis results.

[0106] The feature acquisition submodule is used to acquire the attribute feature data of each transaction object in the transaction graph. The attribute feature data includes location information, transaction frequency, and active time period.

[0107] The risk determination submodule is used to determine the risk values ​​corresponding to the analysis results and attribute feature data based on the preset risk scoring mapping relationship.

[0108] The result determination submodule integrates and calculates multiple risk values ​​using a weighted fusion algorithm to obtain the evaluation result of the transaction graph.

[0109] According to an embodiment of this application, the strategy generation module 550 includes a template determination submodule, a first strategy generation submodule, and a second strategy generation submodule.

[0110] The template determination submodule is used to determine the corresponding early warning strategy template based on the anomaly type of the transaction link in the analysis results when the evaluation result is greater than a preset threshold.

[0111] The first strategy generation submodule is used to generate risk warning strategies for suspending transaction permissions for target objects and transaction objects based on the warning strategy template.

[0112] The second strategy generation submodule is used to generate risk warning strategies that trigger manual review mechanisms for target objects when the evaluation result is determined to be less than or equal to a preset threshold; and to generate risk warning strategies that send notification information for transaction objects.

[0113] According to embodiments of this application, the risk warning device 500 further includes a test acquisition module, a hit determination module, a type determination module, and a type update module.

[0114] The test acquisition module is used to acquire test sample sets from the business system based on a preset period. The test sample set includes multiple test objects and test transaction information corresponding to each test object.

[0115] The hit determination module is used to input the test sample set into each risk detection model for detection and determine the hit rate of each risk detection model for the test object.

[0116] The type determination module is used to determine the current hit type of each risk detection model based on the preset mapping relationship between hit type and hit rate.

[0117] The type update module is used to dynamically update the hit type of the corresponding risk detection model based on the current hit type.

[0118] According to an embodiment of this application, the risk warning device 500 further includes a rolling detection module, a mean calculation module, and a parameter optimization module.

[0119] The rolling detection module is used to perform rolling detection on each risk detection model that has completed the hit type update. Based on the preset sliding step size and preset window length, it uses the test sample set to continuously determine the hit rate of the risk detection model within the preset window length until the test sample set has been traversed.

[0120] The mean calculation module is used to calculate the mean of the hit rate within each preset window length, so as to determine the actual hit type of the risk detection model based on the calculated mean.

[0121] The parameter tuning module is used to dynamically tune the parameters of the risk detection model based on the mean, provided that the updated hit type is consistent with the actual hit type.

[0122] According to embodiments of this application, any multiple modules among the information acquisition module 510, risk detection module 520, map construction module 530, risk assessment module 540, and strategy generation module 550 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the information acquisition module 510, risk detection module 520, map construction module 530, risk assessment module 540, and strategy generation module 550 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the information acquisition module 510, risk detection module 520, map construction module 530, risk assessment module 540, and strategy generation module 550 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0123] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a risk warning method according to an embodiment of this application.

[0124] like Figure 6 As shown, an electronic device 600 according to an embodiment of this application includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0125] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 602 and / or RAM 603. It should be noted that programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in one or more memories.

[0126] According to embodiments of this application, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0127] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0128] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0129] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the risk warning method provided in the embodiments of this application.

[0130] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0131] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0132] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0133] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0134] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0135] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A risk warning method, characterized in that, The method includes: In response to a transaction operation initiated by the target object, obtain the transaction information generated by executing the transaction operation; The transaction information is input into multiple risk detection models with different hit types, so as to determine the risk level of the target object based on the detection results output by each risk detection model; When the risk level is the target level, a transaction graph of the target object is constructed based on the transaction information; A risk assessment is performed on the transaction links between the target objects and transaction objects in the transaction graph, and the assessment results are obtained. Based on the assessment results, a risk warning strategy is generated for the target object and the transaction object.

2. The method according to claim 1, characterized in that, The step of inputting the transaction information into multiple risk detection models with different hit types, and determining the risk level of the target object based on the detection results output by each risk detection model, includes: According to the priority order of the hit types of each risk detection model, the transaction information is sequentially input into multiple risk detection models for risk feature detection, and the detection process is terminated after the risk level is determined based on the detection result output by any of the risk detection models. The multiple hit types include high hit type, medium hit type and low hit type.

3. The method according to claim 2, characterized in that, The step of inputting the transaction information into multiple risk detection models with different hit types to determine the risk level of the target object based on the detection results output by each risk detection model further includes: The transaction information is sequentially input into multiple risk detection models. If the detection result output by the high-hit-rate risk detection model indicates that the transaction information has risk characteristics, the risk level is determined to be a warning level. The warning level indicates that the transaction has risks and the transaction operation must be terminated immediately. If the detection result output by the risk detection model of the hit type indicates that the transaction information has risk characteristics, then the risk level is determined as the target level; If the detection result output by the low-hit-type risk detection model indicates that the transaction information has risk characteristics, the risk level is determined as the observation level. The observation level indicates that the transaction has risk but the transaction operation can continue.

4. The method according to claim 1, characterized in that, The risk assessment of the transaction links between the target object and the transaction object in the transaction graph, and the resulting assessment, include: Using a graph algorithm model, anomaly detection and analysis are performed on the connection patterns of transaction links in the transaction graph, and the analysis results are obtained. Obtain the attribute feature data of each transaction object in the transaction graph, wherein the attribute feature data includes location information, transaction frequency, and active time period; Based on a preset risk scoring mapping relationship, the risk values ​​corresponding to the analysis results and the attribute feature data are determined respectively; The evaluation result of the transaction graph is obtained by integrating and calculating multiple risk values ​​through a weighted fusion algorithm.

5. The method according to claim 4, characterized in that, The step of generating a risk warning strategy for the target object and the transaction object based on the evaluation results includes: If the evaluation result is determined to be greater than a preset threshold, a corresponding early warning strategy template is determined based on the anomaly type of the transaction link in the analysis result. Based on the aforementioned warning strategy template, a risk warning strategy for suspending transaction permissions for the target object and the transaction object is generated. If the evaluation result is determined to be less than or equal to the preset threshold, a risk warning strategy that triggers a manual review mechanism is generated for the target object; and a risk warning strategy that sends a notification message is generated for the transaction object.

6. The method according to claim 1, characterized in that, The method further includes: Based on a preset period, a test sample set is obtained from the business system. The test sample set includes multiple test objects and test transaction information corresponding to each test object. The test sample set is input into each of the risk detection models for detection, and the hit rate of each risk detection model for the test object is determined. Based on the preset mapping relationship between the hit type and the hit rate, the current hit type of each of the risk detection models is determined; Based on the current hit type, the hit type of the corresponding risk detection model is dynamically updated.

7. The method according to claim 6, characterized in that, The method further includes: For each risk detection model that has completed the hit type update, based on a preset sliding step size and a preset window length, the risk detection model is rolled to detect using the test sample set, and the hit rate of the risk detection model within the preset window length is continuously determined until the test sample set is traversed. The average hit rate within each preset window length is calculated to determine the actual hit type of the risk detection model based on the calculated average. If the updated hit type is found to be consistent with the actual hit type, the parameters of the risk detection model are dynamically optimized based on the mean.

8. A risk warning device, characterized in that, The device includes: The information acquisition module is used to acquire transaction information generated by executing the transaction operation in response to the transaction operation initiated by the target object. The risk detection module is used to input the transaction information into multiple risk detection models with different hit types, so as to determine the risk level of the target object based on the detection results output by each risk detection model; The graph construction module is used to construct a transaction graph of the target object based on the transaction information when the risk level is the target level. The risk assessment module is used to assess the risk of the transaction links between the target object and the transaction object in the transaction graph and obtain the assessment results. The strategy generation module is used to generate risk warning strategies for the target object and the transaction object based on the evaluation results.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images