Risk exploration method and device, computer device, storage medium and program product

Abstract

The application relates to a risk exploration method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: receiving a configuration operation of a risk exploration rule, generating a target exploration rule based on the configuration operation, and storing the target exploration rule in an exploration rule library; the target exploration rule is used for risk exploration on data in a specified data source; rules in the exploration rule library are scanned at a fixed time, and the enabling state of a current rule, the enabling state of each exploration index in the current rule and a data arrival signal of each exploration index are checked during the scanning process; in the case that the checking is passed, a corresponding exploration task is generated, and the exploration task is put into an exploration task queue; the exploration task in the task queue is acquired, the acquired exploration task is executed, and a risk exploration result is obtained. The method can flexibly configure multiple indexes, and can integrate exploration and early warning to realize risk exploration.

Description

Technical Field

[0001] This application relates to the field of big data processing technology, and in particular to a risk detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] With the continuous improvement of financial management requirements, the scale of data and the number of users are constantly growing, and the monitoring dimensions of various risk indicators are becoming increasingly diversified. Traditional risk detection methods mainly focus on indicators for specific scenarios, specific businesses, and specific types of customers to carry out specific risk detection and early warning work. Their flexibility is somewhat lacking and it is difficult to meet the ever-growing needs.

[0003] However, existing risk detection methods only offer configurable processing for single indicators. For the detection and early warning of complex indicators and dimensions, developers must perform customized development, resulting in poor flexibility. Furthermore, the detection and early warning systems operate relatively independently. When detecting and issuing early warnings for the same indicator, two calculations are required, making it impossible to reuse existing calculation results.

[0004] Therefore, how to flexibly configure multiple indicators and integrate detection and early warning to achieve risk detection is an urgent problem to be solved. Summary of the Invention

[0005] Therefore, it is necessary to provide a risk detection method, device, computer equipment, computer-readable storage medium, and computer program product that can flexibly configure multiple indicators and integrate detection and early warning to address the above-mentioned technical problems.

[0006] Firstly, this application provides a risk detection method, including:

[0007] The system receives configuration operations for risk detection rules, generates target detection rules based on the configuration operations, and stores the target detection rules in the detection rule library. The target detection rules are used to perform risk detection on data in a specified data source.

[0008] The system periodically scans the rules in the rule base, checking the activation status of the current rule, the activation status of each detection indicator in the current rule, and the data arrival signal of each detection indicator. If the check passes, the system generates the corresponding detection task and puts the detection task into the detection task queue. The system then retrieves the detection tasks from the task queue, executes the retrieved detection tasks, and obtains the risk detection results.

[0009] In one embodiment, the exploration rule configuration operation includes: data source selection operation, business information configuration operation, scheduling information configuration operation, exploration indicator configuration operation, indicator threshold configuration operation, and exploration logic configuration operation.

[0010] Based on the exploration rule configuration operation, target exploration rules are generated, including:

[0011] The risk exploration is determined based on the following steps: Data source selection operation; business information configuration operation; execution scheduling information of the risk exploration rules; indicator combination information of the risk exploration rules; comparison threshold of each indicator in the indicator combination information; and risk exploration logic constructed from the indicator combination information and comparison thresholds.

[0012] Based on the specified data source, target business information, execution scheduling information, indicator combination information, comparison thresholds, and risk detection logic, target detection rules are generated.

[0013] In one embodiment, target detection rules are generated based on a specified data source, target business information, execution scheduling information, indicator combination information, comparison thresholds, and risk detection logic, including:

[0014] Based on the specified data source, target business information, execution scheduling information, indicator combination information, comparison thresholds, and risk detection logic, generate detection rules in a preset format;

[0015] Upon receiving the rule save operation, the parser decomposes the exploration rules in the preset format to generate a binary tree; the binary tree is traversed and converted into the target language to obtain the target exploration rules.

[0016] In one embodiment, the scanning process checks the activation status of the current rule, the activation status of each probe indicator in the current rule, and the data arrival signal of each probe indicator, including:

[0017] Determine whether the current rule has not yet been executed and whether the current rule is enabled;

[0018] If all are yes, then query all indicators included in the current rule and generate an indicator table;

[0019] Iterate through each indicator in the indicator table and determine whether the currently iterated indicator is enabled. If it is enabled, continue to determine whether the currently iterated indicator has a configured data arrival signal. If a data arrival signal is configured, determine whether the corresponding data arrival signal has been received. If the corresponding data arrival signal has been received, then the check is considered successful.

[0020] In one embodiment, probing tasks are retrieved from the task queue, the retrieved probing tasks are executed, and risk probing results are obtained, including:

[0021] According to the pre-set maximum number of tasks to be read in a single session, retrieve the corresponding number of exploration tasks from the task queue;

[0022] The task processing operation is performed on each obtained exploration task in a loop. The task processing operation includes: updating the task status in the current exploration task's log table to the submitted status, deleting the exploration task from the task queue, and adding the exploration task to the thread pool.

[0023] The task status in each log table is read asynchronously. When the task status in the current log table is "committed", the status is updated to "in execution" and the task start time is recorded. The exploration task corresponding to the current log table is executed to obtain the corresponding risk exploration results. The "in execution" status is then updated to "task completed".

[0024] In one embodiment, the detection rule configuration operation further includes: an alert configuration operation; the method further includes:

[0025] The warning method is determined based on the warning configuration operation;

[0026] After obtaining the risk assessment results, an early warning is issued through an early warning system.

[0027] Secondly, this application also provides a risk detection device, comprising:

[0028] The rule configuration module is used to receive configuration operations for risk detection rules, generate target detection rules based on the configuration operations, and store the target detection rules in the detection rule library; the target detection rules are used to perform risk detection on data in a specified data source.

[0029] The scanning module is used to periodically scan the rules in the exploration rule base. During the scanning process, it checks the activation status of the current rule, the activation status of each exploration indicator in the current rule, and the data arrival signal of each exploration indicator. If the check passes, the corresponding exploration task is generated and put into the exploration task queue. The module retrieves the exploration tasks from the task queue, executes the retrieved exploration tasks, and obtains the risk exploration results.

[0030] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0031] The system receives configuration operations for risk detection rules, generates target detection rules based on the configuration operations, and stores the target detection rules in the detection rule library. The target detection rules are used to perform risk detection on data in a specified data source.

[0032] The system periodically scans the rules in the rule base, checking the activation status of the current rule, the activation status of each detection indicator in the current rule, and the data arrival signal of each detection indicator. If the check passes, the system generates the corresponding detection task and puts the detection task into the detection task queue. The system then retrieves the detection tasks from the task queue, executes the retrieved detection tasks, and obtains the risk detection results.

[0033] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0034] The system receives configuration operations for risk detection rules, generates target detection rules based on the configuration operations, and stores the target detection rules in the detection rule library. The target detection rules are used to perform risk detection on data in a specified data source.

[0035] The system periodically scans the rules in the rule base, checking the activation status of the current rule, the activation status of each detection indicator in the current rule, and the data arrival signal of each detection indicator. If the check passes, the system generates the corresponding detection task and puts the detection task into the detection task queue. The system then retrieves the detection tasks from the task queue, executes the retrieved detection tasks, and obtains the risk detection results.

[0036] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0037] The system receives configuration operations for risk detection rules, generates target detection rules based on the configuration operations, and stores the target detection rules in the detection rule library. The target detection rules are used to perform risk detection on data in a specified data source.

[0038] The system periodically scans the rules in the rule base, checking the activation status of the current rule, the activation status of each detection indicator in the current rule, and the data arrival signal of each detection indicator. If the check passes, the system generates the corresponding detection task and puts the detection task into the detection task queue. The system then retrieves the detection tasks from the task queue, executes the retrieved detection tasks, and obtains the risk detection results.

[0039] The aforementioned risk detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product receive configuration operations for risk detection rules, generate target detection rules based on the configuration operations, and store the target detection rules in a detection rule base. The target detection rules are used to perform risk detection on data from a specified data source. The system periodically scans the rules in the detection rule base, checking the activation status of the current rule, the activation status of each detection indicator within the current rule, and the data arrival signals of each detection indicator during the scanning process. If the checks pass, a corresponding detection task is generated and placed in a detection task queue. The system retrieves the detection tasks from the task queue, executes the retrieved detection tasks, and obtains the risk detection results. This allows for flexible configuration of multiple indicators, effectively improving the flexibility and efficiency of risk detection. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a diagram illustrating the application environment of the risk detection method in one embodiment;

[0042] Figure 2 This is a flowchart illustrating a risk detection method in one embodiment;

[0043] Figure 3 Here is an example diagram of a binary tree in one embodiment;

[0044] Figure 4 This is a flowchart illustrating the process of determining the check pass step in one embodiment;

[0045] Figure 5 This is a flowchart illustrating the steps for obtaining risk detection results in one embodiment;

[0046] Figure 6 This is a flowchart illustrating the risk detection method in another embodiment;

[0047] Figure 7 This is a flowchart illustrating the layered interaction of the risk detection method in another embodiment;

[0048] Figure 8 This is a structural block diagram of a risk detection device in one embodiment;

[0049] Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0051] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0052] The risk detection method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Specifically, terminal 102 or server 104 completes a risk detection method, which includes: receiving a configuration operation for risk detection rules; generating a target detection rule based on the configuration operation; storing the target detection rule in a detection rule library; the target detection rule is used to perform risk detection on data from a specified data source; periodically scanning the rules in the detection rule library, checking the activation status of the current rule, the activation status of each detection indicator in the current rule, and the data arrival signal of each detection indicator during the scanning process; if the check passes, generating a corresponding detection task and placing the detection task into a detection task queue; retrieving the detection task from the task queue, executing the retrieved detection task, and obtaining the risk detection result. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, and projection equipment. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0053] In one exemplary embodiment, such as Figure 2 As shown, a risk detection method is provided, which can be applied to... Figure 1 Taking terminal 102 as an example, the explanation includes the following steps 202 to 204. Wherein:

[0054] Step 202: Receive the configuration operation of the risk exploration rule, generate the target exploration rule based on the configuration operation, and store the target exploration rule in the exploration rule library; the target exploration rule is used to conduct risk exploration on the data in the specified data source.

[0055] Among them, target exploration rules refer to the rules formed after configuring the exploration data source, configuration business information, scheduling information, indicator combination information, and threshold information. The data in the specified data source is the information of the indicator to be explored in the specified data source. The exploration rule library is used to store target exploration rules.

[0056] Step 204: Periodically scan the rules in the exploration rule base. During the scanning process, check the activation status of the current rule, the activation status of each exploration indicator in the current rule, and the data arrival signal of each exploration indicator. If the check passes, generate the corresponding exploration task and put the exploration task into the exploration task queue. Retrieve the exploration task in the task queue, execute the retrieved exploration task, and obtain the risk exploration result.

[0057] The exploration task queue is a message queue used to temporarily store exploration tasks. This message queue can be a professional enterprise-grade message queue or an in-memory data storage system.

[0058] Alternatively, in response to a user's exploration task generation operation based on target exploration rules, the generated exploration task can be placed into the exploration task queue.

[0059] For example, before the rules in the periodic scanning exploration rules, in order to ensure that only one scan is executed at a time, a locking operation can be performed on the target exploration rule. After the exploration task is completed, the result is unlocked, the corresponding exploration task is generated, and the priority of the exploration task is obtained. The exploration tasks are then placed into the exploration task queue in a recursive nested manner according to the priority.

[0060] In the aforementioned risk detection method, a target detection rule is generated based on the configuration operation of the risk detection rule received, and the target detection rule is stored in the detection rule library. The target detection rule is used to perform risk detection on data in a specified data source. The method also involves periodically scanning the rules in the detection rule library, checking the activation status of the current rule, the activation status of each detection indicator in the current rule, and the data arrival signal of each detection indicator during the scanning process. If the check passes, a corresponding detection task is generated and placed in the detection task queue. The method then retrieves the detection task from the task queue, executes the retrieved detection task, and obtains the risk detection result. This method allows for flexible configuration of multiple indicators, effectively improving the flexibility and efficiency of risk detection.

[0061] In an exemplary embodiment, the exploration rule configuration operation includes: a data source selection operation, a business information configuration operation, a scheduling information configuration operation, an exploration indicator configuration operation, an indicator threshold configuration operation, and an exploration logic configuration operation. Generating a target exploration rule based on the exploration rule configuration operation includes: determining the specified data source for risk exploration based on the data source selection operation; determining the target business information to which the risk exploration belongs based on the business information configuration operation; determining the execution scheduling information of the risk exploration rule based on the scheduling information configuration operation; determining the indicator combination information of the risk exploration rule based on the exploration indicator configuration operation; determining the comparison threshold of each indicator in the indicator combination information based on the indicator threshold configuration operation; determining the risk exploration logic constructed from the indicator combination information and the comparison threshold based on the exploration logic configuration operation; and generating the target exploration rule based on the specified data source, target business information, execution scheduling information, indicator combination information, comparison threshold, and risk exploration logic.

[0062] The specified data source can be a big data tenant or a relational database. Target business information specifies that the risk detection service applies to at least one target business scenario, such as risk appetite, risk budget management, or risk policy. All target business scenarios require configured indicators and rules. Execution scheduling information defines the execution time or frequency of the target detection rules. Indicator combination information defines the core indicators to be obtained from the data source for risk detection. Comparison thresholds refer to the normal and abnormal threshold values ​​set for each indicator in the indicator combination. Risk detection logic defines the logical relationship between indicators and thresholds; indicators include, for example, business difficulty, general personal loans, joint loans, non-performing loan balances, and overdue loans.

[0063] In this embodiment, by configuring the key elements of risk exploration in detail, the target exploration rules are made to closely match the actual business needs. The target exploration rules generated based on these key elements are not only highly professional and targeted, which lays a solid foundation for subsequent efficient and accurate risk exploration work, but also helps to quickly capture potential risks in a complex and ever-changing data environment and improve the overall risk prevention and control capabilities.

[0064] In one embodiment, a target probing rule is generated based on a specified data source, target business information, execution scheduling information, indicator combination information, comparison threshold, and risk probing logic. This includes: generating a pre-formatted probing rule based on the specified data source, target business information, execution scheduling information, indicator combination information, comparison threshold, and risk probing logic; after receiving a rule saving operation, using a parser to decompose the pre-formatted probing rule to generate a binary tree; traversing the binary tree and converting it into the target language to obtain the target probing rule.

[0065] The binary tree is a data structure similar to a decision tree; its default format is JSON; and its target language is SQL. The parser parses the JSON-formatted probing rules into a language that can be recognized and stored by the database.

[0066] Specifically, upon receiving a rule save operation, the parser decomposes the pre-formatted probe rule into logical rules, comparison operators, fixed values, and extended functions. Based on the logical rules, comparison operators, fixed values, and extended functions, a pre-formatted probe rule is generated. Logical rule operators include OR (satisfying one condition) and AND (satisfying all conditions); comparison operators include equal to (==), greater than or equal to (!=), greater than (>), greater than or equal to (>=), less than (<), and less than or equal to (<=); fixed values ​​include string values ​​and number values; extended functions are reserved for later definition.

[0067] Furthermore, for the correlation exploration of indicators in different dimensions, the fields of indicators with the same dimension are automatically associated, and the indicators in different dimensions are converted into a preset form similar to the target language; the preset form is a left join form.

[0068] In this embodiment, detection rules are generated using a preset format. A parser decomposes the preset format detection rules into a binary tree, traverses the binary tree, and converts it into the target language to obtain the target detection rules. This allows rules from different sources and with different needs to be processed in a unified manner. At the same time, it provides a clear data structure foundation for subsequent conversion work, ensuring that the rules can be executed accurately and without error in a specific system environment, effectively improving the accuracy and reliability of risk detection work.

[0069] In one embodiment, the scanning process checks the activation status of the current rule, the activation status of each probe indicator in the current rule, and the data arrival signal of each probe indicator. This includes: determining whether the current rule has not yet been executed and whether the current rule is in an enabled state; if both are true, querying all indicators contained in the current rule and generating an indicator table; traversing each indicator in the indicator table and determining whether the currently traversed indicator is in an enabled state; if it is in an enabled state, further determining whether the currently traversed indicator has a configured data arrival signal; if a data arrival signal is configured, determining whether the corresponding data arrival signal has been received; if the corresponding data arrival signal has been received, then the check is considered passed.

[0070] Optionally, the system receives configuration operations for risk detection rules, generates target detection rules based on the configuration operations, and stores the target detection rules in the detection rule library. In response to the confirmation and approval operations for the target detection task, the system sequentially displays the database (SQL) file of the target detection rules and performs validity checks on the database file. If the validity check fails, the system generates target detection rules based on the user's modification operations on the database (SQL) file of the displayed target detection rules. Only then will the target detection rules stored in the detection rule library take effect. At this point, it can be determined that the current target detection rule has not yet been executed and is in an enabled state.

[0071] For example, in such Figure 3In the binary tree shown, the indicator combination consists of business dimension, non-performing loan balance, and overdue interest amount. If it is determined that the current rule has not yet been executed and is in an enabled state, then the system begins querying the business dimension, non-performing loan balance, and overdue interest amount included in the current rule. An indicator table is generated based on these three factors. Each indicator in the indicator table is traversed. The comparison thresholds for the business dimension are general personal loans and joint loans; the comparison thresholds for the non-performing loan balance are 500,000,000 and the comparison thresholds for the overdue interest amount are 100,000,000. When either the non-performing loan balance or the overdue interest amount is greater than or equal to (Ge) its comparison threshold, the corresponding OR binary tree node is traversed. Furthermore, when the business dimension includes (IN) general personal loans and joint loans, the corresponding AND binary tree node is traversed. The currently traversed indicator is in an enabled state. If the traversal fails, the corresponding indicator is in an disabled state, indicating a risk.

[0072] For example, when the data source is from an external database, a data arrival signal needs to be configured for the metric to confirm whether the data corresponding to the metric has arrived in the queue. The metric's activation status is determined based on the corresponding comparison threshold and risk detection logic. When all metrics are in the activated state, it continues to determine whether the currently traversed metric has a configured data arrival signal. If a data arrival signal is configured, it determines whether the corresponding data arrival signal has been received. If the corresponding data arrival signal has been received, the check is considered successful.

[0073] Specifically, the specific process is as follows: Figure 4 As shown, the user queries whether the current rule has not yet been executed and determines whether the current rule is enabled. If both are true, the current rule is locked, all metrics included in the current rule are queried, and a metric table is generated. Each metric in the metric table is traversed, and it is determined whether the currently traversed metric is enabled. If it is enabled, it is further determined whether the currently traversed metric has a configured data arrival signal. If a data arrival signal is configured, it is determined whether the corresponding data arrival signal has been received. If the corresponding data arrival signal has been received, the check is confirmed to have passed. If no data arrival signal is configured, the metrics without configured data arrival signals are skipped, and all metrics in the metric table except for the skipped metrics are traversed again, and the subsequent steps are continued. Finally, the rule traversal ends, the current rule is unlocked, and the check is confirmed to have passed. Further, if the metric is not enabled or the metric has a configured data arrival signal but has not received it, the traversal of the current rule ends, and the current rule is unlocked.

[0074] In this embodiment, by sequentially judging the execution status and activation status of the current rule, generating an indicator table, and iterating through and checking the activation status and data arrival signal of each indicator, it can be ensured that only rules that meet the conditions and are in an active state will enter the subsequent processing flow, avoiding the resource occupation of invalid rules. At the same time, it ensures that only indicators that really need to be monitored and whose data are ready will trigger the exploration task, effectively improving resource utilization efficiency, enhancing the reliability and stability of the risk exploration system, and providing a solid data foundation for subsequent accurate and efficient risk judgment.

[0075] In one embodiment, retrieving exploration tasks from the task queue, executing the retrieved exploration tasks, and obtaining risk exploration results includes: retrieving a corresponding number of exploration tasks from the task queue according to a pre-set maximum number of tasks to read at one time; performing task processing operations on each retrieved exploration task in a loop, including: updating the task status in the current exploration task's log record table to the submitted status, deleting the exploration task from the task queue, and adding the exploration task to the thread pool; asynchronously reading the task status in each log record table, updating the submitted status to the executing status and recording the task start time when the task status in the current log record table is submitted, executing the exploration task corresponding to the current log record table, obtaining the corresponding risk exploration results; and updating the executing status to the task execution completed.

[0076] For example, the specific process is as follows Figure 5 As shown, according to the pre-set maximum number of tasks to be read in a single operation, a corresponding number of probe tasks are retrieved from the task queue. Each retrieved probe task is processed in a loop, including: submitting the probe task and related execution information; updating the task status in the current probe task's log table to the submitted status; deleting the probe task from the task queue and storing the log identifier and the probe task execution object relationship; and stopping the use of probe tasks while adding them to the thread pool. Simultaneously, the loop count is determined based on the maximum number of tasks, and the loop count is used to determine whether the task processing operation has ended. When it ends, the operations following updating the task status in the current probe task's log table to the submitted status are no longer performed.

[0077] Furthermore, after adding the exploration task to the thread pool, the task status of each log table is read asynchronously. When the task status in the current log table is "committed", the "committed" status is updated to "executing" status and the task start time is recorded. The exploration task corresponding to the current log table is then executed. The "executing" status is updated to "task completed", and the exploration task completion time, completion time, and error information are generated. The exploration task is then destroyed, and the task object is cleared from the thread pool to obtain the corresponding risk exploration results.

[0078] In this embodiment, by retrieving tasks from the task queue according to a pre-set maximum number of tasks to be read at one time, and performing task processing operations on each retrieved exploration task in a loop, the amount of tasks processed each time can be reasonably controlled, avoiding performance bottlenecks caused by the system processing too many tasks at once, and achieving precise tracking and management of the task execution process. At the same time, by deleting exploration tasks from the task queue and adding them to the thread pool, and reading the task status asynchronously, updating and recording the start time in a timely manner when the task status is submitted, and then executing the exploration task, the task execution efficiency can be improved, the task waiting time can be reduced, and the response speed can be increased.

[0079] In one embodiment, the exploration rule configuration operation further includes: an early warning configuration operation; the method further includes: determining an early warning method based on the early warning configuration operation; and issuing an early warning through the early warning method after obtaining the risk exploration results.

[0080] The early warning configuration operation involves the user configuring hook information after the investigation results are obtained; the hook information is used to determine the early warning method and the corresponding early warning information for the indicators. The early warning method can be a tiered early warning.

[0081] Optionally, when the warning method is tiered warning, the asynchronous thread stack can convert the warning level information generated by the warning configuration operation into a conditional expression in the target language to query the exploration result table and match the corresponding warning level to issue a warning. The exploration result table is generated by comparing the results of two explorations after multiple risk explorations.

[0082] Optionally, warnings can be issued by delivering warning information corresponding to the indicators to users via SMS, email, or sound alerts.

[0083] In this embodiment, by introducing an early warning configuration operation, the risk detection device not only possesses the ability to detect risks but also issues timely warnings when risks occur. Based on the early warning configuration operation, the warning method can be determined, allowing for flexible selection of various warning formats such as SMS, email, and sound alerts according to different business scenarios and needs, ensuring that relevant personnel can obtain risk information immediately. After obtaining the risk detection results, issuing a warning through a pre-set warning method can quickly transmit risk information to relevant personnel, enabling them to take timely measures to effectively reduce losses caused by risks and further improve the effectiveness and timeliness of risk prevention and control.

[0084] Next reference Figure 6 and Figure 7 The present application will describe a risk detection method using a specific embodiment.

[0085] like Figure 7The diagram illustrates a specific risk detection process, comprising five main steps: indicator introduction, rule setting, result execution, result viewing, and post-processing. First, indicators are introduced. Second, users configure rules, including conditional rules and business information configuration. Then, the rules are executed using real-time detection and daily batch queues. Finally, execution results are obtained and viewed, and alert information is processed based on these results. Alert information processing includes adding alert procedures and sending alert emails.

[0086] like Figure 8 As shown, another specific risk investigation process is provided, which is reflected by the interaction between the batch scheduling module, business layer, execution layer and indicator rule layer.

[0087] Since the rules configured in business scenarios may need to be executed periodically, the batch scheduling module can perform regular daily execution of rules based on configuration items, and process the execution results in different ways according to the subsequent processing flow. The execution layer provides rule exploration and execution functions. All functions are processed asynchronously. The business layer can schedule queries in real time, and send notifications after the queries are completed. The business layer can view the results. Batch scheduling can execute a batch of rules. After the execution layer completes the result exploration, it performs subsequent processing of the results according to the relevant configuration items, which can provide the generation of early warning signals, the sending of early warning lists, the generation of early warning analysis platform processes, and data statistics according to various dimensions. The business layer classifies business scenarios, such as risk preference early warning and budget management. These scenarios require the configuration of indicators and rules, and all scenarios can call the rule configuration function to configure rules.

[0088] The batch scheduling module transmits business data to the business layer; the business layer transmits real-time call queries and result queries to the execution layer, and transmits rule configurations to the indicator rule layer. The indicator rule layer provides the rule configuration items to the execution layer. Finally, the execution layer obtains the execution result notification and transmits it to the business layer; the batch scheduling module transmits daily batch scheduling to the execution layer, and the execution layer can return the execution results.

[0089] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0090] Based on the same inventive concept, this application also provides a risk detection device for implementing the risk detection method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations of one or more risk detection device embodiments provided below can be found in the limitations of the risk detection method described above, and will not be repeated here.

[0091] In one exemplary embodiment, such as Figure 8 As shown, a risk detection device 800 is provided, including: a rule configuration module 802 and a scanning module 804, wherein:

[0092] The rule configuration module 802 is used to receive configuration operations for risk detection rules, generate target detection rules based on the configuration operations, and store the target detection rules in the detection rule library; the target detection rules are used to perform risk detection on data in a specified data source;

[0093] The scanning module 804 is used to periodically scan the rules in the exploration rule base. During the scanning process, it checks the activation status of the current rule, the activation status of each exploration indicator in the current rule, and the data arrival signal of each exploration indicator. If the check passes, the corresponding exploration task is generated and placed into the exploration task queue. The module retrieves the exploration tasks from the task queue, executes the retrieved exploration tasks, and obtains the risk exploration results.

[0094] In one embodiment, the rule configuration module is further configured to: determine the specified data source for risk exploration based on the data source selection operation; determine the target business information to which the risk exploration belongs based on the business information configuration operation; determine the execution scheduling information of the risk exploration rule based on the scheduling information configuration operation; determine the indicator combination information of the risk exploration rule based on the exploration indicator configuration operation; determine the comparison threshold of each indicator in the indicator combination information based on the indicator threshold configuration operation; determine the risk exploration logic constructed from the indicator combination information and the comparison threshold based on the exploration logic configuration operation; and generate the target exploration rule based on the specified data source, target business information, execution scheduling information, indicator combination information, comparison threshold, and risk exploration logic.

[0095] In one embodiment, the rule configuration module is further configured to generate a preset format of exploration rules based on a specified data source, target business information, execution scheduling information, indicator combination information, comparison threshold, and risk exploration logic; after receiving a rule save operation, the module uses a parser to decompose the preset format of exploration rules to generate a binary tree; and traverses the binary tree and converts it into the target language to obtain the target exploration rules.

[0096] In one embodiment, the scanning module is further configured to determine whether the current rule has not yet been executed and whether the current rule is enabled; if both are true, then query all the metrics included in the current rule and generate a metric table; traverse each metric in the metric table and determine whether the currently traversed metric is enabled; if it is enabled, continue to determine whether the currently traversed metric has configured a data arrival signal; if a data arrival signal is configured, determine whether the corresponding data arrival signal has been received; if the corresponding data arrival signal has been received, then the check is confirmed to have passed.

[0097] In one embodiment, the scanning module is further configured to obtain a corresponding number of exploration tasks from the task queue according to a pre-set maximum number of tasks to be read at one time; perform task processing operations on each obtained exploration task in a loop, the task processing operations including: updating the task status in the current exploration task's log record table to the submitted status, deleting the exploration task from the task queue, and adding the exploration task to the thread pool; reading the task status in each log record table asynchronously, updating the submitted status to the executing status and recording the task start time when the task status in the current log record table is the submitted status, executing the exploration task corresponding to the current log record table, and obtaining the corresponding risk exploration result; and updating the executing status to the task execution completed.

[0098] In one embodiment, the rule configuration module is further used to determine the warning method based on the warning configuration operation; after obtaining the risk detection results, the warning is issued through the warning method.

[0099] Each module in the aforementioned risk detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0100] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 9 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a risk detection method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0101] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0102] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0103] The system receives configuration operations for risk detection rules, generates target detection rules based on the configuration operations, and stores the target detection rules in the detection rule library. The target detection rules are used to perform risk detection on data in a specified data source.

[0104] The system periodically scans the rules in the rule base, checking the activation status of the current rule, the activation status of each detection indicator in the current rule, and the data arrival signal of each detection indicator. If the check passes, the system generates the corresponding detection task and puts the detection task into the detection task queue. The system then retrieves the detection tasks from the task queue, executes the retrieved detection tasks, and obtains the risk detection results.

[0105] In one embodiment, when the processor executes the computer program, it further performs the following steps: determining the specified data source for risk exploration based on a data source selection operation; determining the target business information to which the risk exploration belongs based on a business information configuration operation; determining the execution scheduling information of the risk exploration rules based on a scheduling information configuration operation; determining the indicator combination information of the risk exploration rules based on an exploration indicator configuration operation; determining the comparison threshold of each indicator in the indicator combination information based on an indicator threshold configuration operation; determining the risk exploration logic constructed from the indicator combination information and the comparison threshold based on an exploration logic configuration operation; and generating target exploration rules based on the specified data source, target business information, execution scheduling information, indicator combination information, comparison threshold, and risk exploration logic.

[0106] In one embodiment, when the processor executes the computer program, it further performs the following steps: generating exploration rules in a preset format based on a specified data source, target business information, execution scheduling information, indicator combination information, comparison threshold, and risk exploration logic; after receiving a rule saving operation, using a parser to decompose the exploration rules in the preset format to generate a binary tree; traversing the binary tree and converting it into a target language to obtain the target exploration rules.

[0107] In one embodiment, when the processor executes the computer program, it further performs the following steps: determining whether the current rule has not yet been executed and whether the current rule is enabled; if both are true, querying all indicators contained in the current rule and generating an indicator table; traversing each indicator in the indicator table, determining whether the currently traversed indicator is enabled; if it is enabled, continuing to determine whether the currently traversed indicator has configured a data arrival signal; if a data arrival signal is configured, determining whether the corresponding data arrival signal has been received; if the corresponding data arrival signal has been received, determining that the check has passed.

[0108] In one embodiment, when the processor executes the computer program, it further implements the following steps: obtaining a corresponding number of exploration tasks from the task queue according to a pre-set maximum number of tasks to read at one time; performing task processing operations on each obtained exploration task in a loop, the task processing operations including: updating the task status in the current exploration task's log table to the submitted status, deleting the exploration task from the task queue, and adding the exploration task to the thread pool; asynchronously reading the task status in each log table, updating the submitted status to the executing status and recording the task start time when the task status in the current log table is submitted, executing the exploration task corresponding to the current log table, and obtaining the corresponding risk exploration result; and updating the executing status to the task completed.

[0109] In one embodiment, when the processor executes the computer program, it also performs the following steps: determining the warning method based on the warning configuration operation; and issuing a warning through the warning method after obtaining the risk detection results.

[0110] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0111] The system receives configuration operations for risk detection rules, generates target detection rules based on the configuration operations, and stores the target detection rules in the detection rule library. The target detection rules are used to perform risk detection on data in a specified data source.

[0112] The system periodically scans the rules in the rule base, checking the activation status of the current rule, the activation status of each detection indicator in the current rule, and the data arrival signal of each detection indicator. If the check passes, the system generates the corresponding detection task and puts the detection task into the detection task queue. The system then retrieves the detection tasks from the task queue, executes the retrieved detection tasks, and obtains the risk detection results.

[0113] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining the specified data source for risk exploration based on a data source selection operation; determining the target business information to which the risk exploration belongs based on a business information configuration operation; determining the execution scheduling information of the risk exploration rules based on a scheduling information configuration operation; determining the indicator combination information of the risk exploration rules based on an exploration indicator configuration operation; determining the comparison threshold of each indicator in the indicator combination information based on an indicator threshold configuration operation; determining the risk exploration logic constructed from the indicator combination information and the comparison threshold based on an exploration logic configuration operation; and generating target exploration rules based on the specified data source, target business information, execution scheduling information, indicator combination information, comparison threshold, and risk exploration logic.

[0114] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: generating a preset-formatted exploration rule based on a specified data source, target business information, execution scheduling information, indicator combination information, comparison threshold, and risk exploration logic; after receiving a rule saving operation, using a parser to decompose the preset-formatted exploration rule to generate a binary tree; traversing the binary tree and converting it into the target language to obtain the target exploration rule.

[0115] In one embodiment, when the computer program is executed by the processor, it further implements the following steps: determining whether the current rule has not yet been executed and whether the current rule is enabled; if both are true, querying all indicators contained in the current rule and generating an indicator table; traversing each indicator in the indicator table, determining whether the currently traversed indicator is enabled; if it is enabled, continuing to determine whether the currently traversed indicator has configured a data arrival signal; if a data arrival signal is configured, determining whether the corresponding data arrival signal has been received; if the corresponding data arrival signal has been received, determining that the check has passed.

[0116] In one embodiment, when the computer program is executed by the processor, it further implements the following steps: obtaining a corresponding number of exploration tasks from the task queue according to a pre-set maximum number of tasks to be read at a time; performing task processing operations on each obtained exploration task in a loop, the task processing operations including: updating the task status in the current exploration task's log table to the submitted status, deleting the exploration task from the task queue, and adding the exploration task to the thread pool; asynchronously reading the task status in each log table, updating the submitted status to the executing status and recording the task start time when the task status in the current log table is submitted, executing the exploration task corresponding to the current log table, and obtaining the corresponding risk exploration result; and updating the executing status to the task completed.

[0117] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining the warning method based on the warning configuration operation; and issuing a warning through the warning method after obtaining the risk detection results.

[0118] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0119] The system receives configuration operations for risk detection rules, generates target detection rules based on the configuration operations, and stores the target detection rules in the detection rule library. The target detection rules are used to perform risk detection on data in a specified data source.

[0120] The system periodically scans the rules in the rule base, checking the activation status of the current rule, the activation status of each detection indicator in the current rule, and the data arrival signal of each detection indicator. If the check passes, the system generates the corresponding detection task and puts the detection task into the detection task queue. The system then retrieves the detection tasks from the task queue, executes the retrieved detection tasks, and obtains the risk detection results.

[0121] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining the specified data source for risk exploration based on a data source selection operation; determining the target business information to which the risk exploration belongs based on a business information configuration operation; determining the execution scheduling information of the risk exploration rules based on a scheduling information configuration operation; determining the indicator combination information of the risk exploration rules based on an exploration indicator configuration operation; determining the comparison threshold of each indicator in the indicator combination information based on an indicator threshold configuration operation; determining the risk exploration logic constructed from the indicator combination information and the comparison threshold based on an exploration logic configuration operation; and generating target exploration rules based on the specified data source, target business information, execution scheduling information, indicator combination information, comparison threshold, and risk exploration logic.

[0122] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: generating a preset-formatted exploration rule based on a specified data source, target business information, execution scheduling information, indicator combination information, comparison threshold, and risk exploration logic; after receiving a rule saving operation, using a parser to decompose the preset-formatted exploration rule to generate a binary tree; traversing the binary tree and converting it into the target language to obtain the target exploration rule.

[0123] In one embodiment, when the computer program is executed by the processor, it further implements the following steps: determining whether the current rule has not yet been executed and whether the current rule is enabled; if both are true, querying all indicators contained in the current rule and generating an indicator table; traversing each indicator in the indicator table, determining whether the currently traversed indicator is enabled; if it is enabled, continuing to determine whether the currently traversed indicator has configured a data arrival signal; if a data arrival signal is configured, determining whether the corresponding data arrival signal has been received; if the corresponding data arrival signal has been received, determining that the check has passed.

[0124] In one embodiment, when the computer program is executed by the processor, it further implements the following steps: obtaining a corresponding number of exploration tasks from the task queue according to a pre-set maximum number of tasks to be read at a time; performing task processing operations on each obtained exploration task in a loop, the task processing operations including: updating the task status in the current exploration task's log table to the submitted status, deleting the exploration task from the task queue, and adding the exploration task to the thread pool; asynchronously reading the task status in each log table, updating the submitted status to the executing status and recording the task start time when the task status in the current log table is submitted, executing the exploration task corresponding to the current log table, and obtaining the corresponding risk exploration result; and updating the executing status to the task completed.

[0125] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining the warning method based on the warning configuration operation; and issuing a warning through the warning method after obtaining the risk detection results.

[0126] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0127] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0128] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A risk detection method, characterized in that, The method includes: The system receives configuration operations for risk detection rules, generates target detection rules based on the configuration operations, and stores the target detection rules in the detection rule library; the target detection rules are used to perform risk detection on data in a specified data source. The rules in the exploration rule base are scanned periodically. During the scan, the activation status of the current rule, the activation status of each exploration indicator in the current rule, and the data arrival signal of each exploration indicator are checked. If the check passes, the corresponding exploration task is generated and placed into the exploration task queue. The exploration tasks in the task queue are retrieved, the retrieved exploration tasks are executed, and the risk exploration results are obtained.

2. The method according to claim 1, characterized in that, The exploration rule configuration operations include: data source selection operation, business information configuration operation, scheduling information configuration operation, exploration indicator configuration operation, indicator threshold configuration operation, and exploration logic configuration operation. The step of generating target exploration rules based on the exploration rule configuration operation includes: The specified data source for risk exploration is determined based on the data source selection operation; the target business information to which the risk exploration belongs is determined based on the business information configuration operation; the execution scheduling information of the risk exploration rules is determined based on the scheduling information configuration operation; the indicator combination information of the risk exploration rules is determined based on the exploration indicator configuration operation; the comparison threshold of each indicator in the indicator combination information is determined based on the indicator threshold configuration operation; and the risk exploration logic constructed from the indicator combination information and the comparison threshold is determined based on the exploration logic configuration operation. Based on the specified data source, the target business information, the execution scheduling information, the indicator combination information, the comparison threshold, and the risk detection logic, a target detection rule is generated.

3. The method according to claim 2, characterized in that, The step of generating target detection rules based on the specified data source, the target business information, the execution scheduling information, the indicator combination information, the comparison threshold, and the risk detection logic includes: Based on the specified data source, the target business information, the execution scheduling information, the indicator combination information, the comparison threshold, and the risk detection logic, generate detection rules in a preset format; Upon receiving the rule save operation, the parser decomposes the exploration rule in the preset format to generate a binary tree; the binary tree is traversed and converted into the target language to obtain the target exploration rule.

4. The method according to claim 1, characterized in that, The scanning process includes checking the activation status of the current rule, the activation status of each detection indicator in the current rule, and the data arrival signal of each detection indicator, including: Determine whether the current rule has not yet been executed and whether the current rule is enabled; If all are yes, then query all indicators included in the current rule and generate an indicator table; Iterate through each indicator in the indicator table and determine whether the currently iterated indicator is enabled. If it is enabled, continue to determine whether the currently iterated indicator has a configured data arrival signal. If a data arrival signal is configured, determine whether the corresponding data arrival signal has been received. If the corresponding data arrival signal has been received, then the check is confirmed to be successful.

5. The method according to claim 1, characterized in that, The process of acquiring exploration tasks from the task queue, executing the acquired exploration tasks, and obtaining risk exploration results includes: According to the pre-set maximum number of tasks to be read in a single session, a corresponding number of exploration tasks are obtained from the task queue; The task processing operation is performed on each obtained exploration task in a loop. The task processing operation includes: updating the task status in the log record table of the current exploration task to the submitted status, deleting the exploration task from the task queue, and adding the exploration task to the thread pool. The task status in each log table is read asynchronously. When the task status in the current log table is "submitted", the "submitted" status is updated to "execution" and the task start time is recorded. The exploration task corresponding to the current log table is executed to obtain the corresponding risk exploration results. The "execution" status is then updated to "task execution completed".

6. The method according to claim 1, characterized in that, The detection rule configuration operation further includes: an early warning configuration operation; the method further includes: The warning method is determined based on the aforementioned warning configuration operation; After obtaining the risk assessment results, an early warning is issued using the aforementioned warning method.

7. A risk detection device, characterized in that, The device includes: The rule configuration module is used to receive configuration operations for risk detection rules, generate target detection rules based on the configuration operations, and store the target detection rules in the detection rule library; the target detection rules are used to perform risk detection on data in a specified data source; The scanning module is used to periodically scan the rules in the exploration rule base. During the scanning process, it checks the activation status of the current rule, the activation status of each exploration indicator in the current rule, and the data arrival signal of each exploration indicator. If the check passes, the corresponding exploration task is generated and placed into the exploration task queue. The module retrieves the exploration tasks from the task queue, executes the retrieved exploration tasks, and obtains the risk exploration results.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images