A risk state mining rule determination method, a risk state determination method, an electronic device, and a medium

Abstract

The application discloses a risk state mining rule determination method, a risk state determination method, an electronic device and a medium, relates to the KYC technical field, and comprises the following steps: acquiring a basic knowledge graph and a basic risk mining rule; in the case that an abnormal user is acquired, searching in the basic knowledge graph according to the basic risk mining rule to obtain a plurality of candidate associated users; determining the risk states of the abnormal user and the candidate associated users according to the basic risk mining rule; and training a classification model according to the candidate associated users and the risk states corresponding thereto, so that the trained classification model can output a target knowledge graph and a target risk mining rule according to input user information. The application has the characteristics and advantages of adapting to dynamic business changes and significantly improving the comprehensiveness and accuracy of high-risk user association mining in the KYC scene.

Description

Technical Field

[0001] This invention relates to the field of KYC technology, and more particularly to a method for determining risk status mining rules, a method for determining risk status, an electronic device, and a computer-readable medium. Background Technology

[0002] KYC (Know Your Customer) is a comprehensive user identity verification and assessment mechanism used to identify abnormal transaction patterns and high-risk operational characteristics. Typically, users flagged as suspicious by KYC are further investigated by identifying related users with high correlation to uncover high-risk individuals.

[0003] Existing technologies generally construct various types of customer information into knowledge graphs, and rely on knowledge graphs to conduct association mining and risk assessment of abnormal users, thereby screening out high-risk users with associations.

[0004] However, due to the real-time changes in KYC user data, the fixed mining strategies and knowledge graph structures in existing technologies cannot adapt to dynamic business changes, which can easily lead to problems such as missing related users and incomplete identification, resulting in low accuracy in mining high-risk users. Summary of the Invention

[0005] This invention aims to address one of the technical problems in related technologies to a certain extent. To this end, this invention provides a method for determining risk status mining rules, a method for determining risk status, an electronic device for executing the method for determining risk status mining rules and the method for determining risk status, and a computer-readable medium. These methods have the characteristics and advantages of adapting to dynamic business changes and significantly improving the comprehensiveness and accuracy of high-risk user association mining in KYC scenarios.

[0006] To achieve the above objectives, as a first aspect of the present invention, a method for determining risk status mining rules is provided, wherein the mining rule determination method includes: Acquire basic knowledge graphs and basic risk mining rules; Upon identifying an abnormal user, multiple candidate associated users are obtained by searching the basic knowledge graph according to the basic risk mining rules. The risk status of abnormal users and candidate associated users is determined based on the basic risk mining rules. The classification model is trained based on candidate associated users and their corresponding risk status, so that the trained classification model can output target knowledge graph and target risk mining rules based on the input user information.

[0007] Optionally, the basic risk mining rules include basic association mining rules and basic risk scoring rules; the target risk mining rules include target association mining rules and target risk scoring rules. The step of training a classification model based on candidate associated users and their corresponding risk states, enabling the trained model to output a target knowledge graph and target risk mining rules based on the input user information, includes: Positive and negative samples are divided based on the risk status of candidate associated users and a preset status threshold; wherein, candidate associated users whose risk status is greater than or equal to the preset status threshold are considered positive samples, and candidate associated users whose risk status is less than the preset status threshold are considered negative samples. The classification model is trained under supervision based on the positive and negative samples to learn the common risk scoring rules among the positive samples. The common risk scoring rules are then added to the basic risk scoring rules to obtain the target risk scoring rules. Clustering the positive samples yields new association mining rules, which are then added to the basic association mining rules to obtain the target association mining rules. Based on the correlation distribution characteristics between the positive and negative samples, perform at least one of the following operations on the basic knowledge graph: node addition / deletion or edge update, to obtain the target knowledge graph.

[0008] Optionally, the step of supervising the classification model based on the positive and negative samples to learn common risk scoring rules among positive samples, and then adding these common risk scoring rules to the basic risk scoring rules to obtain the target risk scoring rule, includes: For the positive and negative samples, candidate features for the corresponding categories are generated according to the preset feature category generation rules; The candidate features of each category are normalized to obtain the risk sub-scores corresponding to each category of candidate features, and the candidate features and their risk sub-scores are used as risk scoring sub-rules. Each risk scoring sub-rule is selected based on its predictive gain and contribution to the prediction results of the current classification model. The selected risk scoring sub-rules are clustered and merged to obtain common risk scoring rules; After the model training is completed, the common risk scoring rules are added to the basic risk scoring rules to obtain the target risk scoring rules.

[0009] Optionally, the supervised training process further includes: During training, the rule weights corresponding to the common risk scoring rule and the basic risk scoring rule are subject to normalization constraints. The rule weights after normalization are adjusted based on the contribution of the common risk scoring rules and the basic risk scoring rules to the prediction results of the classification model.

[0010] Optionally, the step of performing at least one of node addition / deletion or edge update operations on the basic knowledge graph based on the correlation distribution characteristics between positive and negative samples to obtain the target knowledge graph includes: If any two positive samples have the same correlation distribution characteristics, the samples corresponding to the same correlation distribution characteristics are added to the basic knowledge graph as graph nodes. Risk relationship edges are constructed between the newly added graph nodes and the graph nodes corresponding to the two positive samples.

[0011] Optionally, determining the risk status of abnormal users and candidate associated users based on the basic risk mining rules includes: For abnormal users and candidate related users, scores are assigned according to the basic risk scoring rules in the basic risk mining rules, resulting in multiple scoring results; The risk status is obtained by weighted summation of multiple scoring results.

[0012] Optionally, upon obtaining an abnormal user, the process involves retrieving multiple candidate associated users from the basic knowledge graph according to the basic risk mining rules, including: Based on the basic association mining rules in the basic risk mining rules, abnormal user nodes are mined in the basic knowledge graph to retrieve multiple candidate associated user nodes that match the basic association mining rules.

[0013] As a second aspect of the present invention, a method for determining a risk status is provided, wherein the method includes: The user information to be determined is input into the trained classification model to obtain the target knowledge graph and target risk mining rules; wherein, the trained classification model is trained by the risk state mining rule determination method provided by the first aspect of the present invention; If the user information to be determined is an abnormal user, multiple candidate related users are obtained by searching the target knowledge graph according to the target risk mining rules. The risk status of abnormal users and candidate associated users is determined based on the target risk mining rules.

[0014] As a third aspect of the present invention, an electronic device is provided, comprising: One or more processors; A memory storing one or more computer programs, which, when executed by one or more processors, cause the one or more processors to implement a method for determining risk status mining rules according to a first aspect of the present invention and a method for determining risk status according to a second aspect of the present invention.

[0015] Furthermore, as a fourth aspect of the present invention, a computer-readable medium is provided having a computer program stored thereon, wherein the computer program, when executed by a processor, implements a method for determining risk status mining rules provided in the first aspect of the present invention and a method for determining risk status provided in the second aspect of the present invention.

[0016] The method for determining risk status mining rules provided by this invention first acquires a basic knowledge graph and basic risk mining rules. When an abnormal user with KYC marking is obtained, the basic risk mining rules are used to search the basic knowledge graph to obtain multiple candidate associated users. This preliminary search of candidate associated users includes both genuine high- and extremely high-risk users with malicious operations, and low- and medium-low-risk users with only routine operations. Next, the risk status of the abnormal user and the candidate associated users is determined according to the basic risk mining rules. Finally, a classification model is trained based on the candidate associated users and their corresponding risk statuses, enabling the trained classification model to output a target knowledge graph and target risk mining rules based on the input user information.

[0017] In the early stages of training, the candidate related user groups retrieved through coarse searching are sampled based on risk status to identify genuine high-risk user samples with malicious operation characteristics. During training, the filtered samples are used for supervised training of the classification model. The sample data is used to feed back and optimize the classification model's discriminative ability, and the prediction results of the classification model drive iterative updates to the target knowledge graph and target risk mining rules. After processing using the above methods, multiple candidate related users can be retrieved in the target knowledge graph according to the target risk mining rules. At this point, the refined retrieved batch of candidate related users are genuine high-risk users associated with abnormal users.

[0018] The method provided by this invention can first adapt to real-time changes in KYC user data, and can train a classification model based on the real-time changes in KYC user data, synchronously drive the iteration and update of risk mining rules and knowledge graphs, dynamically adapt to complex and ever-changing actual business scenarios, and has strong adaptability and robustness.

[0019] Secondly, regarding this function, the hierarchical mining approach combining coarse and fine retrieval, implemented in this application using graphs, rules, and classification models, effectively distinguishes between ordinary users performing routine operations and high-risk users exhibiting malicious behavior. This avoids classifying all batches of candidate users retrieved by the basic risk mining rules as abnormally associated users, significantly reducing redundant and ineffective mining activities and lowering system computational redundancy. During training, the classification model is supervised through the use of selected real high-risk samples. Based on optimizing the model's capabilities, the knowledge graph and risk mining rules are iteratively updated to fill the coverage blind spots of the basic risk mining rules, effectively reducing the problem of missing high-risk associated users.

[0020] Finally, the method provided by this invention differs from the fixed mining strategies and knowledge graph structures used in existing technologies. It not only eliminates the need for frequent manual changes to mining strategies and maintenance and updates to the graph, but also avoids the discrimination bias caused by single, fixed rules and graphs. While automatically adapting to business changes, it continuously improves the accuracy of identifying and mining malicious high-risk users, and significantly enhances the comprehensiveness and accuracy of high-risk user association mining in KYC scenarios.

[0021] These features and advantages of the present invention will be disclosed in detail in the following specific embodiments and accompanying drawings. The preferred embodiments or means of the present invention will be shown in detail in conjunction with the accompanying drawings, but are not intended to limit the technical solutions of the present invention. In addition, each of these features, elements and components appearing in the following text and drawings is a plurality of, and different symbols or numbers are used for convenience of representation, but all represent parts with the same or similar construction or function. Attached Figure Description

[0022] The present invention will be further described below with reference to the accompanying drawings: Figure 1 A flowchart of a method for determining risk status mining rules provided by the present invention; Figure 2 A flowchart of one embodiment of step S140 of the mining rule determination method provided by the present invention; Figure 3 A flowchart of one embodiment of step S142 of the mining rule determination method provided by the present invention; Figure 4 A flowchart of one embodiment of step S142 of the mining rule determination method provided by the present invention; Figure 5 A flowchart of one embodiment of step S144 of the mining rule determination method provided by the present invention; Figure 6 A schematic diagram of the structure of a knowledge graph in the mining rule determination method provided by the present invention; Figure 7A flowchart of one embodiment of step S130 of the mining rule determination method provided by the present invention; Figure 8 A flowchart of one embodiment of step S120 of the mining rule determination method provided by the present invention; Figure 9 This is an overall flowchart corresponding to the mining rule determination method provided by the present invention; Figure 10 The present invention provides and Figure 9 The corresponding flowchart shows the detailed process for calculating risk results; Figure 11 The present invention provides and Figure 9 Detailed flowchart of the corresponding automated review process; Figure 12 A flowchart of a method for determining a risk status provided by the present invention; Figure 13 A module diagram of an electronic device provided by the present invention; Figure 14 This invention provides a schematic diagram of a computer-readable medium.

[0023] Explanation of reference numerals in the attached figures Among them, 101 is the processor; 102 is the memory; 103 is the I / O interface; and 104 is the bus. Detailed Implementation

[0024] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described are intended to explain the present invention and should not be construed as limiting the invention.

[0025] The terms "an embodiment," "example," or "trademark" used in this specification refer to a particular feature, structure, or characteristic described in connection with the embodiment itself that may be included in at least one embodiment disclosed in this invention. The phrase "in an embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment.

[0026] The main reason for the low comprehensiveness and accuracy of high-risk user discovery in existing technologies is that they generally rely on GES graphs for mining and verification. These graphs only maintain the latest version of the data structure, while KYC user data changes in real time. Once the data changes, past relationships in the GES graph are overwritten, resulting in the inability to discover complete historical relationship chains and directly causing omissions in the discovery of related users. Secondly, for changing KYC user data, the graph topology and mining rules of existing technologies are fixed and cannot adapt to real-time business changes, further leading to incomplete and low-accuracy high-risk user discovery. Furthermore, the discovery of risky users is primarily subject to manual verification, further reducing the comprehensiveness and accuracy of high-risk user discovery.

[0027] In view of this, in order to solve the above problems, as a first aspect of the present invention, a method for determining risk status mining rules is provided, such as... Figure 1 As shown, the method for determining mining rules includes: In step S110, the basic knowledge graph and basic risk mining rules are obtained; In step S120, if an abnormal user is found, multiple candidate related users are obtained by searching the basic knowledge graph according to the basic risk mining rules. In step S130, the risk status of abnormal users and candidate associated users is determined according to the basic risk mining rules; In step S140, the classification model is trained based on the candidate associated users and their corresponding risk status, so that the trained classification model can output the target knowledge graph and target risk mining rules based on the input user information.

[0028] Step S140, as the main inventive point of this application, uses the candidate associated users and corresponding risk status obtained from the preliminary steps S110-S130 to train and dynamically learn the classification model, thereby achieving adaptive updates of the graph and rules. This aims to adapt to the real-time changing KYC data scenario and significantly improve the comprehensiveness and accuracy of high-risk user association mining in the KYC scenario.

[0029] It should be noted that the candidate associated users retrieved from the graph in step S120 include, but are not limited to, the candidate associated users themselves, their identity information, biometric information, device information related to the candidate associated users, network behavior information, graph relationship information, and transaction flow information. The basic risk mining rules disclosed in steps S110-130 include basic association mining rules related to user mining and basic risk scoring rules related to user risk status. Using the results of steps S120 and S130 as input to step S140, the resulting target risk mining rules include target association mining rules and target risk scoring rules.

[0030] The outputs of steps S120 and S130 are used together as input to step S140. In step S140, supervised training is performed on the classification model to improve its discriminative ability. The prediction results of the classification model are then used to drive the updating of the basic knowledge graph and basic risk mining rules, thus obtaining the overall process of the target knowledge graph and target risk mining rules. Figure 2 As shown, as an optional implementation of step S140, training the classification model based on candidate associated users and their corresponding risk states, so that the trained classification model can output a target knowledge graph and target risk mining rules based on the input user information, includes: In step S141, positive samples and negative samples are divided according to the risk status of candidate associated users and a preset status threshold; wherein, candidate associated users whose risk status is greater than or equal to the preset status threshold are considered positive samples, and candidate associated users whose risk status is less than the preset status threshold are considered negative samples. In step S142, the classification model is trained under supervision based on the positive and negative samples to learn the common risk scoring rules among the positive samples. The common risk scoring rules are then added to the basic risk scoring rules to obtain the target risk scoring rules. In step S143, the positive samples are clustered to obtain new association mining rules, and the new association mining rules are added to the basic association mining rules to obtain the target association mining rules. In step S144, at least one of the node addition / deletion or edge update operations is performed on the basic knowledge graph based on the correlation distribution characteristics between the positive and negative samples to obtain the target knowledge graph.

[0031] The candidate associated users in step S141 are the group of candidate associated users coarsely retrieved in step S120. This group includes both malicious actors and general abnormal users. The task of mining associated users of KYC-abnormal users aims to identify associated users such as malicious actors. Therefore, before model training, the sample group is divided based on the risk status of each candidate associated user obtained in step S130, resulting in positive and negative samples for the classification model.

[0032] To further improve the accuracy of risk status determination and achieve adaptive optimization of risk scoring rules in risk mining rules, relying solely on the basic risk scoring rules within the basic risk mining rules still has certain limitations. Specifically, the candidate related user groups obtained in step S130, in addition to the risk characteristics quantified by the basic risk scoring rules, also contain hidden potential risk characteristics that are not captured, represented, or quantified by the current basic risk scoring rules. Therefore, it is necessary to find risk scoring rules corresponding to these potential risk characteristics, improve the comprehensiveness of the risk scoring rules' coverage, accurately distinguish malicious operators from general abnormal users, and thus improve the accuracy of high-risk user discovery. Specifically, abnormal user A and related user B in the candidate related user group are scored according to the current risk scoring rule F1 and determined as positive samples; however, there may be an unknown risk scoring rule F2 between them, and this risk scoring rule F2 better reflects the risk status of both than risk scoring rule F1, and can also be better generalized to the risk status determination of other users.

[0033] Thus, through the dynamic learning of the classification model, the basic risk scoring rule in the basic risk mining rule is continuously optimized to obtain the target risk scoring rule. As an optional implementation of step S142, such as... Figure 3 As shown, the step of supervising the training of the classification model based on the positive and negative samples to learn the common risk scoring rules among positive samples, and then adding the common risk scoring rules to the basic risk scoring rules to obtain the target risk scoring rule, includes: In step S142a, candidate features for the corresponding categories are generated for the positive samples and the negative samples according to the preset feature category generation rules; In step S142b, the candidate features of each category are normalized to obtain the risk sub-scores corresponding to each category of candidate features, and the candidate features and their risk sub-scores are used as risk scoring sub-rules. In step S142c, each risk scoring sub-rule is screened based on its prediction gain on the current classification model and its contribution to the prediction results of the current classification model. In step S142d, the filtered risk scoring sub-rules are clustered and merged to obtain common risk scoring rules; In step S142e, after the model training is completed, the common risk scoring rule is added to the basic risk scoring rule to obtain the target risk scoring rule.

[0034] Specifically, in step S142a, the preset feature category generation rules include, but are not limited to: statistical feature category generation rules, graph feature category generation rules, cross feature category generation rules, and sequence feature category generation rules. Candidate features generated by the statistical feature category generation rules include, but are not limited to: frequency, proportion, burst rate, and time window stability; candidate features generated by the graph feature category generation rules include, but are not limited to: degree, common neighbors, shortest path, and community consistency; candidate features generated by the cross feature category generation rules include, but are not limited to: device reuse rate × nighttime transaction proportion; candidate features generated by the sequence feature category generation rules include, but are not limited to: transaction rhythm and behavioral mutation points.

[0035] As explained above, the candidate features for each category are original features with varying dimensions, inconsistent units, and different value ranges. Considering that multi-dimensional candidate features cannot be directly weighted and merged into rules, the candidate features for each category are normalized according to step S142b to obtain risk sub-scores. Specifically, continuous candidate features are binned or monotonic mapped to obtain risk sub-scores in the [0,1] interval; discrete candidate features are mapped to risk sub-scores in the [0,1] interval using probability estimation; finally, the candidate features and their corresponding risk sub-scores are bound together to obtain a risk scoring sub-rule.

[0036] The following detailed description of the process of generating risk scoring sub-rules in steps S142a-S142b, using several specific embodiments, is provided below.

[0037] Example 1: Using 7-day transaction frequency from the statistical feature category as a candidate feature, the value range of this candidate feature is 0-100 (i.e., the number of transactions a user makes within 7 days can range from 0 to 100, corresponding to the unit of "times"). Binning is used to normalize it: the 7-day transaction frequency is divided into 5 intervals, with a 7-day transaction frequency ≥ 80 times being the highest risk interval. A monotonic mapping is used to map the candidate feature value of this interval to the [0,1] interval, resulting in a risk probability sub-score of 0.85. The resulting risk scoring sub-rule is: when a user's 7-day transaction frequency is ≥ 80 times, the risk probability sub-score corresponding to this candidate feature is 0.85.

[0038] Example 2: Using node degree in the graph feature category as a candidate feature. It should be noted that node degree represents the number of other users a user is associated with in the graph. The value range of this candidate feature is 0-50, and the unit is "number". A monotonic mapping method is used for normalization, setting a positive correlation between node degree and risk sub-score. Specifically, a risk probability sub-score of 0.78 corresponds to a node degree ≥ 30. The resulting risk scoring sub-rule is: when a user has a node degree ≥ 30 in the basic knowledge graph, the risk probability sub-score corresponding to this candidate feature is 0.78.

[0039] Example 3: Using device reuse rate × nighttime transaction ratio from the cross-feature category as candidate features, the original value range is 0-1. After calibration using a monotonic mapping method, a risk probability sub-score of 0.82 is set when device reuse rate × nighttime transaction ratio ≥ 0.6. The resulting risk scoring sub-rule is: when the product of a user's device reuse rate and nighttime transaction ratio ≥ 0.6, the risk probability sub-score corresponding to this candidate feature is 0.82.

[0040] It should be noted that the above embodiments one to three are several specific implementations of steps S142a-S142b of the present invention, which are described in more specific and detailed manner, but the scope of protection of the present invention is not limited thereto.

[0041] Through extensive experimental testing, the applicant of this application discovered that directly feeding all generated risk scoring sub-rules into the classification model for risk scoring can easily lead to problems such as sub-rule redundancy and highly correlated features, causing the model to overlearn repetitive features. Furthermore, the generated risk scoring sub-rules may contain invalid rules that interfere with the model's discrimination performance. This not only lowers the overall accuracy and stability of risk state determination but also severely impacts the learning performance of the classification model, preventing it from accurately extracting common risk features of positive samples and thus weakening the model's ability to drive adaptive updates of the basic risk scoring rules.

[0042] In response, after obtaining the risk scoring sub-rules, step S142c is used to filter each risk scoring sub-rule during the training process based on its prediction gain and contribution to the prediction results of the current classification model.

[0043] Specifically, in step S142c, the prediction gain includes, but is not limited to, evaluation metrics such as AUC (area under the curve), KS (Kolmogorov-Smirnov value), and PR (precision-recall curve). Contribution includes, but is not limited to, quantitative metrics such as SHAP increment (Shapley's explainable contribution) and mutual information.

[0044] Specifically, the selection method based on predictive gain involves examining whether the overall discrimination performance (i.e., evaluation metrics) of the classification model improves after adding a risk scoring sub-rule. If the model's AUC, KS, and PR increase significantly after adding a risk scoring sub-rule, it indicates that the sub-rule is valuable and can be retained. If the model's AUC, KS, and PR remain almost unchanged or even decrease after adding the sub-rule, it indicates that the sub-rule is redundant or disruptive and needs to be removed.

[0045] The specific method for filtering based on contribution involves examining whether a given risk scoring sub-rule has independent explanatory power for the risk assessment of the classification model. If the SHAP increment is high and the mutual information is large, it indicates that the risk scoring sub-rule itself contains risk differentiation information and is not a duplicate feature. If the SHAP is close to 0 and the mutual information is extremely low, it indicates that the risk scoring sub-rule highly overlaps with existing rules and is a redundant sub-item that is repeatedly scored, and it needs to be removed.

[0046] By combining the two dimensions of prediction gain and contribution, redundant sub-rules that do not improve model capabilities, have low contribution, or are highly correlated with features can be screened out and eliminated, retaining only high-quality risk scoring sub-rules with actual risk discrimination value.

[0047] In another implementation of step S142c, in addition to the above-mentioned evaluation dimensions, evaluation indicators such as stability and compliance can also be combined to screen the risk scoring sub-rules. Among them, stability includes, but is not limited to: cross-month PSI, missing rate, and drift rate; compliance includes, but is not limited to: explainability, auditability, and no disabled attributes.

[0048] Finally, the obtained high-quality risk scoring sub-rules are clustered and merged according to step S142d, which drives the model to learn common risk scoring rules. Following step S142e, this common scoring rule is added to the basic risk scoring rules to obtain the target risk scoring rule.

[0049] It should be noted that in actual business applications, the filtered target risk scoring sub-rules can be sent to the business sub-item library, and assigned a number and version information, and marked with their source, launch time and applicable scenarios, to complete the business rule registration and versioning tasks.

[0050] In one embodiment, the classification model can employ LightGBM. During the training of LightGBM and the acquisition of the target risk scoring rules, to improve the discrimination accuracy of common risk scoring rules, ensure a reasonable allocation of contributions among each risk scoring rule, and address the problems of disordered weights, unbalanced contributions, and large weight oscillations among the various risk scoring rules, as one implementation of step S142, such as... Figure 4 As shown, the supervised training process further includes: In step S142a, during the training process, the rule weights corresponding to the common risk scoring rule and the basic risk scoring rule are subject to normalization constraints respectively. In step S142b, the rule weights after normalization constraints are adjusted according to the contribution of the common risk scoring rules and the basic risk scoring rules to the prediction results of the classification model.

[0051] The purpose of normalization constraints is to incorporate smoothing and debouncing constraints during training to prevent large fluctuations in weights and ensure stable and reliable risk assessment results.

[0052] Specifically, the rule weights after normalization constraints are given by the following formulas (1) and (2): ≥0, (1) (2) In equations (1) and (2) above, i represents each corresponding scoring rule (common risk scoring rule and basic risk scoring rule); SHAP is the Shapley interpretable contribution value; C i Contribution to each scoring rule; w i These are the rule weights after normalization constraints.

[0053] After obtaining the rule weights after normalization constraints for each scoring rule and each rule, the corresponding risk score is obtained by weighted summation according to formula (3).

[0054] (3) In equation (3) above, w i For the normalized constraint rules, s i For the rules. Risk scoring.

[0055] In application, based on risk scores and preset threshold classifications, corresponding handling strategies can be provided. Specifically, low risk adopts an automatic release strategy; medium risk adopts a strategy of triggering secondary authentication or enhanced verification; high risk adopts a review or limit strategy; and extremely high risk adopts a strategy of interception, freezing, or reporting.

[0056] Samples with a hit strategy of high risk or very high risk are used again as training sample data. Steps S142a-S142e are executed cyclically to automatically discover new common risk scoring rules, update the new target risk scoring rules, and continuously adjust the rule weights after normalization constraints, thereby realizing the closed-loop processing of dynamic iterative learning of classification model and risk identification.

[0057] In addition to the automatically updated target risk scoring rules described above, this application can also cluster positive samples and positive samples that hit the strategy of high risk or very high risk according to step S143 to obtain new association mining rules. These new association mining rules are then added to the basic association mining rules to obtain the target association mining rules. The target association mining rules and the target risk scoring rules together serve as the target risk mining rules output by the model.

[0058] Specifically, as an example of positive sample clustering in step S143, the multidimensional risk features of the hit positive samples are automatically learned and extracted during the training of the classification model; the multidimensional risk features among positive samples are clustered according to feature similarity, and new association mining rules, such as mining rules for similar risk patterns and behavioral behaviors, are learned from similar groups.

[0059] As a data carrier related to high-risk user mining, the basic knowledge graph can not only intuitively reflect the relationships between various users, but also preserve the connection between user behavior and risky behavior. To address the problem that the fixed knowledge graph structure in traditional methods cannot adapt to dynamic business changes, this application continues to utilize a classification model to drive the updating of the basic knowledge graph. As an optional implementation of step S144, such as... Figure 5 As shown, the step of performing at least one of node addition / deletion or edge update operations on the basic knowledge graph based on the correlation distribution characteristics between positive and negative samples to obtain the target knowledge graph includes: In step S144a, if there are identical correlation distribution features between any two positive samples, the samples corresponding to the identical correlation distribution features are added to the basic knowledge graph as graph nodes. In step S144b, risk relationship edges are constructed between the newly added graph node and the graph nodes corresponding to the two positive samples.

[0060] It should be noted that the association distribution characteristics between positive and negative samples include the association distribution characteristics between positive samples, the association distribution characteristics between negative samples, and the differences and cross-associations between positive and negative samples. Steps S144a-S144b above only provide one embodiment of updating the knowledge graph structure based on the relationships between positive samples. A complete graph update includes, but is not limited to, operations that optimize the graph topology, such as adding unknown nodes, improving or modifying existing relationships, supplementing hidden risk links, and removing invalid associations.

[0061] The graph is constructed by using collected identity information, biometric information, device information, network information, and behavioral information as its constituent elements. Specifically, user information, user IP addresses, enterprise module information, legal representative module, ubo module, and agent module are encrypted and stored in the graph in atomic form. Figure 6This is a structural diagram of a knowledge graph proposed in this application. Nodes in the graph represent core information, typically unique identifiers for enterprises or individuals. Transactional activities and shared identifiers between any two nodes form the edges of the graph. Specifically, enterprise information, legal representative information, and ubo information are stored as nodes; IP addresses, device information, email addresses, and ID numbers are also stored as nodes. Enterprise information includes ID numbers, which are associated with existing nodes to create edge relationships; user information is associated with phone numbers, email addresses, and IP addresses to create edge relationships.

[0062] Specifically, with Figure 6 Taking a basic knowledge graph as an example, the graph is searched for samples with a high or extremely high risk hit strategy. If none are found, a new node is added to the graph, serving as a unique identifier for the hit sample. The new node is then labeled as a high-risk or extremely high-risk sample, and the risk relationships between this sample and other nodes are added to the graph (i.e., the graph edges are updated). If a hit sample exists in the graph, the association distribution characteristics between the hit samples are analyzed (the association distribution characteristics include, but are not limited to, time-series characteristics, device homology characteristics, identity association characteristics, transaction interaction characteristics, and business scenario association characteristics). If the association distribution characteristics point to a new sample not yet present in the graph, this sample is added to the knowledge graph as a new node, and the risk relationships between the hit sample and the new sample are added, and the graph edges are updated, achieving dynamic updates to the graph. Furthermore, during the graph update process, if certain nodes in the graph need to be deleted, all associated edges corresponding to those nodes must be adaptively deleted simultaneously to ensure the integrity and consistency of the knowledge graph topology.

[0063] Based on the aforementioned publicly available training and optimization techniques, the classification model is trained under supervision using selected samples. This sample data is then used to improve the model's discriminative ability, and the model's predictions drive iterative updates to the target knowledge graph and target risk mining rules. Therefore, this approach can adapt to real-time changes in KYC data, dynamically updating the target risk mining rules and target knowledge graph simultaneously. This ensures the comprehensive and accurate identification of high-risk users, effectively improving the comprehensiveness and accuracy of risk identification and guaranteeing the timeliness and reliability of risk prevention and control.

[0064] Similarly, before training, a basic risk mining rule and a basic knowledge graph will be used as the initial version. The basic risk mining rule includes basic association mining rules and basic risk scoring rules. As an optional implementation of step S130, such as Figure 7 As shown, determining the risk status of abnormal users and candidate associated users based on the basic risk mining rules includes: In step S131, abnormal users and candidate associated users are scored according to the basic risk scoring rules in the basic risk mining rules to obtain multiple scoring results; In step S132, the multiple scoring results are weighted and summed to obtain the risk status.

[0065] Determining the initial risk status based on basic risk scoring rules is essentially a multi-dimensional risk status analysis algorithm. Specifically, taking an example with eight basic risk scoring rules: address similarity analysis, address distance analysis, device fingerprint analysis, network and VPN similarity analysis, risk region / IP analysis, frequency ratio analysis of transfers by the same person, overlap analysis of legal representatives / shareholders, and correlation analysis between legal representatives / shareholders / agents and recipients of funds.

[0066] The scoring rules for address similarity analysis are as follows: scores are output based on text similarity algorithms such as edit distance and vector similarity. The scoring rules for address distance analysis are as follows: based on address to latitude and longitude, calculate spherical / straight-line distance, and output scores by segmenting distances; The scoring rules for device fingerprint consistency analysis are as follows: scores are output based on fingerprint hit ratio or Boolean hit mapping. The scoring rules for network and VPN similarity analysis are as follows: scores are output based on IP similarity, same exit point, and same VPN service characteristics. The scoring rules for risk region / IP analysis are as follows: scores are output based on risk regions, blacklisted network segments, proxy IP feature mapping, etc. The scoring rules for the analysis of the frequency ratio of transfers by the same person are as follows: the frequency of transfers by the same person is statistically analyzed by time window and the scores are output by hierarchical mapping.

[0067] The scoring rules for the legal entity / shareholder overlap analysis are as follows: the score is output based on the degree of overlap of the main relationships in the graph, the graph adjacency strength mapping, etc. The scoring rules for the association analysis between legal entities / shareholders / agents and recipients of funds are as follows: scores are output based on role overlap or nearest neighbor path mapping, etc.

[0068] Each basic risk scoring rule has a corresponding score, and the risk status can be obtained by weighted summation. It should be noted that the number of risk scoring rules and the content of the rules are updated and optimized as the model is trained.

[0069] Similarly, this is an optional implementation of step S120. For example... Figure 8 As shown, when an abnormal user is identified, the basic risk mining rules are used to search the basic knowledge graph to obtain multiple candidate related users, including: In step S121, based on the basic association mining rules in the basic risk mining rules, abnormal user nodes are mined in the basic knowledge graph to retrieve multiple candidate associated user nodes that match the basic association mining rules.

[0070] Retrieving candidate related users based on basic association mining rules is essentially a multi-dimensional user mining algorithm. However, each basic association mining rule is performed independently during the mining process. Specifically, taking three basic association mining rules as an example: Rule 1, Rule 2, and Rule 3.

[0071] The specific mining rule for mining rule 1 is: search for identical users in the graph based on their IP addresses; The specific mining rule for mining rule 2 is as follows: In the graph, search for legal persons, agents, and UBO companies that are the same as or act as agents for other companies based on the user's legal person, UBO, and agent. The specific mining rule for rule 3 is: to find different users in the graph who have simultaneously transacted with the same person and have a certain degree of similarity and frequency.

[0072] It should be noted again that each basic association mining rule may uncover the same candidate associated users or different candidate associated users. The number of items and the content of the basic association mining rules are updated and optimized as the model is trained. It should also be emphasized that in practical applications, the candidate associated user group mined in step S120 will undergo snapshot sealing and review to prevent the omission of candidate associated users, ensuring the integrity of risk mining in the coarse search stage while enabling historical data traceability.

[0073] An overall flowchart of the risk status mining rule determination method of this application is as follows: Figure 9 As shown.

[0074] Each newly learned association mining rule is added to the mining rule base. The latest updated mining rule base is configured. When an abnormal KYC user is detected, a multi-level search is performed based on the association mining rules in the mining rule base to identify customers who meet the criteria. The data of customers meeting the criteria is pushed to GES for snapshot archiving. Since each newly learned risk scoring rule is added to the risk scoring rule base, the risk scoring rule base also needs to be configured (i.e.,...). Figure 9 The computational engine in the system will score eligible customers according to various risk scoring rules in the risk scoring rule base (i.e., ...). Figure 9(The system performs calculations using the execution calculation engine). After obtaining the final risk, it determines whether to push the risk for review based on the risk calculation results. Finally, it configures the automated review process and rules, and when the review determines that there is an anomaly, it sends the data back to KYC in batches and tags it.

[0075] Figure 10 To and Figure 9 A detailed flowchart showing the risk results obtained during the corresponding execution calculation engine. For example... Figure 10 As shown, the process first loads the pre-configured risk scoring rules from the calculation engine, loads KYC data, and then calculates corresponding risk sub-scores according to the following criteria: address similarity comparison, whether the transferor is a legal entity or UBO, address distance calculation, device fingerprint matching, IP rules, risk regions, overlap of shareholders and legal entities, number of transfers to the same person, and other rules. Finally, the risk sub-scores from each rule are weighted and summed to obtain the final risk score. The risk score is compared with preset multi-level status thresholds to obtain the final risk status. Different handling strategies are adopted for different risk statuses. Specifically, low risk uses an automatic release strategy; medium risk uses a secondary authentication or enhanced verification strategy; high risk uses a review or limit strategy; and extremely high risk uses an interception, freezing, or reporting strategy.

[0076] To address the issue that existing technologies rely heavily on manual verification of identified high-risk users, which further reduces the comprehensiveness and accuracy of high-risk user identification, this application's method for determining risk status identification rules also includes an automated review process. For example... Figure 11 As shown, Figure 11 To and Figure 9 The corresponding detailed flowchart for the automated review process is as follows: First, configure the automated review rules. After triggering the review rules, the process enters two main stages: automated review and manual review. If the automated review is successful, the process ends directly; if the automated review is rejected, the KYC status is reverted and marked, ending the process. For applications going to manual review, the data needs to be manually verified. The process ends after the manual verification is successful; if the manual review fails, the KYC status is reverted and marked, ending the process.

[0077] The automated review process of this application can significantly improve review and processing efficiency, effectively shorten the time required for manual intervention, and improve the overall processing time of risk control review.

[0078] In the process of business processing using the method described in this application, the final processing results will be documented and visualized, and all key data will be saved throughout the process to form a traceable risk handling report to support regulatory audits and operational reviews. The saved data includes, but is not limited to: the hit status of each rule, sub-rule scores, weight configurations, final total score, action taken, timestamps, and model version information.

[0079] As a second aspect of the present invention, a method for determining a risk status is provided, such as... Figure 12 The determination method includes: In step S210, the user information to be determined is input into the trained classification model to obtain the target knowledge graph and target risk mining rules; wherein, the trained classification model is trained by the risk status mining rule determination method provided by the first aspect of the present invention; In step S220, if the user information to be determined is an abnormal user, multiple candidate related users are obtained by searching the target knowledge graph according to the target risk mining rules. In step S230, the risk status of abnormal users and candidate associated users is determined according to the target risk mining rules.

[0080] The method provided by this invention can first adapt to real-time changes in KYC user data, and can train a classification model based on the real-time changes in KYC user data, synchronously drive the iteration and update of risk mining rules and knowledge graphs, dynamically adapt to complex and ever-changing actual business scenarios, and has strong adaptability and robustness.

[0081] Secondly, regarding this function, the hierarchical mining approach combining coarse and fine retrieval, implemented in this application using graphs, rules, and classification models, effectively distinguishes between ordinary users performing routine operations and high-risk users exhibiting malicious behavior. This avoids classifying all batches of candidate users retrieved by the basic risk mining rules as abnormally associated users, significantly reducing redundant and ineffective mining activities and lowering system computational redundancy. During training, the classification model is supervised through the use of selected real high-risk samples. Based on optimizing the model's capabilities, the knowledge graph and risk mining rules are iteratively updated to fill the coverage blind spots of the basic risk mining rules, effectively reducing the problem of missing high-risk associated users.

[0082] Finally, the method provided by this invention differs from the fixed mining strategies and knowledge graph structures used in existing technologies. It not only eliminates the need for frequent manual changes to mining strategies and maintenance and updates to the graph, but also avoids the discrimination bias caused by single, fixed rules and graphs. While automatically adapting to business changes, it continuously improves the accuracy of identifying and mining malicious high-risk users, and significantly enhances the comprehensiveness and accuracy of high-risk user association mining in KYC scenarios.

[0083] The risk status mining rules and risk status determination methods of this application can be applied to various business scenarios, typical application scenarios include: Application Scenario 1: Reverse correlation query scenario for users whose transaction behavior matches the rules. Specifically, based on users whose transaction behavior matches the rules, their KYC data is queried in reverse, and related customers are retrieved through multi-level retrieval of knowledge graphs to achieve batch screening and identification of risk groups.

[0084] Application Scenario 2: Risk retrieval scenario for users with abnormal login activity. Specifically, based on the risk characteristics of users with abnormal login activity, the system reversely determines abnormal behavior and retrieves their associated KYC customers, thus identifying potential high-risk groups in advance.

[0085] As a third aspect of the present invention, an electronic device is provided, such as... Figure 13 As shown, it includes: One or more processors 101; The memory 102 stores one or more computer programs that, when executed by the one or more processors 101, cause the one or more processors 101 to implement a method for determining risk status mining rules according to a first aspect of the present invention and a method for determining risk status according to a second aspect of the present invention.

[0086] The tool may also include one or more I / O interfaces 103 connected between the processor 101 and the memory 102, configured to enable information interaction between the processor 101 and the memory 102.

[0087] The processor 101 is a device with data processing capabilities, including but not limited to a central processing unit 101 (CPU); the first memory 102 is a device with data storage capabilities, including but not limited to random access memory 102 (RAM, more specifically SDRAM, DDR, etc.), read-only memory 102 (ROM), electrically erasable programmable read-only memory 102 (EEPROM), and flash memory (FLASH); the I / O interface 103 (read-write interface) is connected between the processor 101 and the memory 102, enabling information interaction between the processor 101 and the memory 102, including but not limited to a data bus 104 (Bus).

[0088] In some embodiments, the processor 101, memory 102, and I / O interface 103 are interconnected via bus 104, and thus connected to other components of the computing device.

[0089] Furthermore, as a fourth aspect of the present invention, a computer-readable medium is also provided having a computer program stored thereon, such as... Figure 14 As shown, when the computer program is executed by the processor, it implements the risk state mining rule determination method provided by the first aspect of the present invention and the risk state determination method provided by the second aspect of the present invention.

[0090] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. Accordingly, the computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can implement the methods of any of the above embodiments. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0091] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Those skilled in the art should understand that the present invention includes, but is not limited to, the contents described in the accompanying drawings and the specific embodiments above. Any modifications that do not depart from the functional and structural principles of the present invention will be included within the scope of the claims.

Claims

1. A method for determining risk status mining rules, characterized in that, The method for determining the mining rules includes: Obtain a basic knowledge graph and basic risk mining rules; the basic risk mining rules include basic association mining rules and basic risk scoring rules. Upon identifying an abnormal user, multiple candidate associated users are obtained by searching the basic knowledge graph according to the basic risk mining rules. The risk status of abnormal users and candidate associated users is determined based on the basic risk mining rules. The classification model is trained based on candidate associated users and their corresponding risk states, enabling the trained model to output a target knowledge graph and target risk mining rules based on the input user information, including: Positive and negative samples are divided based on the risk status of candidate associated users and a preset status threshold; wherein, candidate associated users whose risk status is greater than or equal to the preset status threshold are considered positive samples, and candidate associated users whose risk status is less than the preset status threshold are considered negative samples. The classification model is trained under supervision based on the positive and negative samples to learn the common risk scoring rules among the positive samples. The common risk scoring rules are then added to the basic risk scoring rules to obtain the target risk scoring rules. Clustering the positive samples yields new association mining rules, which are then added to the basic association mining rules to obtain the target association mining rules. Based on the correlation distribution characteristics between the positive and negative samples, perform at least one of the node addition / deletion or edge update operations on the basic knowledge graph to obtain the target knowledge graph. The target risk mining rules include target association mining rules and target risk scoring rules.

2. The method for determining mining rules according to claim 1, characterized in that, The step of supervising the training of the classification model based on the positive and negative samples to learn common risk scoring rules among positive samples, and then adding these common risk scoring rules to the basic risk scoring rules to obtain the target risk scoring rule, includes: For the positive and negative samples, candidate features for the corresponding categories are generated according to the preset feature category generation rules; The candidate features of each category are normalized to obtain the risk sub-scores corresponding to each category of candidate features, and the candidate features and their risk sub-scores are used as risk scoring sub-rules. Each risk scoring sub-rule is selected based on its predictive gain and contribution to the prediction results of the current classification model. The selected risk scoring sub-rules are clustered and merged to obtain common risk scoring rules; After the model training is completed, the common risk scoring rules are added to the basic risk scoring rules to obtain the target risk scoring rules.

3. The method for determining mining rules according to claim 2, characterized in that, The supervised training process also includes: During training, the rule weights corresponding to the common risk scoring rule and the basic risk scoring rule are subject to normalization constraints. The rule weights after normalization are adjusted based on the contribution of the common risk scoring rules and the basic risk scoring rules to the prediction results of the classification model.

4. The method for determining mining rules according to claim 1, characterized in that, The step of performing at least one of node addition / deletion or edge update operations on the basic knowledge graph based on the correlation distribution characteristics between positive and negative samples to obtain the target knowledge graph includes: If any two positive samples have the same correlation distribution characteristics, the samples corresponding to the same correlation distribution characteristics are added to the basic knowledge graph as graph nodes. Risk relationship edges are constructed between the newly added graph nodes and the graph nodes corresponding to the two positive samples.

5. The method for determining mining rules according to any one of claims 1 to 4, characterized in that, The step of determining the risk status of abnormal users and candidate associated users according to the basic risk mining rules includes: For abnormal users and candidate related users, scores are assigned according to the basic risk scoring rules in the basic risk mining rules, resulting in multiple scoring results; The risk status is obtained by weighted summation of multiple scoring results.

6. The method for determining mining rules according to any one of claims 1 to 4, characterized in that, Upon identifying an abnormal user, the system retrieves multiple candidate associated users from the basic knowledge graph according to the basic risk mining rules, including: Based on the basic association mining rules in the basic risk mining rules, abnormal user nodes are mined in the basic knowledge graph to retrieve multiple candidate associated user nodes that match the basic association mining rules.

7. A method for determining a risk state, characterized in that, The determination method includes: The user information to be determined is input into the trained classification model to obtain the target knowledge graph and target risk mining rules; wherein, the trained classification model is trained by the risk status mining rule determination method provided according to any one of claims 1 to 6; If the user information to be determined is an abnormal user, multiple candidate related users are obtained by searching the target knowledge graph according to the target risk mining rules. The risk status of abnormal users and candidate associated users is determined based on the target risk mining rules.

8. An electronic device, characterized in that, include: One or more processors; A memory having stored thereon one or more computer programs that, when executed by the one or more processors, cause the one or more processors to implement the method according to any one of claims 1 to 7.

9. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 7.

Images