Method, device and equipment for obtaining user transaction risk and medium

Abstract

Embodiments of the present application disclose a method and device for obtaining user transaction risk, equipment and medium, wherein the method comprises: obtaining a credit application record of a target object, and extracting a credit application behavior feature of the target object in a fund raising stage according to the credit application record; inputting the credit application behavior feature into a pre-trained anti-fraud risk early warning model to obtain a baseline risk score corresponding to the target object; matching the credit application behavior feature with a risk rule in a preset rule library to obtain a rule trigger identifier and a rule risk score corresponding to the target object; generating a final risk score corresponding to the target object according to a preset fusion strategy based on the baseline risk score and the rule trigger identifier and the rule risk score; determining an early warning level corresponding to the target object according to the final risk score, and outputting the early warning level.

Description

Technical Field

[0001] This application relates to, but is not limited to, the field of data security, and in particular to a method, apparatus, device, and medium for obtaining user transaction risks. Background Technology

[0002] In recent years, telecommunications and online fraud cases have continued to occur frequently, and the methods of fraud are becoming more covert, rapidly evolving, and diversified in scenarios. In scenarios such as loan inducement fraud and new types of rapid fraud, fraudsters usually induce victims to have an urgent need for financing by continuously inducing them, thereby generating abnormal credit application behavior in a short period of time, and then quickly transferring the funds after they are received.

[0003] Existing monitoring technologies primarily focus on the contact and interaction phase before fraud is committed and the fund transfer phase after fraud is committed, relying mainly on interaction or fund transfer characteristics. Feature systems built upon communication, device, and social behavior mainly reflect users' external interactive behaviors, which are usually indirectly related to fraud risk. Furthermore, in real-world adversarial environments, they are susceptible to interference from dynamic IP proxies, device spoofing, and communication evasion techniques, leading to decreased feature stability and affecting the accuracy and stability of early warnings. On the other hand, while monitoring methods based on fund transfer behavior can directly reflect risk outcomes, relevant signals are usually only available when funds have already been transferred or are about to be transferred, resulting in delayed early warning triggers and difficulty in timely intervention measures before funds are transferred. Therefore, existing technologies lack behavioral data sources that can both directly reflect changes in fund status and provide proactive insights, making it difficult to achieve effective risk identification before funds are transferred. Summary of the Invention

[0004] In view of this, embodiments of this application provide at least one method, apparatus, device, and medium for obtaining user transaction risks.

[0005] The technical solution of this application embodiment is implemented as follows: On the one hand, embodiments of this application provide a method for obtaining user transaction risk, the method comprising: Obtain the credit application records of the target object, and extract the credit application behavior characteristics of the target object during the fundraising stage based on the credit application records; The credit application behavior characteristics are input into a pre-trained anti-fraud risk early warning model to obtain the benchmark risk score corresponding to the target object; The credit application behavior characteristics are matched with risk rules in a preset rule base to obtain the rule triggering identifier and rule risk score corresponding to the target object; Based on the baseline risk score, the rule trigger identifier, and the rule risk score, the final risk score corresponding to the target object is generated according to a preset fusion strategy. The warning level corresponding to the target object is determined based on the final risk score, and the warning level is output.

[0006] On the other hand, embodiments of this application provide a device for acquiring user transaction risk, the method comprising: The processing module is used to obtain the credit application records of the target object and extract the credit application behavior characteristics of the target object in the fundraising stage based on the credit application records; The credit application behavior characteristics are input into a pre-trained anti-fraud risk early warning model to obtain the benchmark risk score corresponding to the target object; The credit application behavior characteristics are matched with risk rules in a preset rule base to obtain the rule triggering identifier and rule risk score corresponding to the target object; Based on the baseline risk score, the rule trigger identifier, and the rule risk score, the final risk score corresponding to the target object is generated according to a preset fusion strategy. The output module is used to determine the warning level corresponding to the target object based on the final risk score, and output the warning level.

[0007] In another aspect, embodiments of this application provide a computer device, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the program, it implements some or all of the steps in the above-described method for obtaining user transaction risks.

[0008] In another aspect, embodiments of this application provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements some or all of the steps in the above-described method for obtaining user transaction risks.

[0009] In another aspect, embodiments of this application provide a computer program including computer-readable code. When the computer-readable code is run in a computer device, the processor in the computer device executes some or all of the steps in the above-described method for obtaining user transaction risks.

[0010] In another aspect, embodiments of this application provide a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. When the computer program is read and executed by a computer, it implements some or all of the steps in the above-described method for obtaining user transaction risks.

[0011] This application embodiment combines the generalization ability of machine learning models with the rapid reinforcement ability of business rules by acquiring credit application behavior characteristics during the fundraising stage and inputting them into the model and rule base for parallel processing, and then generating the final warning result according to the preset fusion strategy. This improves the timeliness, accuracy and stability of warnings in complex scenarios such as insufficient samples.

[0012] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of this application. Attached Figure Description

[0013] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with this application and, together with the specification, serve to explain the technical solutions of this application.

[0014] Figure 1 A schematic diagram illustrating the implementation process of a method for obtaining user transaction risk provided in an embodiment of this application; Figure 2 A schematic diagram illustrating the structural composition of a user transaction risk acquisition device provided in this application embodiment; Figure 3 This is a schematic diagram of the hardware entity of a computer device provided in an embodiment of this application. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application are further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0016] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0017] The terms “first / second / third” are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that “first / second / third” may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. The terminology used herein is for descriptive purposes only and is not intended to limit the scope of this application.

[0019] This application provides a method for obtaining user transaction risk, which can be executed by the processor of a computer device. The computer device can refer to a server, laptop, tablet, desktop computer, smart TV, set-top box, mobile device (such as a mobile phone, portable video player, personal digital assistant, dedicated messaging device, portable gaming device), or other similar computer equipment. Figure 1 This is a schematic diagram illustrating the implementation process of a method for obtaining user transaction risk provided in an embodiment of this application, as shown below. Figure 1 As shown, the method includes: Step 101: Obtain the credit application records of the target object, and extract the credit application behavior characteristics of the target object in the fundraising stage based on the credit application records.

[0020] In this embodiment, the target is a specific individual of interest who requires risk warning, such as an individual user initiating a loan application at a financial institution. Credit application records are data corresponding to the target's loan application behavior at financial institutions or lending platforms, including fields such as application time, application platform, and application result. The fundraising stage is the period during which the victim takes action to obtain funds during the fraudulent activity, and their behavioral characteristics differ from normal borrowing behavior. Credit application behavior characteristics are numerical values ​​or indicators that quantify the target's application behavior, obtained through statistical analysis and calculation of credit application records, such as the number of loan applications submitted in a single day.

[0021] The system retrieves credit application records of the target individuals from credit business data sources. Subsequently, based on these records, it extracts credit application behavior characteristics that can characterize the abnormal behavior of the target individuals during the fraudulent fundraising stage by setting multi-scale time windows and performing aggregation calculations and arithmetic logic operations. These characteristics include short-term application surge coefficients and the proportion of applications to high-risk platforms.

[0022] Step 102: Input the credit application behavior characteristics into the pre-trained anti-fraud risk warning model to obtain the benchmark risk score corresponding to the target object.

[0023] In this embodiment, the anti-fraud risk warning model is a machine learning model, such as a gradient boosting tree model, pre-trained using historical labeled samples. Its function is to map the input multi-dimensional credit application behavior features into a risk score. The baseline risk score is a value between 0 and 1 output by the anti-fraud risk warning model, used to initially quantify the degree to which the target's current behavior poses a fraud risk.

[0024] The calculated credit application behavior characteristics are input into a pre-trained anti-fraud risk warning model. Internally, this model uses complex nonlinear functions to map the input feature vectors into a numerical value, namely a baseline risk score. A higher score indicates that the model considers the target's behavior pattern more similar to historical fraud samples, and therefore a higher level of risk.

[0025] Step 103: Match the credit application behavior characteristics with the risk rules in the preset rule base to obtain the rule triggering identifier and rule risk score corresponding to the target object.

[0026] In this embodiment, the preset rule base is a set of machine-executable logical judgment conditions derived from historical case experience and expert knowledge, such as "if the number of applications submitted to more than 5 platforms in a day, then trigger the rule." A risk rule is a specific judgment logic within the preset rule base, containing characteristic conditions, thresholds, and logical combinations. The rule trigger identifier is a Boolean value indicating whether the credit application behavior characteristics of the target object match any of the preset risk rules. The rule risk score is a risk score assigned based on the preset severity of the rule after it is triggered.

[0027] The credit application behavior characteristics calculated in step 101 are matched in parallel with each risk rule in the preset rule base. If the feature value meets the conditions of a certain rule, the trigger flag corresponding to the rule is set to "triggered", and the corresponding rule risk score is calculated according to the preset weight or score of the rule; if no rule is matched, the trigger flag is "not triggered", and the rule risk score is zero or a base value.

[0028] Step 104: Based on the baseline risk score, the rule trigger identifier, and the rule risk score, generate the final risk score corresponding to the target object according to a preset fusion strategy.

[0029] In this embodiment, the preset fusion strategy is a predefined mathematical formula or logical judgment rule used to combine model output and rule output. For example, "when a rule is triggered and the rule score is higher than the model score, the final score is the rule score; otherwise, the model score is taken." The final risk score is a numerical value representing the overall risk level of the target object, obtained by combining the judgment of the machine learning model and the judgment of the business rules.

[0030] The system receives a baseline risk score, a rule trigger identifier, and a rule risk score. Based on a pre-defined fusion strategy, such as maximizing the value, using a weighted average, or segmented risk enhancement, it calculates the risk score from these inputs to generate a unified final risk score. This score combines the model's ability to learn complex nonlinear patterns with the rules' ability to respond quickly to significant anomalous patterns.

[0031] Step 105: Determine the warning level corresponding to the target object based on the final risk score, and output the warning level.

[0032] In this embodiment, the warning level is a risk level classified based on the final risk score, such as high risk, medium risk, and low risk, used to instruct business personnel to take different levels of intervention measures. Output is the process of sending structured information such as the warning level to downstream business processes or user interfaces via a data interface.

[0033] The calculated final risk score is compared with multiple preset grading thresholds. Based on the score's range, the corresponding warning level for the target object is determined, such as high risk, medium risk, or low risk. The target object's identifier, final risk score, warning level, and potentially key impact characteristics are combined into a structured warning result, which is then output to downstream business processes via API calls for manual review or risk intervention.

[0034] This application embodiment combines the generalization ability of machine learning models with the rapid reinforcement ability of business rules by acquiring credit application behavior characteristics during the fundraising stage and inputting them into the model and rule base for parallel processing, and then generating the final warning result according to the preset fusion strategy. This improves the timeliness, accuracy and stability of warnings in complex scenarios such as insufficient samples.

[0035] Optionally, step 101 includes: Step 1011: Receive a new credit application event and determine the identity information of the target object based on the new credit application event.

[0036] In this embodiment, a new credit application event is a received trigger signal indicating that a new credit application has occurred. The target is a specific individual or entity whose credit application behavior risk needs to be assessed.

[0037] Receives a "new credit application event" signal from upstream business or data interface. Based on this event, the specific target object associated with the event is parsed out, and the unique identity information of the target object, such as user ID, ID card number, etc., is determined in order to obtain its historical data later.

[0038] Step 1012: Obtain the original credit application records of the target object within a preset historical time range from the credit business data source based on the identity information. The original credit application records include at least the application time, application platform, application result, and platform type.

[0039] In this embodiment, the credit business data source is a database storing credit application-related data. The original credit application record is application data obtained directly from the data source without any processing. The preset historical time range is a pre-defined time length used to analyze the target's behavior, such as the past 7 days, 30 days, or 90 days. The application time is the specific date and time the target initiated the credit application. The application platform is the specific institution or channel through which the target submitted the credit application, such as a bank, consumer finance company, or internet lending platform. The application result is the final status of the credit application, such as approved, rejected, or pending review. The platform type is a classification based on platform attributes, such as a banking platform or a non-banking platform.

[0040] Based on the identified identity information, all original credit application records of the target individual within a preset historical time range are retrieved from the credit business data source. These original records form the basis for subsequent analysis and contain key data fields such as application time, application platform, application result, and platform type.

[0041] Step 1013: De-identify the identity information in the original credit application record to generate a unique identifier corresponding to the target object.

[0042] In this embodiment, desensitization is the process of replacing or hiding sensitive personal identification information. A unique identifier is a generated code used to replace real identity information in subsequent processing and does not contain any personal privacy information.

[0043] To protect the privacy of the target individuals, the identity information in the original credit application records is anonymized. The actual identity information is replaced with a unique code corresponding to the target individual, which does not contain personal privacy information—a unique identifier. All subsequent data processing and analysis are then based on this unique identifier, thus ensuring data security.

[0044] Step 1014: Perform format verification, invalid record filtering, duplicate record removal and standardization on the original credit application record after anonymization to obtain a standardized credit application record.

[0045] In this embodiment, format validation is the process of checking whether the data conforms to a preset format specification. Invalid record filtering is the process of identifying and removing data records that do not meet quality requirements. Duplicate record removal is the process of identifying and deleting redundant data records with identical or highly similar content. Standardization processing is the process of converting data into a uniform format and unit. Standardized credit application records are data that has passed all the above data cleaning steps and is of acceptable quality and uniform format.

[0046] Data cleaning is performed on the original credit application records after anonymization. Format validation is performed to remove records with format errors or missing key information. Invalid record filtering is performed to exclude data generated by test accounts or other non-genuine activities. Duplicate record removal is performed, merging or deleting duplicate application records caused by network latency or other reasons. Standardization processing is performed to unify the format, units, and coding of all data. After these steps, standardized credit application records are obtained, which can be used for subsequent analysis.

[0047] Step 1015: Based on the standardized credit application records, the application frequency, number of application platforms, number of applications during sensitive periods, number of applications on non-bank platforms, number of applications on high-interest platforms, and application approval rate of the target object are statistically analyzed within multiple preset time windows to obtain basic behavioral characteristics.

[0048] In this embodiment, the preset time window is a pre-defined time period used to aggregate and calculate behavioral characteristics, such as 1 day, 3 days, or 7 days. Application frequency is the number of times the target object initiates a credit application within a specific time window. The number of application platforms is the total number of different credit platforms the target object has applied to within a specific time window. The number of applications during sensitive periods is the number of times the target object initiates a credit application during preset abnormal activity periods, such as late at night or early morning, within a specific time window. The number of applications to non-bank platforms is the number of times the target object initiates applications to non-bank credit platforms within a specific time window. The number of applications to high-interest platforms is the number of times the target object initiates applications to platforms with higher interest rates within a specific time window. The application approval rate is the proportion of applications approved by the platform within a specific time window out of the total number of applications. Basic behavioral characteristics are quantitative indicators directly statistically derived from the raw data that describe the target object's basic credit application behavior.

[0049] Based on standardized credit application records, statistical calculations are performed on the credit application behavior of target individuals within multiple preset time windows. Specifically, the calculations for each time window include application frequency, number of application platforms, number of applications during sensitive periods, number of applications on non-bank platforms, number of applications on high-interest-rate platforms, and application approval rate. These statistical results constitute the basic behavioral characteristics describing the target individuals' fundamental behavioral patterns.

[0050] Step 1016: Based on the basic behavioral characteristics, perform temporal cross-combination and arithmetic logic operations on the multiple preset time windows to obtain derived characteristics used to characterize abnormal application behavior.

[0051] In this embodiment, derived features are composite features generated by combining, operating on, and transforming basic behavioral features, which can more deeply characterize abnormal behavior patterns. Temporal cross-combination involves associating and comparing basic behavioral features from different time windows across time dimensions. Arithmetic and logical operations include mathematical and logical operations such as addition, subtraction, multiplication, division, and comparison. Abnormal application behavior is behavior that significantly deviates from normal user behavior patterns and may indicate a risk of fraud, such as a surge in the number of applications within a short period or simultaneous applications to multiple platforms.

[0052] To more accurately capture abnormal behavior patterns, derived features are generated based on fundamental behavioral characteristics through temporal cross-combination and arithmetic logic operations. Basic features from different time windows are combined; for example, the ratio of application frequency in a short-term window to the average application frequency in a long-term window is calculated, or the proportion of applications during sensitive periods in the total number of applications is calculated. These calculation results can intuitively reflect abnormal characteristics such as sudden increases, concentrations, and expansions in application behavior. These features collectively constitute the derived features used to characterize abnormal application behavior.

[0053] Step 1017: Perform phased feature filtering on the candidate feature set composed of the basic behavioral features and the derived features to obtain the core feature vector, which serves as the credit application behavioral feature.

[0054] In this embodiment, the candidate feature set is the complete set of all initial features that could potentially be used for early warning, composed of basic behavioral features and derived features. Phased feature selection is a process of eliminating invalid, redundant, or noisy features from the candidate feature set step-by-step and hierarchically using various methods. The core feature vector is the subset of features retained after selection that contributes the most to risk early warning and has the best stability; it is the final input data used for model inference and rule matching. Credit application behavioral features are the comprehensive feature set ultimately used to describe the behavioral risk of the target object during the fundraising stage.

[0055] All basic behavioral features and derived features obtained in steps 1015 and 1016 are merged to form a high-dimensional candidate feature set. Since this set contains many features that are ineffective or redundant for early warning, a phased feature screening process is performed. Ineffective features with zero or extremely low variance are removed. Next, the correlation between features is calculated, and highly correlated redundant features are removed. Regularized linear models and tree models are used to evaluate the contribution of each feature to risk warning, and the features with the highest contribution are retained. Finally, a core feature vector with moderate dimensionality, rich information, and stability is obtained; this vector represents the credit application behavior features required in this step.

[0056] This application embodiment constructs a processing flow that can efficiently and stably extract pre-risk signals from credit application behavior by receiving new credit application events, obtaining and cleaning the original credit application records of the target object, extracting basic behavioral features and generating derived features, and performing phased screening of candidate features to obtain core feature vectors. This provides high-quality, high-discrimination, and low-redundancy input data for subsequent machine learning models and rule engines, thereby supporting the realization of early and accurate anti-fraud risk warnings.

[0057] Optionally, step 1016 includes: Step 10161: Based on the number of applications within the first short time window and the number of applications within the first long time window, calculate the growth rate of the number of applications within the first short time window relative to the average number of applications within the first long time window, and obtain the short-term application surge coefficient, wherein the duration of the first short time window is shorter than the duration of the first long time window.

[0058] In this embodiment, the first short time window is a short time interval used to analyze short-term behavioral changes of the target object; the first long time window is a long time interval used to analyze the long-term behavioral baseline of the target object; the short-term application surge coefficient is a numerical indicator used to quantify the degree of increase in the number of credit applications of the target object in the short term compared with its long-term average level.

[0059] Obtain the total number of credit applications from the target individual within the first shortest time window and the total number of credit applications within the first longest time window. Calculate the average number of applications within the first longest time window by dividing the total number of applications within that time window by the number of days or units of time. Compare the number of applications within the first shortest time window with the average number of applications within the first longest time window, and calculate the increase in the former relative to the latter, thus obtaining the short-term application surge coefficient. The higher this coefficient, the more significant the surge in the target individual's recent application behavior compared to their historical norm.

[0060] Step 10162: Based on the number of application platforms in the first short time window and the number of application platforms in the first long time window, calculate the expansion degree of the number of application platforms in the first short time window relative to the number of application platforms in the first long time window, and obtain the short-term platform expansion coefficient.

[0061] In this embodiment, the first short time window is a short time interval used to analyze short-term behavioral changes of the target object; the first long time window is a long time interval used to analyze the long-term behavioral baseline of the target object; the number of application platforms refers to the total number of different credit platforms involved in the credit application initiated by the target object within the specified time window; the short-term platform expansion coefficient is a numerical indicator used to quantify the degree of expansion of the number of platforms involved in the target object's application behavior in the short term compared to its long-term base.

[0062] The study counts the number of different lending platforms involved in applications submitted by the target individual within the first short-term window, and the number of different lending platforms involved in applications submitted within the first long-term window. The degree of expansion of the number of platforms applied to within the first short-term window relative to the number applied to within the first long-term window is calculated; that is, the short-term platform expansion coefficient is obtained by comparing the ratio or difference between the two quantities. A larger coefficient indicates that the target individual is attempting to obtain funds from more new, previously unused lending platforms in the short term, demonstrating a significant change in their behavioral patterns.

[0063] Step 10163: Based on the number of applications during the sensitive period within the first short time window and the total number of applications within the first short time window, calculate the proportion of the number of applications during the sensitive period in the total number of applications to obtain the concentration of behavior during the sensitive period.

[0064] In this embodiment, the first short time window is a short time interval used to analyze short-term behavioral changes of the target object; the sensitive period is a predefined specific time period within a day, such as late night or early morning, which is generally considered to be associated with abnormal behavior; the number of applications during the sensitive period refers to the total number of credit applications initiated by the target object within the first short time window and belonging to the sensitive period; the total number of applications refers to the total number of credit applications initiated by the target object within the first short time window; the concentration of behavior during the sensitive period is a numerical indicator used to characterize the degree to which the target object's application behavior during the sensitive period is concentrated in its total application behavior.

[0065] From all credit application records of the target individual within the first short time window, applications that occurred during sensitive periods are filtered out, and their total number is counted. Simultaneously, the total number of all applications submitted by the target individual within the first short time window is also counted. The number of applications submitted during sensitive periods is divided by the total number of applications to calculate the concentration of behavior during sensitive periods. A higher concentration indicates that the target individual's credit application behavior is more concentrated during abnormal activity periods, which is a typical abnormal behavior pattern.

[0066] Step 10164: Based on the total number of applications within the first short time window and the total number of application platforms within the first short time window, calculate the degree of repetition of the total number of applications relative to the total number of application platforms to obtain the platform repetition intensity.

[0067] In this embodiment, the first short time window is a short time interval used to analyze short-term behavioral changes of the target object; the total number of applications refers to the total number of credit applications initiated by the target object within the first short time window; the total number of application platforms refers to the total number of different credit platforms involved in the applications initiated by the target object within the first short time window; the intensity of repeated applications on platforms is a numerical indicator used to quantify whether the target object's application behavior is concentrated on a few platforms and repeatedly carried out within a specific time window.

[0068] Obtain the total number of applications and the total number of platforms applied to by the target individual within the first shortest time window. Calculate the degree of repetition between the total number of applications and the total number of platforms to determine the intensity of platform-based application repetition. For example, the higher the average value obtained by dividing the total number of applications by the total number of platforms, the more times the target individual applies on average on each platform. This indicates a high degree of platform concentration and repetition in their application behavior, which may reflect a desperate need for funds leading to repeated attempts on the same platform.

[0069] Step 10165: Based on the number of applications for high-interest-rate platforms within the first short time window and the total number of applications within the first short time window, calculate the proportion of applications for high-interest-rate platforms in the total number of applications to obtain the proportion of high-risk platform applications.

[0070] In this embodiment, the first short time window is a short time interval used to analyze short-term behavioral changes of the target object; the high-interest platform is a predefined type of credit platform that typically has higher loan interest rates; the number of high-interest platform applications refers to the total number of credit applications initiated by the target object to the high-interest platform within the first short time window; the total number of applications refers to the total number of credit applications initiated by the target object within the first short time window; the proportion of high-risk platform applications is a numerical indicator used to quantify the proportion of the target object's applications to high-risk platforms in its total application behavior.

[0071] From all credit application records of the target individual within the first short time window, identify and count the number of applications submitted to high-interest platforms. Simultaneously, calculate the total number of applications submitted by the target individual within the first short time window. Divide the number of high-interest platform applications by the total number of applications to calculate the percentage of applications submitted to high-risk platforms. A higher percentage indicates that the target individual is increasingly inclined to choose higher-risk, higher-cost credit channels during the fundraising process, which is typically a behavioral characteristic of those whose normal credit channels are blocked or who are in a state of extreme anxiety.

[0072] Step 10166: Based on the application approval rate within the first long-term window and the application approval rate within the first short-term window, calculate the difference between the application approval rate within the first long-term window and the application approval rate within the first short-term window to obtain the long-term and short-term approval rate difference.

[0073] In this embodiment, the first long time window is a relatively long time interval used to analyze the long-term behavioral baseline of the target object; the first short time window is a relatively short time interval used to analyze the short-term behavioral changes of the target object; the application approval rate refers to the proportion of the number of times the target object's credit application is approved by the platform within a specified time window to the total number of applications; the difference between the long and short time approval rates is a numerical indicator used to quantify the magnitude of change between the target object's recent application approval rate and its historical application approval rate.

[0074] Calculate the application approval rate for the target applicant within the first long-term window and the first short-term window. Calculate the difference between the application approval rates within the first long-term and first short-term windows to obtain the long-term / short-term approval rate difference. For example, you can subtract the short-term approval rate from the long-term approval rate. If this difference is positive and large, it indicates that the target applicant's recent application approval rate is significantly lower than their historical average. This may reflect a deterioration in their creditworthiness or excessively frequent application activity leading to rejections, representing another aspect of abnormal fundraising behavior.

[0075] This application embodiment comprehensively and accurately depicts the abnormal behavioral trajectory of victims during the fundraising stage by quantitatively comparing and extracting features of the target object's credit application behavior in short and long time windows from multiple dimensions, providing a core discrimination basis with foresight and stability for subsequent risk warning models.

[0076] Optionally, step 1017 includes: Step 10171: Calculate the variance of each feature in the candidate feature set, and remove features whose variance is less than a preset variance threshold to obtain the first screening feature set.

[0077] In this embodiment, the candidate feature set is an initial set of features formed during the feature engineering stage by traversing and combining basic behavioral features and derived features for subsequent screening. The preset variance threshold is a preset numerical standard used to determine whether the numerical fluctuation of the features is low enough, thereby filtering out features with insufficient information.

[0078] A candidate feature set is obtained, containing all high-dimensional features generated through automatic cross-combination. To remove invalid features with minimal numerical variation that contribute almost nothing to risk differentiation, the variance of each feature in the set is calculated, i.e., the dispersion of the feature value across all samples. The variance of each feature is compared with a preset variance threshold, and features with variances less than the threshold are directly discarded because these features hardly change across samples and cannot provide effective discriminative information. After this step, a first filtered feature set consisting of the remaining features is output.

[0079] Step 10172: Calculate the correlation coefficient between any two features in the first screening feature set, and retain the feature with stronger univariate predictive ability among the two features with a correlation coefficient greater than a preset correlation coefficient threshold to obtain the second screening feature set.

[0080] In this embodiment, the first set of selected features is a subset of features whose variance is greater than or equal to a preset variance threshold. The correlation coefficient is a statistical indicator used to measure the degree of linear correlation between two features, with a value between -1 and 1. The preset correlation coefficient threshold is a preset numerical standard used to determine whether a high correlation exists between two features. Univariate predictive ability assesses the ability of a single feature to independently predict risk outcomes, typically measured by calculating a statistic between the feature and the target variable, such as information value or chi-square statistic.

[0081] After obtaining the first set of selected features, to eliminate high redundancy among features and reduce model complexity and overfitting risk, the correlation coefficient between any two features in this set is calculated. When the absolute value of the correlation coefficient between two features is found to be greater than a preset correlation coefficient threshold, it is determined that these two features are strongly correlated. In this case, both features are not retained simultaneously; instead, their individual univariate predictive abilities are further evaluated, and only the feature with the stronger predictive ability is retained. In this way, redundant features can be effectively removed, resulting in a second set of selected features with lower correlation among features.

[0082] Step 10173: Input the second set of selected features into a linear model with regularization constraints to evaluate the feature contribution, and retain features whose feature contribution is greater than the first preset contribution threshold to obtain the third set of selected features.

[0083] In this embodiment, the second set of selected features is a subset of features retained after relevance screening. A linear model with regularization constraints is a machine learning model, such as Lasso regression or Ridge regression. It automatically selects features or prevents overfitting by adding a regularization term to the objective function during model training to penalize feature coefficients. Feature contribution is a quantified value in a linear model that assesses the importance of each feature to the final prediction result based on the absolute value of the feature coefficients learned by the model. The first preset contribution threshold is a preset numerical standard used to determine whether the feature contribution is high enough to select features that significantly contribute to the model.

[0084] The second set of selected features is input into a linear model with regularization constraints. During training, the model automatically calculates the coefficients for each feature, and the absolute value of the coefficient represents the feature's contribution. The regularization constraint encourages the model to compress the coefficients of unimportant features to near zero. The contribution of each feature is then compared to a preset first contribution threshold, and only features with contributions greater than this threshold are retained, as these features are considered to have relatively high value for risk prediction. This step outputs a third set of selected features chosen by the linear model.

[0085] Step 10174: Input the third set of selected features into the tree model to evaluate the feature splitting gain, and retain the features whose feature splitting gain is greater than the second preset contribution threshold to obtain the core feature vector.

[0086] In this embodiment, the third set of selected features is a subset of features retained after being filtered by the linear model contribution. A tree model is a machine learning algorithm based on decision trees, such as random forests or gradient boosting trees. It learns the non-linear relationship between features and the target by constructing multiple decision trees. Feature split gain is an indicator used when constructing a tree model to measure the improvement in information purity that a feature brings when splitting at a decision tree node; a larger gain indicates that the feature is more important for distinguishing sample categories. The second preset contribution threshold is another preset numerical standard used to determine whether the split gain of a feature in the tree model is high enough to select the final core features.

[0087] To overcome the limitation of linear models failing to capture nonlinear relationships, a third set of selected features is input into a tree model for further evaluation. During training, the tree model calculates the average information gain (i.e., feature split gain) of each feature used as a splitting node in the decision tree construction. This gain value reflects the importance of the feature from a nonlinear perspective. The split gain of each feature is then compared to a preset second contribution threshold, and only features with split gains greater than this threshold are retained. Finally, the feature set retained after these four multi-level selection steps is determined as the core feature vector.

[0088] This application embodiment constructs a multi-level feature optimization mechanism, from low variance filtering, correlation redundancy removal, linear model contribution evaluation to nonlinear gain verification of tree models, to efficiently screen out a subset of core features that have both strong discriminative power and stability from automatically generated high-dimensional candidate features. This effectively reduces model complexity, overfitting risk, and sensitivity to noise features, providing a high-quality feature foundation for subsequent model training and rule matching.

[0089] Optionally, the anti-fraud risk warning model is trained through the following steps: Step 201: Obtain a historical labeled sample set. The historical labeled sample set contains the historical credit application behavior characteristics of multiple historical target objects and their corresponding historical risk labels. The historical risk labels are used to indicate whether the historical target object belongs to the fraud sample.

[0090] In this embodiment of the application, the historical labeled sample set is a data set containing the historical credit application behavior characteristics of multiple historical target objects and the corresponding historical risk labels; the historical target object is a user who has made credit application behavior in the past; the historical credit application behavior characteristics are quantitative indicators describing the past credit application behavior of the historical target object; the historical risk label is a mark used to indicate whether the historical target object belongs to the fraud sample.

[0091] A historical labeled sample set is obtained, which forms the basis for subsequent model training. Credit application records of multiple historical target objects within a specified time range are extracted from the credit business database, and historical credit application behavior characteristics, such as application frequency and number of platforms, are calculated based on these records. Simultaneously, a corresponding historical risk label is associated with each historical target object. This label is a binary marker; for example, 1 indicates that the object is a victim of fraud, and 0 indicates that it is not a victim. This label indicates whether the object was ultimately identified as a fraud victim in historical events. This sample set provides the basis for the machine learning model to learn the correlation between credit application behavior and fraud risk.

[0092] Step 202: Divide the historical labeled sample set into a training set, a validation set, and a test set according to time sequence.

[0093] In this embodiment, the training set is a subset of data used to train the gradient boosting tree model; the validation set is a subset of data used to evaluate model performance and adjust hyperparameters during training; and the test set is a subset of data used to evaluate the final generalization ability of the model after training is completed.

[0094] The historical labeled sample set obtained in step 201 is strictly divided according to chronological order to avoid future information leakage during model training. Samples from the earliest time period are assigned to the training set for iterative model learning; samples from intermediate time periods are assigned to the validation set to monitor model performance during training, prevent overfitting, and adjust model parameters; samples from the most recent time period are assigned to the test set to evaluate the model's performance on unknown data after training. This division method simulates the model's prediction scenarios when facing future data in real-world applications, ensuring the reliability of the evaluation results.

[0095] Step 203: Input the historical credit application behavior features in the training set into the gradient boosting tree model for iterative training to obtain the initial predicted risk score corresponding to the historical target object.

[0096] In this embodiment of the application, the gradient boosting tree model is a machine learning model based on ensemble learning, which improves prediction accuracy by iteratively constructing multiple decision trees and combining their prediction results; the initial prediction risk score is a numerical assessment given by the gradient boosting tree model in the current iteration of the probability that the historical target object belongs to the deceitful sample.

[0097] The historical credit application behavior features from the segmented training set are used as input and fed into a gradient boosting tree model for iterative training. In each iteration, the model generates a new decision tree whose goal is to fit the residuals of all tree predictions from the previous iteration. Features corresponding to all historical target objects in the training set are input into the model. After multiple iterations, the model outputs an initial predicted risk score for each historical target object. This score is a value between 0 and 1; a higher value indicates a higher risk that the model judges the object to be a fraudulent sample. This score is a direct result of the model's fitting of the training data.

[0098] Step 204: During the iterative training of the gradient boosting tree model, a monotonically non-decreasing constraint is applied to the preset directional features in the historical credit application behavior features. The preset directional features include the short-term application surge coefficient and the proportion of applications to high-risk platforms. The monotonically non-decreasing constraint is used to restrict the coefficients of the preset directional features from being updated in the negative direction during training.

[0099] In this embodiment, the preset directional feature is a core feature with a clear risk direction in business, such as the short-term application surge coefficient and the proportion of applications from high-risk platforms; the short-term application surge coefficient is used to characterize the growth rate of the number of applications within a short time window relative to the average number of applications within a long time window; the proportion of applications from high-risk platforms is used to characterize the proportion of applications from high-interest-rate platforms in the total number of applications; the monotonically non-decreasing constraint is a mathematical constraint applied during model training to restrict the coefficients of the preset directional feature from being updated in the negative direction during training.

[0100] During the iterative training of the gradient boosting tree model, a monotonically non-decreasing constraint is applied to the preset directional features. Specifically, two features are identified from historical credit application behavior characteristics: the short-term application surge coefficient and the proportion of applications to high-risk platforms. Based on business experience, the higher the values ​​of these two features, the more abnormal the user behavior, and the higher the risk of being scammed. Therefore, a constraint is added during model training to ensure that the relationship between these two features learned by the model and the predicted risk score is monotonically non-decreasing; that is, as the feature values ​​increase, the risk score output by the model cannot decrease. This constraint prevents the model from learning a negative relationship that contradicts business common sense when there is insufficient sample coverage or abnormal noise, thereby improving the model's stability and interpretability.

[0101] Step 205: By limiting the maximum tree depth, number of leaf nodes, minimum number of leaf samples, feature sampling ratio, sample sampling ratio, regularization term coefficient, and learning rate of the gradient boosting tree model, the model complexity of the gradient boosting tree model is constrained, resulting in a constrained gradient boosting tree model.

[0102] In the embodiments of this application, model complexity is an indicator that measures the balance between model fitting ability and generalization ability. Excessive complexity can easily lead to overfitting; constraints are operations that reduce the complexity of the model by limiting specific parameters.

[0103] By restricting several key hyperparameters of the gradient boosting tree model, the model complexity is constrained to prevent overlearning of noise and anomalous patterns in the training data. Specific parameters include: maximum tree depth to prevent the tree from growing too deep and learning local noise; number of leaf nodes to limit the total number of branches; minimum leaf sample size to avoid unstable splits triggered by a single extreme anomalous sample; feature sampling ratio and sample sampling ratio to introduce randomness through random sampling, reducing the impact of local noise on the tree structure; and regularization coefficient and learning rate to enhance the model's robustness by penalizing large weights and slowing down the learning speed. Through these constraints, a more concise and better generalization-capable gradient boosting tree model is obtained.

[0104] Step 206: Output the predicted risk score corresponding to the historical target object according to the constrained gradient boosting tree model.

[0105] In this embodiment of the application, the predicted risk score is the final numerical assessment given by the constrained gradient boosting tree model of the probability that the historical target object belongs to the defrauded sample.

[0106] The constrained gradient boosting tree model is used to predict historical target objects in the training set. The historical credit application behavior features of each historical target object are input into the model, which performs forward propagation calculations and outputs a corresponding predicted risk score. This score represents the model's final judgment on the risk level of the current sample after imposing monotonicity and complexity constraints; it reflects the model's comprehensive assessment of sample risk under the dual constraints of business priors and generalization ability.

[0107] Step 207: Calculate the focus loss value based on the predicted risk score and the historical risk label. The focus loss value is used to dynamically attenuate the contribution of easily classified samples to the overall loss.

[0108] In the embodiments of this application, the focus loss value is a loss function specifically designed to handle class imbalance problems. It focuses the model training on high-risk and difficult-to-classify samples by dynamically attenuating the contribution of easily classified samples to the overall loss.

[0109] The focus loss value is calculated based on the predicted risk score and historical risk label. In anti-fraud scenarios, the number of defrauded samples is far less than the number of non-defrauded samples, representing a typical class imbalance problem. The focus loss function introduces a modulation factor that reduces the loss contribution of easily classified samples with high model prediction confidence, while maintaining the loss contribution of difficult-to-classify samples with low model prediction confidence. This allows for greater focus on a smaller number of important high-risk and boundary samples during backpropagation parameter updates, thereby enhancing the model's sensitivity to positive samples.

[0110] Step 208: Jointly evaluate the recall, precision, and F1 score of the initial machine learning model on the validation set. When the recall, precision, and F1 score no longer improve within a preset number of consecutive rounds, stop training and save the model parameters with the best validation performance to obtain the trained anti-fraud risk warning model.

[0111] In this embodiment, recall is a measure of the proportion of samples correctly identified by the model among all real positive samples; precision is a measure of the proportion of samples predicted as positive by the model that are actually positive samples; the F1 score is the harmonic mean of recall and precision, used to comprehensively evaluate model performance; the model parameters with optimal validation performance are the model parameters that achieve the best combination of evaluation metrics on the validation set.

[0112] The model's recall, precision, and F1 score are jointly evaluated on the validation set, and this evaluation is used as the basis for stopping training and saving the model. During training, after each iteration, the current model is applied to the defined validation set, and its recall, precision, and F1 score are calculated. These metrics are monitored, and if none of these three metrics improve within a preset number of iterations, the model is considered to have converged, and continued training may lead to overfitting. At this point, an early stopping mechanism is triggered, training is terminated, and the model parameters from the iteration with the best validation performance are saved, resulting in the trained anti-fraud risk warning model. This avoids the model overfitting to random noise in the training data and ensures the model's stability and generalization ability on unknown data.

[0113] This application embodiment obtains historical samples and divides them into training, validation, and test sets. In the gradient boosting tree model training, it applies monotonically non-decreasing constraints to incorporate business priors, limits model complexity to prevent overfitting, uses a focus loss function to handle class imbalance, and implements an early stopping mechanism based on multi-indicator joint evaluation on the validation set, thereby constructing a stable, accurate, and highly generalizable anti-fraud risk early warning model.

[0114] Optionally, step 103 includes: Step 1031: When the rule triggering identifier indicates that the target object has not triggered any of the risk rules in the preset rule base, the baseline risk score is determined as the final risk score.

[0115] In this embodiment, the rule trigger identifier is a marker indicating whether the target object meets any risk rule condition in the preset rule base. The preset rule base is a pre-stored collection of condition combinations, threshold relationships, and logical judgment rules derived from historical cases and expert experience. The target object is the current credit applicant subject undergoing risk warning assessment, such as a specific user. The baseline risk score is a numerical value representing the basic risk level of the target object, output by a pre-trained machine learning model after inference operations on the feature vector of the target object. The final risk score is a numerical value representing the comprehensive risk level of the target object, determined by fusing the baseline risk score and the rule risk score.

[0116] The system receives a rule trigger identifier, generated by the rule engine module. It then determines the specific content of this identifier. If the identifier indicates that the target object has not triggered any risk rule in the preset rule base, the rule engine's calculation result will not be used. In this case, the baseline risk score output by the model inference module is directly determined as the final risk score. This final risk score will be used for subsequent risk grading and early warning result output.

[0117] Step 1032: When the rule triggering identifier indicates that the target object triggers at least one of the risk rules in the preset rule base, obtain the rule risk score corresponding to the triggered risk rule.

[0118] In this embodiment, the rule trigger identifier is a marker indicating whether the target object meets any risk rule condition in the preset rule base. The target object is the current credit applicant subject undergoing risk warning assessment, such as a specific user. The preset rule base is a pre-stored collection of condition combinations, threshold relationships, and logical judgment rules derived from historical cases and expert experience. A risk rule is a specific judgment condition in the preset rule base, such as the rule "short-term application surge coefficient greater than 10". The rule risk score is a numerical value generated by the rule engine module based on the pre-set score or calculation logic of the rule when the target object triggers a specific risk rule, used to characterize the degree of risk identified by the rule.

[0119] The system receives a rule trigger identifier, generated by the rule engine module. It then determines the specific content of the identifier. If the identifier indicates that the target object has triggered at least one risk rule from the preset rule base, the rule score acquisition process is initiated. Further, the specific triggered risk rule is obtained, and the corresponding rule risk score is read from the rule engine module.

[0120] Step 1033: Compare the baseline risk score and the rule risk score, and take the larger value of the baseline risk score and the rule risk score as the final risk score.

[0121] In this embodiment, the baseline risk score is a numerical value representing the basic risk level of the target object, output by a pre-trained machine learning model after inference calculations on the feature vector of the target object. The rule risk score is a numerical value representing the risk level identified by the rule, generated by the rule engine module according to the pre-set score or calculation logic of the rule when the target object triggers a specific risk rule. The final risk score is a numerical value representing the overall risk level of the target object, determined by fusing the baseline risk score and the rule risk score.

[0122] After obtaining the baseline risk score and the rule-based risk score, the fusion decision logic is executed. Internally, the baseline risk score and the rule-based risk score are compared. The larger value is selected as the final risk score. By taking the larger value, it ensures that any high-risk signal identified by the model and rules is reflected in the final warning result, thereby improving the comprehensiveness and sensitivity of the warning.

[0123] This application embodiment determines whether to use rule scores by judging rule triggering flags, and compares model scores and rule scores when rules are triggered and takes the larger value as the final score fusion method. When the model and rules issue warnings in parallel, the advantages of both are fully utilized to avoid the single model from missing reports in new risk scenarios, while retaining the model's ability to learn complex nonlinear patterns.

[0124] Optionally, step 105 includes: Step 1051: Determine the score range of the final risk score based on the preset high-risk warning threshold, medium-risk warning threshold, and low-risk warning threshold.

[0125] In this embodiment, the high-risk warning threshold is a preset score limit used to define the sample with the highest risk level; the medium-risk warning threshold is another preset score limit used to define the sample with a medium risk level; the low-risk warning threshold is a third preset score limit used to define the sample with the lowest risk level; the final risk score is a comprehensive risk value calculated for each target object after model inference and rule fusion; the score interval refers to a specific range on the numerical axis where the final risk score falls.

[0126] Three pre-defined warning thresholds are obtained: a high-risk warning threshold, a medium-risk warning threshold, and a low-risk warning threshold. The calculated final risk score is compared with these three thresholds to determine which specific score interval the score falls within. This score interval is the direct basis for subsequent determination of the warning level.

[0127] Step 1052: When the final risk score is greater than or equal to the high-risk warning threshold, the warning level is determined to be a high-risk warning level.

[0128] In this embodiment of the application, the high-risk warning level is the highest level of risk warning status defined, used to identify target objects with extremely high risks.

[0129] After determining the score range of the final risk score, a logical judgment is made. If the final risk score is determined to be greater than or equal to the high-risk warning threshold, the warning level for the target object is set to high-risk. This indicates that the target object's behavioral pattern is considered to be highly consistent with high-risk characteristics, requiring immediate intervention at the highest level.

[0130] Step 1053: When the final risk score is less than the high-risk warning threshold and greater than or equal to the medium-risk warning threshold, the warning level is determined to be a medium-risk warning level.

[0131] In this embodiment of the application, the medium-risk warning level is a defined intermediate level of risk warning status, used to identify target objects with a moderate degree of risk that require attention.

[0132] If the final risk score does not meet the criteria for high risk (i.e., it is less than the high-risk warning threshold), logical judgment will continue. If the final risk score is greater than or equal to the medium-risk warning threshold, the warning level for the target object will be determined as medium-risk. This indicates that the target object is considered to have some risk, but the degree is lower than high risk, and corresponding monitoring or intervention measures are required.

[0133] Step 1054: When the final risk score is less than the medium-risk warning threshold and greater than or equal to the low-risk warning threshold, the warning level is determined to be a low-risk warning level.

[0134] In this embodiment of the application, the low-risk warning level is the lowest level of risk warning status defined, used to identify target objects that have slight abnormal trends but low risk.

[0135] If the final risk score does not meet the criteria for either high or medium risk (i.e., it is below the medium-risk warning threshold), a final logical judgment will be made. If the final risk score is greater than or equal to the low-risk warning threshold, the warning level for the target object will be set to low-risk. This indicates that the target object's behavior shows some abnormal signs, but the risk level is low, and it can be managed or recorded in a tiered manner without immediate intervention.

[0136] Step 1055: Combine the unique identifier of the target object, the final risk score, the warning level, and the rule triggering information into a structured warning result, and output the structured warning result to downstream business through the data interface.

[0137] In this embodiment, the unique identifier is a unique code assigned to each target object to uniquely identify the object; the rule trigger information is the relevant identifier or result generated after the rule engine determines whether the target object has hit a preset rule; the structured warning result refers to a complete and standardized data packet formed by combining multiple related warning information in a fixed format; the data interface is a standardized channel for exchanging data with other external businesses; and the downstream business refers to other businesses that receive the warning result and perform subsequent processing, such as manual review or risk disposal.

[0138] After determining the warning level, the final warning output is assembled. The unique identifier of the target object, the calculated final risk score, the determined warning level, and the rule triggering information output by the rule engine are combined to form a structured warning result data package. This structured warning result is then output to downstream business processes through a predefined data interface for subsequent operations such as manual verification, risk intervention, or case review.

[0139] This application embodiment compares the final risk score with preset multi-level thresholds to determine the corresponding warning level, and then combines these key information into a structured result and outputs it, thereby enabling refined hierarchical management and efficient transmission of risks.

[0140] Based on the foregoing embodiments, this application provides a device for obtaining user transaction risk. The device includes various units and modules included in each unit, which can be implemented by a processor in a computer device; of course, it can also be implemented by specific logic circuits. In the implementation process, the processor can be a central processing unit (CPU), a microprocessor unit (MPU), a digital signal processor (DSP), or a field programmable gate array (FPGA), etc.

[0141] Figure 2 This is a schematic diagram of the composition structure of a user transaction risk acquisition device provided in an embodiment of this application, as shown below. Figure 2 As shown, the user transaction risk acquisition device 30 includes: Processing module 301 is used to obtain the credit application records of the target object and extract the credit application behavior characteristics of the target object in the fundraising stage based on the credit application records; The credit application behavior characteristics are input into a pre-trained anti-fraud risk early warning model to obtain the benchmark risk score corresponding to the target object; The credit application behavior characteristics are matched with risk rules in a preset rule base to obtain the rule triggering identifier and rule risk score corresponding to the target object; Based on the baseline risk score, the rule trigger identifier, and the rule risk score, the final risk score corresponding to the target object is generated according to a preset fusion strategy. Output module 302 is used to determine the warning level corresponding to the target object based on the final risk score, and output the warning level.

[0142] Optionally, the processing module 301 is further configured to: Receive new credit application events and determine the identity information of the target object based on the new credit application events; Based on the identity information, the original credit application records of the target object within a preset historical time range are obtained from the credit business data source. The original credit application records include at least the application time, application platform, application result, and platform type. The identity information in the original credit application record is anonymized to generate a unique identifier corresponding to the target object; The original credit application records after anonymization are subjected to format validation, invalid record filtering, duplicate record removal and standardization to obtain standardized credit application records. Based on the standardized credit application records, the application frequency, number of application platforms, number of applications during sensitive periods, number of applications on non-bank platforms, number of applications on high-interest platforms, and application approval rate of the target object are statistically analyzed in multiple preset time windows to obtain basic behavioral characteristics. Based on the basic behavioral characteristics, the multiple preset time windows are subjected to temporal cross-combination and arithmetic logic operations to obtain derived characteristics used to characterize abnormal application behavior; A phased feature filtering process is performed on the candidate feature set consisting of the basic behavioral features and the derived features to obtain a core feature vector, which serves as the credit application behavioral feature.

[0143] Optionally, the processing module 301 is further configured to: Based on the number of applications within the first short time window and the number of applications within the first long time window, the growth rate of the number of applications within the first short time window relative to the average number of applications within the first long time window is calculated to obtain the short-term application surge coefficient, wherein the duration of the first short time window is shorter than the duration of the first long time window. Based on the number of application platforms within the first short time window and the number of application platforms within the first long time window, the expansion degree of the number of application platforms within the first short time window relative to the number of application platforms within the first long time window is calculated to obtain the short-term platform expansion coefficient. Based on the number of applications during sensitive periods within the first short time window and the total number of applications within the first short time window, the proportion of the number of applications during sensitive periods in the total number of applications is calculated to obtain the concentration of behavior during sensitive periods; Based on the total number of applications within the first short time window and the total number of application platforms within the first short time window, the degree of repetition of the total number of applications relative to the total number of application platforms is calculated to obtain the intensity of platform repetition applications; Based on the number of applications for high-interest-rate platforms within the first short time window and the total number of applications within the first short time window, the proportion of applications for high-interest-rate platforms in the total number of applications is calculated to obtain the proportion of applications for high-risk platforms. Based on the application approval rate within the first long-term window and the application approval rate within the first short-term window, the difference between the application approval rate within the first long-term window and the application approval rate within the first short-term window is calculated to obtain the long-term and short-term approval rate difference.

[0144] Optionally, the processing module 301 is further configured to: Calculate the variance of each feature in the candidate feature set, and remove features whose variance is less than a preset variance threshold to obtain a first set of filtered features; Calculate the correlation coefficient between any two features in the first set of selected features, and retain the feature with stronger univariate predictive ability among the two features whose correlation coefficient is greater than a preset correlation coefficient threshold, to obtain the second set of selected features. The second set of selected features is input into a linear model with regularization constraints to evaluate the feature contribution, and features with a feature contribution greater than the first preset contribution threshold are retained to obtain the third set of selected features. The third set of selected features is input into the tree model for feature splitting gain evaluation, and features with splitting gain greater than the second preset contribution threshold are retained to obtain the core feature vector.

[0145] Optionally, the processing module 301 is further configured to: Obtain a historical labeled sample set, which contains the historical credit application behavior characteristics of multiple historical target objects and their corresponding historical risk labels. The historical risk labels are used to indicate whether the historical target object belongs to the fraud sample. The historical labeled sample set is divided into a training set, a validation set, and a test set according to chronological order; The historical credit application behavior features in the training set are input into the gradient boosting tree model for iterative training to obtain the initial predicted risk score corresponding to the historical target object; During the iterative training of the gradient boosting tree model, a monotonically non-decreasing constraint is applied to the preset directional features in the historical credit application behavior features. The preset directional features include the short-term application surge coefficient and the proportion of applications to high-risk platforms. The monotonically non-decreasing constraint is used to restrict the coefficients of the preset directional features from being updated in the negative direction during training. By limiting the maximum tree depth, number of leaf nodes, minimum leaf sample size, feature sampling ratio, sample sampling ratio, regularization coefficient, and learning rate of the gradient boosting tree model, the model complexity of the gradient boosting tree model is constrained, resulting in a constrained gradient boosting tree model. The predicted risk score corresponding to the historical target object is output based on the constrained gradient boosting tree model. The focus loss value is calculated based on the predicted risk score and the historical risk label. The focus loss value is used to dynamically attenuate the contribution of easily classified samples to the overall loss. The recall, precision, and F1 score of the initial machine learning model are jointly evaluated on the validation set. When the recall, precision, and F1 score no longer improve within a preset number of consecutive rounds, training is stopped and the model parameters with the best validation performance are saved to obtain the trained anti-fraud risk warning model.

[0146] Optionally, the processing module 301 is further configured to: When the rule triggering identifier indicates that the target object has not triggered any of the risk rules in the preset rule base, the benchmark risk score is determined as the final risk score; When the rule trigger identifier indicates that the target object triggers at least one of the risk rules in the preset rule base, the rule risk score corresponding to the triggered risk rule is obtained; The baseline risk score and the rule-based risk score are compared, and the larger of the baseline risk score and the rule-based risk score is taken as the final risk score.

[0147] Optionally, the output module 302 is further configured to: The score range of the final risk score is determined based on the preset high-risk warning threshold, medium-risk warning threshold, and low-risk warning threshold. When the final risk score is greater than or equal to the high-risk warning threshold, the warning level is determined to be a high-risk warning level; When the final risk score is less than the high-risk warning threshold and greater than or equal to the medium-risk warning threshold, the warning level is determined to be a medium-risk warning level. When the final risk score is less than the medium risk warning threshold and greater than or equal to the low risk warning threshold, the warning level is determined to be a low risk warning level. The unique identifier of the target object, the final risk score, the warning level, and the rule triggering information are combined into a structured warning result, and the structured warning result is output to the downstream business system through a data interface.

[0148] This application embodiment combines the generalization ability of machine learning models with the rapid reinforcement ability of business rules by acquiring credit application behavior characteristics during the fundraising stage and inputting them into the model and rule base for parallel processing, and then generating the final warning result according to the preset fusion strategy. This improves the timeliness, accuracy and stability of warnings in complex scenarios such as insufficient samples.

[0149] The descriptions of the apparatus embodiments above are similar to those of the method embodiments above, and have similar beneficial effects. In some embodiments, the functions or modules included in the apparatus provided in this application can be used to perform the methods described in the method embodiments above. For technical details not disclosed in the apparatus embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0150] It should be noted that, in the embodiments of this application, if the above-mentioned method for obtaining user transaction risks is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware, software, or firmware, or any combination of hardware, software, and firmware.

[0151] This application provides a computer device including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the program, it implements some or all of the steps in the above-described method.

[0152] This application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements some or all of the steps in the above-described method. The computer-readable storage medium can be transient or non-transient.

[0153] This application provides a computer program including computer-readable code, wherein when the computer-readable code is executed in a computer device, a processor in the computer device performs some or all of the steps in the above-described method.

[0154] This application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. When the computer program is read and executed by a computer, it implements some or all of the steps in the above-described method. This computer program product can be implemented specifically through hardware, software, or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium; in other embodiments, the computer program product is specifically embodied as a software product, such as a software development kit (SDK), etc.

[0155] It should be noted that the descriptions of the various embodiments above tend to emphasize the differences between them, while their similarities or commonalities can be referred to interchangeably. The descriptions of the above embodiments of the device, storage medium, computer program, and computer program product are similar to the descriptions of the above method embodiments and have similar beneficial effects. For technical details not disclosed in the embodiments of the device, storage medium, computer program, and computer program product of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0156] It should be noted that, Figure 3 This is a schematic diagram of a hardware entity of a computer device in an embodiment of this application, such as... Figure 3 As shown, the hardware entity of the computer device 700 includes: one or more processors 701, a communication interface 702, and a memory 703, wherein: Processor 701 typically controls the overall operation of computer device 700.

[0157] Communication interface 702 enables computer devices to communicate with other terminals or servers over a network.

[0158] The memory 703 is configured to store instructions and applications executable by the processor 701, and can also cache data to be processed or already processed (e.g., image data, audio data, voice communication data, and video communication data) in the processor 701 and various modules in the computer device 700. It can be implemented using flash memory or random access memory (RAM). Data transfer between the processor 701, the communication interface 702, and the memory 703 can be performed via bus 704. Only one processor is shown in the figure; each processor 701 includes one or more cores.

[0159] It should be noted that the computer device may include multiple processors 701, and each processor 701 can interact with each other through aggregated communication methods such as all-to-all, all-gather, or all-reduce. The processors 701 may be central processing units (CPUs), graphics processing units (GPUs), embedded neural network processing units (NPUs), tensor processing units (TPUs), data processing units (DPUs), accelerated processing units (APUs), floating-point processing units (FPUs), or application-specific integrated circuits (ASICs). The processors may also be single-core or multi-core processors. The processor may consist of a CPU and hardware chips. The hardware chips may be ASICs, PLDs, or combinations thereof. The PLDs may be complex programmable logic devices (CPLDs), FPGAs, generic array logic (GALs), or any combination thereof. The processor can also be implemented using logic devices with built-in processing logic, such as FPGAs or digital signal processors (DSPs).

[0160] The communication interface 702 can be a wired interface or a wireless interface, used to communicate with other modules or devices. The wired interface can be an Ethernet interface, a local interconnect network (LIN), etc., and the wireless interface can be a cellular network interface or a wireless LAN interface, etc.

[0161] Memory 703 can be non-volatile memory, such as read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Memory 703 can also be volatile memory, which can be random access memory (RAM) used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synclink dynamic random access memory (SLDRAM), and direct rambus RAM (DRRAM), direct rambus DRAM (DRDRAM), and rambus DRAM.

[0162] The 704 bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc.

[0163] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above steps / processes do not imply a sequential order of execution; the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above embodiments of this application are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0164] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0165] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0166] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0167] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0168] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0169] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, or the part that contributes to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, magnetic disks, or optical disks.

[0170] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A method for obtaining user transaction risk, characterized in that, The method includes: Obtain the credit application records of the target object, and extract the credit application behavior characteristics of the target object during the fundraising stage based on the credit application records; The credit application behavior characteristics are input into a pre-trained anti-fraud risk early warning model to obtain the benchmark risk score corresponding to the target object; The credit application behavior characteristics are matched with risk rules in a preset rule base to obtain the rule triggering identifier and rule risk score corresponding to the target object; Based on the baseline risk score, the rule trigger identifier, and the rule risk score, the final risk score corresponding to the target object is generated according to a preset fusion strategy. The warning level corresponding to the target object is determined based on the final risk score, and the warning level is output.

2. The method according to claim 1, characterized in that, The process of obtaining the target's credit application records and extracting the target's credit application behavior characteristics during the fundraising stage based on these records includes: Receive new credit application events and determine the identity information of the target object based on the new credit application events; Based on the identity information, the original credit application records of the target object within a preset historical time range are obtained from the credit business data source. The original credit application records include at least the application time, application platform, application result, and platform type. The identity information in the original credit application record is anonymized to generate a unique identifier corresponding to the target object; The original credit application records after anonymization are subjected to format validation, invalid record filtering, duplicate record removal and standardization to obtain standardized credit application records. Based on the standardized credit application records, the application frequency, number of application platforms, number of applications during sensitive periods, number of applications on non-bank platforms, number of applications on high-interest platforms, and application approval rate of the target object are statistically analyzed in multiple preset time windows to obtain basic behavioral characteristics. Based on the basic behavioral characteristics, the multiple preset time windows are subjected to temporal cross-combination and arithmetic logic operations to obtain derived characteristics used to characterize abnormal application behavior; A phased feature filtering process is performed on the candidate feature set consisting of the basic behavioral features and the derived features to obtain a core feature vector, which serves as the credit application behavioral feature.

3. The method according to claim 2, characterized in that, The step involves performing temporal cross-combination and arithmetic logic operations on the multiple preset time windows based on the basic behavioral characteristics to obtain derived characteristics used to characterize abnormal application behavior, including: Based on the number of applications within the first short time window and the number of applications within the first long time window, the growth rate of the number of applications within the first short time window relative to the average number of applications within the first long time window is calculated to obtain the short-term application surge coefficient, wherein the duration of the first short time window is shorter than the duration of the first long time window. Based on the number of application platforms within the first short time window and the number of application platforms within the first long time window, the expansion degree of the number of application platforms within the first short time window relative to the number of application platforms within the first long time window is calculated to obtain the short-term platform expansion coefficient. Based on the number of applications during sensitive periods within the first short time window and the total number of applications within the first short time window, the proportion of the number of applications during sensitive periods in the total number of applications is calculated to obtain the concentration of behavior during sensitive periods; Based on the total number of applications within the first short time window and the total number of application platforms within the first short time window, the degree of repetition of the total number of applications relative to the total number of application platforms is calculated to obtain the intensity of platform repetition applications; Based on the number of applications for high-interest-rate platforms within the first short time window and the total number of applications within the first short time window, the proportion of applications for high-interest-rate platforms in the total number of applications is calculated to obtain the proportion of applications for high-risk platforms. Based on the application approval rate within the first long-term window and the application approval rate within the first short-term window, the difference between the application approval rate within the first long-term window and the application approval rate within the first short-term window is calculated to obtain the long-term and short-term approval rate difference.

4. The method according to claim 2, characterized in that, The step of performing a phased feature filtering on the candidate feature set composed of the basic behavioral features and the derived features to obtain the core feature vector includes: Calculate the variance of each feature in the candidate feature set, and remove features whose variance is less than a preset variance threshold to obtain a first set of filtered features; Calculate the correlation coefficient between any two features in the first set of selected features, and retain the feature with stronger univariate predictive ability among the two features whose correlation coefficient is greater than a preset correlation coefficient threshold, to obtain the second set of selected features. The second set of selected features is input into a linear model with regularization constraints to evaluate the feature contribution, and features with a feature contribution greater than the first preset contribution threshold are retained to obtain the third set of selected features. The third set of selected features is input into the tree model for feature splitting gain evaluation, and features with splitting gain greater than the second preset contribution threshold are retained to obtain the core feature vector.

5. The method according to claim 1, characterized in that, The anti-fraud risk early warning model is trained through the following steps: Obtain a historical labeled sample set, which contains the historical credit application behavior characteristics of multiple historical target objects and their corresponding historical risk labels. The historical risk labels are used to indicate whether the historical target object belongs to the fraud sample. The historical labeled sample set is divided into a training set, a validation set, and a test set according to chronological order; The historical credit application behavior features in the training set are input into the gradient boosting tree model for iterative training to obtain the initial predicted risk score corresponding to the historical target object; During the iterative training of the gradient boosting tree model, a monotonically non-decreasing constraint is applied to the preset directional features in the historical credit application behavior features. The preset directional features include the short-term application surge coefficient and the proportion of applications to high-risk platforms. The monotonically non-decreasing constraint is used to restrict the coefficients of the preset directional features from being updated in the negative direction during training. By limiting the maximum tree depth, number of leaf nodes, minimum leaf sample size, feature sampling ratio, sample sampling ratio, regularization coefficient, and learning rate of the gradient boosting tree model, the model complexity of the gradient boosting tree model is constrained, resulting in a constrained gradient boosting tree model. The predicted risk score corresponding to the historical target object is output based on the constrained gradient boosting tree model. The focus loss value is calculated based on the predicted risk score and the historical risk label. The focus loss value is used to dynamically attenuate the contribution of easily classified samples to the overall loss. The recall, precision, and F1 score of the initial machine learning model are jointly evaluated on the validation set. When the recall, precision, and F1 score no longer improve within a preset number of consecutive rounds, training is stopped and the model parameters with the best validation performance are saved to obtain the trained anti-fraud risk warning model.

6. The method according to claim 1, characterized in that, The step of generating the final risk score corresponding to the target object according to the baseline risk score, the rule triggering identifier, and the rule risk score, and following a preset fusion strategy, includes: When the rule triggering identifier indicates that the target object has not triggered any of the risk rules in the preset rule base, the benchmark risk score is determined as the final risk score; When the rule trigger identifier indicates that the target object triggers at least one of the risk rules in the preset rule base, the rule risk score corresponding to the triggered risk rule is obtained; The baseline risk score and the rule-based risk score are compared, and the larger of the baseline risk score and the rule-based risk score is taken as the final risk score.

7. The method according to claim 1, characterized in that, The step of determining the warning level corresponding to the target object based on the final risk score and outputting the warning level includes: The score range of the final risk score is determined based on the preset high-risk warning threshold, medium-risk warning threshold, and low-risk warning threshold. When the final risk score is greater than or equal to the high-risk warning threshold, the warning level is determined to be a high-risk warning level; When the final risk score is less than the high-risk warning threshold and greater than or equal to the medium-risk warning threshold, the warning level is determined to be a medium-risk warning level. When the final risk score is less than the medium risk warning threshold and greater than or equal to the low risk warning threshold, the warning level is determined to be a low risk warning level. The unique identifier of the target object, the final risk score, the warning level, and the rule triggering information are combined into a structured warning result, and the structured warning result is output to the downstream business system through a data interface.

8. A device for acquiring user transaction risk, characterized in that, The device includes: The processing module is used to obtain the credit application records of the target object and extract the credit application behavior characteristics of the target object in the fundraising stage based on the credit application records; The credit application behavior characteristics are input into a pre-trained anti-fraud risk early warning model to obtain the benchmark risk score corresponding to the target object; The credit application behavior characteristics are matched with risk rules in a preset rule base to obtain the rule triggering identifier and rule risk score corresponding to the target object; Based on the baseline risk score, the rule trigger identifier, and the rule risk score, the final risk score corresponding to the target object is generated according to a preset fusion strategy. The output module is used to determine the warning level corresponding to the target object based on the final risk score, and output the warning level.

9. A computer device comprising a memory and a processor, the memory storing a computer program executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the method for obtaining user transaction risk according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method for obtaining user transaction risk as described in any one of claims 1 to 7.

Images