Cluster feature packet processing method, apparatus, and electronic device

Abstract

The application discloses a cluster feature message processing method and device and electronic equipment. The cluster includes a plurality of target objects. The method comprises the following steps: acquiring first data of a target object; acquiring a target data mode; acquiring a target parameter of the target object according to the first data; acquiring a first feature associated with the target data mode when the target parameter of the target object meets the target data mode; acquiring a cluster summary type matched with the cluster according to the first feature; and generating a summary message of the cluster according to a message template matched with the cluster summary type. In this way, the generation efficiency and accuracy of the cluster feature message can be improved.

Description

Technical Field

[0001] This application relates to the fields of Internet and machine learning technology, and more specifically, to a method, apparatus and electronic device for processing cluster feature messages. Background Technology

[0002] In order to cope with various risks in various financial and trading systems, it is necessary to extract various risk data from a large amount of data. However, the processing of such risk data generally still requires human intervention. Therefore, how to efficiently convert large amounts of raw data into brief information that can be quickly understood by humans has become a basic requirement of such information systems. Summary of the Invention

[0003] This application proposes a cluster feature message processing method, apparatus, and electronic device to improve the above-mentioned problems.

[0004] On the one hand, embodiments of this application provide a cluster feature message processing method, wherein the cluster may include multiple target objects, and the method includes:

[0005] Obtain the first data for each of the target objects;

[0006] Acquire at least one preset target data pattern, wherein the target data pattern includes descriptive information of at least one target parameter;

[0007] The target parameters of the target object are obtained based on the first data;

[0008] When the target parameters of the target object match the description information, the first feature associated with the target data pattern is obtained.

[0009] Obtain the cluster profile type matching the cluster based on the first feature of each target object; and

[0010] Generate a summary message for the cluster based on a message template that matches the cluster summary type.

[0011] On the other hand, embodiments of this application also provide a cluster feature message generation apparatus, which includes:

[0012] The first acquisition module is used to acquire first data for each of the target objects;

[0013] The second acquisition module is used to acquire at least one preset target data pattern, wherein the target data pattern includes descriptive information of at least one target parameter;

[0014] The parameter acquisition module is used to acquire the target parameters of the target object based on the first data;

[0015] The feature acquisition module is used to acquire a first feature associated with the target data pattern when the target parameters of the target object match the description information;

[0016] The summary type acquisition module is used to acquire a cluster summary type matching the cluster based on the first feature of each target object; and

[0017] The message generation module is used to generate a summary message for the cluster based on a message template that matches the cluster summary type.

[0018] On the other hand, embodiments of this application provide an electronic device, including: one or more processors; a memory; one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to perform the methods described above.

[0019] On the other hand, embodiments of this application provide a computer-readable storage medium having program code stored thereon, which can be called by a processor to execute the above-described method.

[0020] The solution provided in this application eliminates the need for manual risk classification and message filling, enabling automatic judgment of risk types in gang-related cases and automatic generation of cluster characteristic messages, effectively improving the efficiency and accuracy of cluster characteristic message generation.

[0021] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A schematic diagram of an application environment applicable to an embodiment of this application is shown.

[0024] Figure 2 A flowchart illustrating a cluster feature message processing method provided in an embodiment of this application is shown.

[0025] Figure 3 It shows Figure 2 A detailed flowchart of step S208 is shown.

[0026] Figure 4 It shows Figure 3A detailed flowchart of step S2082 is shown.

[0027] Figure 5 A partial flowchart of a cluster feature message processing method provided in another embodiment of this application is shown.

[0028] Figure 6 A partial flowchart of a cluster feature message processing method provided in another embodiment of this application is shown.

[0029] Figure 7 A partial flowchart of a cluster feature message processing method provided in another embodiment of this application is shown.

[0030] Figure 8 A partial flowchart of a cluster feature message processing method provided in another embodiment of this application is shown.

[0031] Figure 9 A block diagram of another cluster feature message generation apparatus provided in an embodiment of this application is shown.

[0032] Figure 10 A block diagram of another cluster feature message generation apparatus provided in an embodiment of this application is shown.

[0033] Figure 11 A block diagram of an electronic device for performing the cluster feature message processing method according to embodiments of this application is shown.

[0034] Figure 12 A storage unit is shown for storing or carrying program code that implements the cluster feature message processing method of the embodiments of this application. Detailed Implementation

[0035] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0036] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0037] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0038] Machine Learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instructional learning.

[0039] This application proposes a cluster feature message processing method, apparatus, and electronic device, involving artificial intelligence machine learning and other technologies. Based on raw data, it can output cluster feature messages, significantly improving the efficiency and quality of cluster review and reporting. Specific examples are provided below:

[0040] Please see Figure 1 , Figure 1 This is a schematic diagram of an application environment applicable to embodiments of this application. Embodiments of this application can be applied to application environments including, but not limited to, server 100 and terminal device 200.

[0041] The server 100 can communicate with the terminal device 200 via a network. The terminal device 200 has a client 210 installed and can log in to the server 100 through the client 210, thereby providing corresponding services to users, such as transaction services, in cooperation with the server 100.

[0042] The server 100 can be a standalone server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud computing, big data, and artificial intelligence platforms. The terminal device 200 can be, but is not limited to, smartphones, tablets, laptops, personal computers (PCs), smart TVs, portable wearable devices, etc., and can also be a bank deposit and withdrawal terminal. The client 210 can be any application with transaction functionality, such as a banking platform, trading platform, or payment platform. This embodiment can be applied to all transaction scenarios, and is particularly suitable for automatically generating risk messages for groups identified during transaction case review.

[0043] The cluster feature message processing method and apparatus provided in this application can be applied to electronic devices, where the electronic device can be... Figure 1 The server 100 or terminal device 200 are shown. The cluster feature message processing method can be executed in the server 100, in the terminal device 200, or through interaction between the server 100 and the terminal device 200. Preferably, the cluster feature message processing method is executed in the server 100.

[0044] Please see Figure 2 , Figure 2 This application provides a method for processing cluster feature messages. This method can be applied to electronic devices; in this embodiment, an electronic device is used. Figure 1 Taking server 100 as an example, the steps of this method are described. It should be understood that the flowchart in this embodiment is not intended to limit the order of execution steps. As needed, some steps in the flowchart can be added to or removed.

[0045] The aforementioned cluster refers to a collection of multiple target objects. These multiple target objects may have different meanings in different systems, but multiple target objects within the same cluster should be directly or indirectly related to each other.

[0046] For example, the cluster mentioned above could refer to a communication cluster of instant messaging software, and the target object could be the instant messaging account within that communication cluster.

[0047] For example, the cluster mentioned above is a collection of trading objects within a financial trading system. These trading objects may have direct or indirect transactions with each other. Here, the financial system could refer to a third-party payment system, a bank's transfer system, a securities trading system, and so on. Within a financial system, the direct trading object is the account; therefore, in this case, the target object mentioned above refers to the trading objects within these financial systems, i.e., the account. Of course, it's understandable that an account might be associated with an offline individual, company, or other institution.

[0048] The method includes:

[0049] S200, retrieve the first data for each target object.

[0050] The first data is the original data of the target object. In different systems, the original data can have different definitions.

[0051] For example, in a financial transaction system, raw data may include: attribute data (such as account type, account level, etc.) and transaction details (such as transaction time, transaction location, transaction type, transaction amount, etc.).

[0052] For example, in instant messaging systems, the raw data can be the text content within the chat.

[0053] It is understood that in the specific implementation of this application, data related to user information accounts, transaction details, etc. are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0054] Therefore, the first data mentioned in step S200 is data obtained with user authorization or directly authorized by laws and regulations.

[0055] S202, acquire at least one preset target data pattern, the target data pattern including description information of at least one target parameter.

[0056] A data pattern is used to determine whether the data of a target object conforms to a preset pattern. A data pattern includes descriptive information for at least one target parameter. This descriptive information can, for example, limit the range of the original data, such as limiting it to data within a specific time period. Furthermore, the descriptive parameter can define the range of a target parameter, which can be directly extracted from the original data or further calculated from it.

[0057] like Figure 3 The image shown is a schematic diagram of one example of the target data pattern. Figure 3The target parameters for various target data patterns are illustrated in the diagram.

[0058] In a specific example, the target data pattern mentioned above may include "late-night and early-morning transactions". Accordingly, the target parameters of this target data pattern include: the transaction time occurs between 10 p.m. and 6 a.m.; condition 1: the number of transactions in the interval / the total number of transactions >= 20%; condition 2: the number of transactions in the interval >= 10; condition 3: the total transaction amount in the interval >= 1000 yuan; and condition 4: the number of days that meet the above three conditions has three consecutive days or the sum of the number of days is greater than 5 in the past three months.

[0059] In a specific example, the target data pattern mentioned above may include "transaction pattern". Accordingly, in the first mode, the target parameters of this target data pattern include: hitting accounts within three months: total number of deposits / total number of withdrawals >= 2.5 or total number of depositors / total number of withdrawals >= 2.5 (months); in the second mode, the target parameters of this target data pattern include: hitting accounts within three months: total number of deposits / total number of withdrawals <= 0.3 or total number of depositors / total number of withdrawals <= 0.3 (months).

[0060] In a specific example, the target data pattern described above could include "quick in, quick out." Accordingly, the target parameters for this data pattern would include: Hitting accounts within three months: 0.8 <= withdrawal amount / deposit amount <= 1, and (average deposit time - average withdrawal time) < 30 minutes, and total number of transactions >= 5 (days).

[0061] In a specific example, the target data pattern mentioned above may include "sudden increase in transactions". Accordingly, the target parameters of this target data pattern include: Condition 1: The total amount or number of transactions for general tens, hundreds, and thousands of yuan received increases by more than 100% week-on-week within three months; Condition 2: Total amount received > 1000; Condition 3: Total number of transactions received > 10 (defined as general tens, hundreds, and thousands of yuan, within the range of tens, hundreds, and thousands of yuan plus or minus 1).

[0062] In a specific example, the target data pattern mentioned above may include "auspicious amount". Accordingly, the target parameters of this target data pattern include: the number of auspicious amount transactions of 6.66 / 16.88 / 66.66 / 88.88 / 168 / 168.88 / the ratio of auspicious amount transactions to total number of transactions exceeds the preset value of 0.5 in the example.

[0063] In a specific example, the target data pattern described above may include "transaction notes," and correspondingly, the target parameters for this target data pattern include: the transaction notes of the matched account matching the thesaurus.

[0064] S204, Obtain the target parameters of the target object based on the first data.

[0065] As described above, after obtaining the first data of the target object, the target parameters can be directly extracted from the first data according to the target parameters corresponding to different target data patterns, or obtained through other operations.

[0066] It is worth noting that the target parameters for different target objects are obtained separately during this process. In other words, the data for a specific target object must be filtered first, and then the target parameters are obtained based on the filtered data.

[0067] S206, when the target parameters of the target object match the description information, obtain the first feature associated with the target data pattern.

[0068] As shown in Table 1, each target data pattern has a corresponding first feature.

[0069] Table 1:

[0070]

[0071]

[0072]

[0073] For example, the first characteristic corresponding to the data pattern "trading late at night and early morning" is "frequent trading during sensitive periods late at night and early morning." The first characteristic corresponding to the data pattern "trading pattern" is "dispersed inflows, concentrated outflows," or "concentrated inflows, dispersed outflows." The first characteristic corresponding to the data pattern "rapid in and outflows" is "account trading characteristics show rapid in and outflows." The first characteristic corresponding to the data pattern "sudden increase in trading" is "account exhibits a sudden increase in trading." The first characteristic corresponding to the data pattern "auspicious amount" is "single transaction contains an auspicious amount." The first characteristic corresponding to the data pattern "trading remarks" is "account trading remarks are shown in the matching words."

[0074] When the target parameters of a target object completely match the description information of a target data pattern, the target object is considered to have the first feature that matches the target data pattern.

[0075] For example, if the data of a target object fully meets the following conditions: the transaction time is between 10 pm and 6 am, condition 1: the number of transactions in the interval / the total number of transactions >= 20%; condition 2: the number of transactions in the interval >= 10; condition 3: the total transaction amount in the interval >= 1000 yuan; and condition 4: the number of days that meet the above three conditions has been three consecutive days or the sum of the number of days is greater than 5 in the past three months, then the target object has the first characteristic of "frequent transactions during sensitive periods in the late night and early morning".

[0076] By performing the above process on all target objects, we can obtain Table 2:

[0077]

[0078]

[0079] In the table above, a cell value of 1 indicates that a target object possesses the first feature X. For example, target object 001 has first features 1 and first features 4. It can be understood that the number of first features is not limited and can be arbitrarily expanded according to the actual application scenario.

[0080] S208, obtain a cluster profile type that matches the cluster based on the first feature of each target object.

[0081] As described above, according to step S206, data on whether all target objects possess a certain first characteristic has been obtained, and based on this data, the cluster profile type that matches the cluster can be determined.

[0082] Further reading Figure 3 This is a detailed flowchart of step S208 above. Figure 4 In step S208, the steps include:

[0083] S2080, determine the probability that the target object belongs to a preset first summary type based on the first feature.

[0084] The first summary type mentioned above corresponds one-to-one with the risk type of the target object. However, risk types can have different definitions in different systems.

[0085] For example, in financial transfer systems, various risks accompany various transfer transactions, and the characteristics of transfer transactions may differ depending on the type of risk. These risk types could include, for example, gambling, pyramid schemes, and drug trafficking.

[0086] See Figure 4 In a specific example, step S2080 specifically includes:

[0087] S3000: Obtain pre-labeled historical data; for the association between the first feature and the first summary type of each object in the historical data, perform machine learning using a classification algorithm to obtain a classification model.

[0088] The pre-labeled historical data specifically refers to the data obtained in the table above regarding whether the target object possesses the first characteristic. This data is then manually determined to identify the corresponding risk type, i.e., the first summary type, before labeling. The labeled data is then processed using a classification algorithm for machine learning to obtain a classification model.

[0089] In a specific example, the classification algorithm described above can be learned using a Bayesian classification algorithm, for instance.

[0090] Let each data sample be described by an n-dimensional feature vector representing the feature values ​​of n attributes (i.e., the first feature mentioned above), i.e., X = {x1, x2, ..., xn}. Assume there are m classes, denoted by C1, C2, ..., Cm. Given an unknown data sample X (i.e., without class labels), if the Naive Bayes classification method assigns the unknown sample X to class Ci, then it must be...

[0091] P(Ci|X)>P(Cj|X)1≤j≤m,j≠i

[0092] S3002, using the classification model, based on the first feature of each target object, obtain the probability that each target object belongs to a preset first summary type.

[0093] According to Bayes' theorem, since P(X) is constant for all classes, maximizing the posterior probability P(Ci|X) can be transformed into maximizing the prior probability P(X|Ci)P(Ci). If the training dataset has many attributes and tuples, the cost of computing P(X|Ci) can be very high. Therefore, it is usually assumed that the values ​​of each attribute are independent, so the prior probabilities P(x1|Ci), P(x2|Ci), ..., P(xn|Ci) can be obtained from the training dataset. After training, the trained classification model can be used to calculate the probability P of a new target object in a certain risk type C. KC That is, the probability that each target object belongs to a preset first summary type is obtained.

[0094] S2082, obtain the cluster profile type of the cluster based on the probability that the target object belongs to the first profile type.

[0095] The probability P of each target object X under each risk type C is obtained by using the method in step S2080 above. KC Therefore, for the entire cluster, the probability for each risk type is...

[0096] P' C =ΣP XC

[0097] Refer to Table 3, which provides an example of the probabilities of different target objects within the cluster for each risk type obtained through the above process:

[0098] 1 001 0.12 0 0.31 …… 2 002 0.03 0.15 0.11 …… 3 003 0.31 0.22 0.21 …… 4 004 0.11 0.33 0.02 …… …… …… …… …… …… …… Grand total …… 0.57 0.7 0.65 ……

[0099] The cluster probability is obtained by summing the probabilities of each target object X within the cluster belonging to the first summary type. The cluster probability is used to characterize whether the cluster conforms to the above risk types.

[0100] In the data example in the table above, the probability of a cluster belonging to risk type C1 is 0.57, the probability of belonging to risk type C2 is 0.7, and the probability of belonging to risk type C3 is 0.65. For a cluster, its cluster profile type and its risk type are interrelated.

[0101] In a specific example, the risk type with the highest probability can be taken as the risk type of the cluster; that is, the risk type of the cluster is C2. Further, the corresponding cluster profile type is determined based on risk type C2.

[0102] In a specific example, the risk types with the highest probabilities can be selected as the risk types for the cluster, such as using risk type C2 and risk type C3 as the risk types for the cluster. Further, the corresponding cluster profile type is determined based on risk type C2 and risk type C3.

[0103] In a specific example, all risk types with probability values ​​higher than a preset threshold can be used as the risk types for the cluster. For example, this threshold could be 0.5. Based on this, risk types C1 / C2 / C3 will be used as the risk types for the cluster. Further, the corresponding cluster profile type is determined based on the risk types C1 / C2 / C3.

[0104] S210, Generate a summary message for the cluster based on a message template that matches the cluster summary type.

[0105] Summary messages are briefings on cluster-related risks intended for human readers. See the following example for a concrete example:

[0106] Description of the activities: Seven clients in this cluster are suspected of organizing gambling. In the past three months, 271 million yuan has flowed in. Most clients operate on the same equipment, and some members have strong financial relationships. They have been reported multiple times for suspected gambling activities. The overall transaction pattern is similar, mainly manifested in the following ways: Two corporate clients, including Chengdu XX Company, frequently receive payments through various transaction methods. The transactions are frequent and the amounts show fixed characteristics (e.g., close to round numbers), presumably for collecting gambling funds; funds are mainly transferred to bank cards through four corporate clients, including Shenzhen XX Company, presumably for rebates through other channels. Funds from Fujian XX Company mainly circulate internally among its members. Based on the above, it is suspected that this cluster is involved in organizing gambling.

[0107] The above message content can be generated by rendering the message template shown in Table 4:

[0108]

[0109] In the message template, the content enclosed in curly braces {} represents the data of interest that needs to be dynamically rendered. Content enclosed in square brackets allows for iteration over multiple data entries.

[0110] In a specific example, the interest data to be dynamically rendered in the first summary template includes first interest data, which can be extracted from the first data of the cluster. For example, the dynamic data customer count corresponding to {number of customers} is obtained by counting the target objects. {cluster summary type} is obtained in step S2082 above. {transaction time} is obtained by statistics from the first data. {amount involved} is obtained by summarizing the transaction amounts in the first data. After extracting the interest data, it is filled into the first summary template to obtain the first part of the final cluster feature message.

[0111] In a specific example, the interest data that needs to be dynamically rendered in the second summary template includes second interest data, which can be extracted from the first data. It can be understood that different first features can have corresponding second summary templates.

[0112] See Table 5 for examples of different second summary templates corresponding to different first features.

[0113]

[0114] The second interest data {name} can be extracted from the account's basic information. The second interest data {number of people} can be obtained by counting the target objects. The second {matching words} are obtained by matching from the transaction remarks. Therefore, after extracting the second interest data, it is filled into the second summary template corresponding to the first feature to obtain the second part of the cluster summary message.

[0115] In a specific example, the first and second parts described above constitute the cluster summary message. However, it is understood that the cluster summary message may include other content, and is not limited to the first and second parts mentioned above.

[0116] Based on the cluster summary message processing method in the above example, the cluster summary type can be quickly extracted from the raw data, and a cluster summary message can be quickly generated based on the summary template for people to view, thereby greatly improving the efficiency and accuracy of cluster feature message generation.

[0117] Please see Figure 5 It illustrates a flowchart of obtaining the cluster summary type in the cluster feature message processing method provided in this application embodiment, which includes:

[0118] S402a, obtain the cluster probabilities corresponding to multiple first summary types respectively, and obtain the maximum value of the cluster probability; and

[0119] S404a, obtain the first summary type corresponding to the maximum cluster probability as the cluster summary type.

[0120] As described above, for a specific first summary type, the cluster probability is the sum of the probabilities of each target object belonging to that first summary type. After calculating the cluster probability for each summary type, data similar to Table 3 can be obtained. The probability of a cluster belonging to risk type C1 is 0.57, the probability of belonging to risk type C2 is 0.7, and the probability of belonging to risk type C3 is 0.65. According to step S404a, the first summary type corresponding to risk type C2 is taken as the aforementioned cluster summary type.

[0121] The cluster feature message processing method according to this embodiment can quickly extract the cluster summary type from the raw data and generate cluster summary messages quickly based on the summary template for human review, thereby greatly improving the generation efficiency of cluster feature messages. Furthermore, determining the cluster summary type based on the maximum cluster probability can further improve the accuracy of the cluster summary messages.

[0122] Please see Figure 6 It illustrates a flowchart of obtaining the cluster summary type in the cluster feature message processing method provided in this application embodiment, which includes:

[0123] S402b, respectively obtain the cluster probabilities corresponding to the multiple first summary types.

[0124] As mentioned above, for a specific first profile type, the cluster probability is the sum of the probabilities of each target object belonging to that first profile type. The cluster probability calculation for each profile type yields data similar to that shown in Table 3. Specifically, the probability of a cluster belonging to risk type C1 is 0.57, the probability of belonging to risk type C2 is 0.7, and the probability of belonging to risk type C3 is 0.65.

[0125] S404b, obtain the N cluster probabilities with the largest probability values ​​among the cluster probabilities, and the first summary type corresponding to the N cluster probabilities, where N>1.

[0126] In one specific implementation, N is set to 2. Based on the data shown in Table 3, the risk types with the highest probability values ​​are C2 and C3, with probabilities of 0.7 and 0.65, respectively. Risk types C2 and C3 each have a corresponding first summary type.

[0127] S406b, Obtain the cluster summary type according to the first summary type corresponding to the N cluster probabilities.

[0128] Specifically, risk types C2 and C3 each have corresponding first summary types, which are now labeled as first summary type a and first summary type b, respectively. Together, they determine the cluster summary type.

[0129] As mentioned above, the cluster profile type determines the message template of the final profile message, and thus ultimately determines the content of the output cluster feature message. Therefore, in this embodiment, both the first profile type a and the first profile type b will be reflected in the message template.

[0130] The message templates shown in Table 4 above are associated with a specific cluster profile type. When considering two or more first profile types, message templates corresponding to profile type a and first profile type b can be used to generate parts of the message content. Finally, the generated message content is merged to form the final cluster feature message.

[0131] The cluster feature message processing method according to this embodiment can quickly extract the cluster summary type from the raw data and quickly generate a cluster summary message for human review based on the summary template, thereby greatly improving the generation efficiency of cluster feature messages. Furthermore, generating the final cluster feature message based on the N first summary types with the highest cluster probability can further enhance the comprehensiveness of the cluster message.

[0132] Please see Figure 7 It illustrates a flowchart of obtaining the cluster summary type in the cluster feature message processing method provided in this application embodiment, which includes:

[0133] S402c, respectively obtain the cluster probabilities corresponding to the multiple first summary types.

[0134] As mentioned above, for a specific first profile type, the cluster probability is the sum of the probabilities of each target object belonging to that first profile type. The cluster probability calculation for each profile type yields data similar to that shown in Table 3. Specifically, the probability of a cluster belonging to risk type C1 is 0.57, the probability of belonging to risk type C2 is 0.7, and the probability of belonging to risk type C3 is 0.65.

[0135] S404c, Obtain the cluster probabilities where all probability values ​​in the cluster probabilities exceed a preset threshold.

[0136] The preset threshold here can be, for example, 0.5. That is, as long as the probability of a risk type exceeds 0.5, the final cluster feature message should reflect the corresponding content. In the data example shown in Table 3, if the threshold is 0.5, risk types C1, C2, and C3 all meet the above conditions.

[0137] S406c, Obtain the cluster summary type according to the first summary type corresponding to the cluster probability whose probability value exceeds a preset threshold.

[0138] When considering that the number of first summary types exceeds 1, message templates corresponding to each first summary type can be used to generate part of the message content. Finally, the generated message content is merged to form the final cluster feature message.

[0139] According to the cluster feature message processing method of this embodiment, the cluster summary type can be quickly extracted from the raw data, and a cluster summary message can be quickly generated based on the summary template for human review, thereby greatly improving the generation efficiency of cluster feature messages. Furthermore, obtaining the cluster summary type based on the first summary type corresponding to the probability of a cluster exceeding a preset threshold and generating the cluster feature message can further enhance the comprehensiveness of the cluster message.

[0140] See Figure 8 It illustrates a schematic diagram of the cluster feature message generation process in the cluster feature message processing method provided in this application embodiment, which includes:

[0141] S502a, Obtain the first summary template associated with the cluster summary type.

[0142] In one specific implementation, the aforementioned first summary template is as follows: Behavioral Description: This cluster has {number of customers} customers involved in {cluster summary type}. Funds inflow {amount involved} have occurred recently within {transaction time}. Most customers operate on the same devices, some members have strong financial relationships, and the cluster has been reported multiple times for suspected involvement in organized gambling. The overall transaction pattern is similar.

[0143] S504a, Extract the first interest data of the cluster from the first data.

[0144] The aforementioned first summary template includes several dynamic fields, which need to be populated by extracting first interest data from the original data. Specifically: the dynamic data corresponding to {number of customers} is obtained by counting the target objects. {cluster summary type} is obtained using the method described above. {transaction time} is obtained through statistics from the first data. {amount involved} is obtained by summarizing the transaction amounts in the first data.

[0145] S506a, the first interest data is filled into the first summary template to obtain the first part of the summary message of the cluster.

[0146] The first part mentioned above, after dynamic rendering of the first interest data, could be interpreted as follows: Seven clients in this cluster are suspected of organizing gambling. In the past three months, 271 million yuan has flowed in. Most clients operate on the same equipment, some members have strong financial ties, and they have been reported multiple times for suspected gambling activities. Their overall transaction patterns are similar.

[0147] S502b, referring to Table 5, obtain the second summary template that corresponds one-to-one with each of the multiple first features.

[0148] S504b, the second summary template is sorted according to the number of target objects in the cluster that match the first feature.

[0149] As shown in Table 2, different target objects can have different first features. First feature 1 hits 3 target objects, first feature 2 hits 3 target objects, first feature 3 hits 1 target object, first feature 4 hits 4 target objects, and first feature 5 hits 2 target objects. If sorted from highest to lowest hit count, the order is: first feature 4, first feature 1 / 2, first feature 5, first feature 3. This sorting determines the output order of the simulated messages corresponding to different first features in the final cluster feature messages.

[0150] S504b, extract second interest data that matches the second summary template from the first data.

[0151] The second interest data {name} can be extracted from the account's basic information. The second interest data {number of people} can be obtained by counting the target audience. The second {matching keywords} are obtained by matching from transaction comments.

[0152] S504b, the second interest data is filled into the second summary template to obtain the second part of the summary message of the cluster.

[0153] Therefore, after extracting the second interest data, the second summary template corresponding to the first feature is filled in to obtain the second part of the cluster summary message.

[0154] S510 assembles the first and second parts to obtain the cluster feature message.

[0155] Assembling the first and second parts together yields the final cluster characteristic message. For example: This cluster has 7 clients suspected of organizing gambling. In the past 3 months, 271 million yuan has flowed in. Most clients operate the same equipment, some members have strong financial relationships, and the cluster has been reported multiple times for suspected gambling activities. The overall transaction pattern is similar, mainly manifested in: two corporate clients, including Chengdu XX Company, frequently receiving payments through various transaction methods, with frequent transactions and fixed amounts (e.g., close to whole numbers), presumably for receiving gambling funds; funds are mainly transferred through four corporate clients, including Shenzhen XX Company, or directly to bank cards, presumably for rebates through other channels. Funds from Fujian XX Company mainly circulate internally among its members. Based on the above, it is presumed that this cluster is suspected of organizing gambling.

[0156] The cluster feature message processing method according to this embodiment can quickly extract the cluster summary type from the raw data and generate cluster summary messages based on the summary template for easy reference, thereby greatly improving the generation efficiency of cluster feature messages. Furthermore, using different message templates to render and generate cluster feature messages decouples the template from the data of interest during the message generation process. Therefore, when it is necessary to update the version of the message content, only the template needs to be updated, further improving the efficiency and flexibility of the cluster feature message generation system.

[0157] See Figure 9 It illustrates a flowchart of the cluster feature message processing method provided in this application embodiment, wherein after generating the cluster feature message, it further includes:

[0158] S212, outputs the generated cluster feature message in an output device.

[0159] In one specific implementation, the output device described above can be a display device, and the output refers to displaying the cluster feature message on the display device. The display device here can be, for example, a monitor or a projection device. The purpose of outputting the cluster feature message is for human review.

[0160] In one specific implementation, the output device described above can also be a voice output device, such as a speaker. The output refers to playing the voice of the cluster feature message through the voice output device for listening and analysis.

[0161] S214, Receive the input content and update the cluster feature message according to the received content.

[0162] Personnel responsible for post-processing cluster feature messages can view or listen to the content of the cluster feature messages through the aforementioned output device, and input the content to be partially modified through an input device. The input device can be, for example, a keyboard or a recording device. Users can input the content they wish to modify, delete or modify at least a portion of the cluster feature message, and save the changes.

[0163] According to the cluster feature message processing method of this embodiment, the automatically generated cluster feature postscript is also output for the user to understand its content, and the user can modify all or part of the cluster feature postscript, which can further improve the accuracy of the cluster feature message.

[0164] Please see Figure 9 This diagram illustrates a structural block diagram of a cluster feature message generation apparatus provided in an embodiment of this application. The apparatus 500 can be used to execute the method provided in the embodiment of this application. Figure 2 The corresponding steps in the corresponding method. Functionally, the device 500 may include: a first acquisition module 501, a second acquisition module 502, a parameter acquisition module 503, a feature acquisition module 504, a summary type acquisition module 505, and a message generation module 506.

[0165] The first acquisition module 501 is used to acquire first data for each of the target objects.

[0166] The second acquisition module 502 is used to acquire at least one preset target data pattern, wherein the target data pattern includes descriptive information of at least one target parameter.

[0167] The parameter acquisition module 503 is used to acquire the target parameters of the target object based on the first data.

[0168] The feature acquisition module 504 is used to acquire a first feature associated with the target data pattern when the target parameters of the target object match the description information.

[0169] The summary type acquisition module 505 is used to acquire a cluster summary type that matches the cluster based on the first feature of each target object.

[0170] The message generation module 506 is used to generate a summary message for the cluster based on a message template that matches the cluster summary type.

[0171] Optionally, the second acquisition module 502 acquires multiple preset target data patterns. The summary type acquisition module 505 determines the probability that the target object belongs to a preset first summary type based on the first feature associated with the multiple target data patterns, and acquires the cluster summary type of the cluster based on the probability that the target object belongs to the first summary type.

[0172] Optionally, the summary type acquisition module 505 accumulates the probability that each target object in the cluster belongs to the first summary type to obtain the cluster probability, and obtains the target summary type that matches the cluster probability as the cluster summary type.

[0173] Optionally, the summary type acquisition module 505 acquires the cluster probabilities corresponding to multiple first summary types, acquires the maximum value of the cluster probability, and then acquires the first summary type corresponding to the maximum value of the cluster probability as the cluster summary type.

[0174] Optionally, the summary type acquisition module 505 acquires the cluster probabilities corresponding to multiple first summary types, acquires the N cluster probabilities with the largest probability values ​​among the cluster probabilities, and the first summary type corresponding to the N cluster probabilities, where N>1, and acquires the cluster summary type according to the first summary type corresponding to the N cluster probabilities.

[0175] Optionally, the summary type acquisition module 505 acquires the cluster probabilities corresponding to multiple first summary types; acquires the cluster probabilities for all clusters whose probability values ​​exceed a preset threshold; and acquires the cluster summary type according to the first summary type corresponding to the cluster probabilities whose probability values ​​exceed the preset threshold.

[0176] Optionally, the summary type acquisition module 505 acquires pre-labeled historical data, and performs machine learning using a classification algorithm based on the association between the first feature and the first summary type of each object in the historical data to obtain a classification model; using the classification model, the probability that each target object belongs to a preset first summary type is obtained based on the first feature of each target object.

[0177] Optionally, the classification algorithm can be a Bayesian classification algorithm.

[0178] Optionally, the message generation module 506 obtains a first summary template associated with the cluster summary type; extracts first interest data of the cluster from the first data; and fills the first interest data into the first summary template to obtain a first part of the summary message of the cluster.

[0179] Optionally, the message generation module 506 obtains a second summary template that corresponds one-to-one with a plurality of the first features; sorts the second summary templates according to the number of target objects in the cluster that match the first features; extracts second interest data that matches the second summary template from the first data; and fills the second interest data into the second summary template to obtain the second part of the summary message of the cluster.

[0180] Optionally, the message generation module 506 sorts the second summary templates from largest to smallest according to the number of matched target objects and finally generates a cluster feature message.

[0181] Optionally, see Figure 10 The aforementioned cluster feature post-processing device 500 may further include: a display module 507 and an update module 508.

[0182] Display module 507 is used to output the generated cluster feature message in an output device.

[0183] The update module 508 is used to receive the input content and update the cluster feature message according to the received content.

[0184] The cluster feature message processing device according to the above embodiments can quickly extract the cluster summary type from the raw data and quickly generate cluster summary messages based on the summary template for human review, thereby greatly improving the generation efficiency and accuracy of cluster feature messages. Furthermore, using different message templates to render and generate cluster feature messages decouples the template from the data of interest during the message generation process. Therefore, when it is necessary to update the version of the message content, only the template needs to be updated, further improving the efficiency and flexibility of the cluster feature message generation system.

[0185] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described device and module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0186] In the several embodiments provided in this application, the coupling or direct coupling or communication connection between the modules shown or discussed may be an indirect coupling or communication connection through some interface, device or module, and may be electrical, mechanical or other forms.

[0187] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0188] Please see Figure 11 This document illustrates a structural block diagram of an electronic device 1000 provided in an embodiment of this application. The electronic device 1000 may be... Figure 1The server 100 or terminal device 200 shown. The electronic device 1000 in this application may include one or more of the following components: processor 1010, memory 1020, and one or more application programs, wherein the one or more application programs may be stored in memory 1020 and configured to be executed by one or more processors 1010, and the one or more programs are configured to perform the methods as described in the foregoing method embodiments.

[0189] The processor 1010 may include one or more processing cores. The processor 1010 connects to various parts within the electronic device 1000 using various interfaces and lines, and performs various functions and processes data of the electronic device 1000 by running or executing instructions, programs, code sets, or instruction sets stored in the memory 1020, and by calling data stored in the memory 1020. Optionally, the processor 1010 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 1010 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the displayed content; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 1010 and may be implemented separately using a communication chip.

[0190] The memory 1020 may include random access memory (RAM) or read-only memory (ROM). The memory 1020 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 1020 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function, instructions for implementing the various method embodiments described above, etc. The data storage area may also store data created by the electronic device 1000 during use.

[0191] Understandable. Figure 11 The structure shown is for illustrative purposes only. The electronic device 1000 may also include components that are more... Figure 11The electronic device 1000 may include more, fewer, or completely different components. For example, the electronic device 1000 may also include an input unit, a display unit, etc.

[0192] Please see Figure 12 This diagram illustrates a structural block diagram of a computer-readable storage medium provided in an embodiment of this application. The computer-readable storage medium 1100 stores program code 1110, which can be called by a processor to execute the methods described in the above method embodiments.

[0193] The computer-readable storage medium 1100 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. Optionally, the computer-readable storage medium 1100 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 1100 has storage space for program code 1110 that performs any of the method steps described above. This program code can be read from or written to one or more computer program products. The program code 1110 may be compressed, for example, in a suitable form.

[0194] Additionally, according to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various alternative implementations described above.

[0195] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A cluster summary packet processing method, the cluster comprising a plurality of target objects, characterized in that, The method includes: Obtain the first data for each of the target objects; Acquire multiple preset target data patterns, wherein each target data pattern includes descriptive information of at least one target parameter; The target parameters of the target object are obtained based on the first data; When the target parameters of the target object match the description information, a first feature associated with the target data pattern is obtained; wherein, each target data pattern has a corresponding first feature; when the target parameters of the target object match the description information, it indicates that the target object has a first feature that matches the target data pattern. Based on the first feature associated with multiple target data patterns for each target object whose target parameters match the description information, determine the probability that each target object belongs to a preset first summary type; The probability of the target object belonging to the first summary type for each object in the cluster is accumulated to obtain the cluster probability; Obtain the target profile type that matches the cluster probability as the cluster profile type; Obtain a first summary template associated with the cluster summary type and a second summary template that corresponds one-to-one with multiple first features of the target object that conforms to the description information of the target parameters; Extract the first interest data of the cluster from the first data; The second summary template is sorted according to the number of target objects in the cluster that match the first feature; Extract second interest data that matches the second summary template from the first data; The first interest data is filled into the first summary template to obtain the first part of the summary message of the cluster; The second interest data is filled into the second summary template to obtain the second part of the summary message of the cluster.

2. The method of claim 1, wherein, The step of obtaining the target profile type that matches the cluster probability as the cluster profile type includes: Obtain the cluster probabilities corresponding to multiple first summary types, and obtain the maximum value of the cluster probabilities; and Obtain the first summary type corresponding to the maximum cluster probability as the cluster summary type.

3. The method of claim 1, wherein, The step of obtaining the target profile type that matches the cluster probability as the cluster profile type includes: Obtain the cluster probabilities corresponding to multiple first summary types respectively; Obtain the N cluster probabilities with the highest probability values ​​from the cluster probabilities, and the first summary type corresponding to these N cluster probabilities, where N>1; and The cluster profile type is obtained based on the first profile type corresponding to the N cluster probabilities.

4. The method of claim 1, wherein, The step of obtaining the target profile type that matches the cluster probability as the cluster profile type includes: Obtain the cluster probabilities corresponding to multiple first summary types respectively; Obtain the probability of all clusters whose probability values ​​exceed a preset threshold; and The cluster profile type is obtained based on the first profile type corresponding to the cluster probability whose probability value exceeds a preset threshold.

5. The method of claim 1, wherein, The step of determining the probability that each target object belongs to a preset first summary type based on the first feature associated with multiple target data patterns for each target object whose target parameters match the description information includes: Obtain pre-labeled historical data, and perform machine learning using a classification algorithm based on the association between the first feature and the first summary type of each object in the historical data to obtain a classification model; Using the classification model, based on the first feature associated with multiple target data patterns for each target object whose target parameters match the description information, the probability that each target object belongs to a preset first summary type is determined.

6. The method of claim 5, wherein, The use of classification algorithms for machine learning includes: using Bayesian classification algorithms for machine learning.

7. The method of claim 1, wherein, The step of sorting the second summary template according to the number of target objects in the cluster that match the first feature includes: sorting them from largest to smallest according to the number of matched target objects.

8. The method of claim 1, wherein, Also includes: The generated cluster feature message is output in an output device; as well as Receive the input content and update the cluster feature message based on the received content.

9. A cluster feature message generation apparatus, the cluster including a plurality of target objects, characterized by comprising: The device includes: The first acquisition module is used to acquire first data for each of the target objects; The second acquisition module is used to acquire multiple preset target data patterns, wherein the target data pattern includes description information of at least one target parameter; The parameter acquisition module is used to acquire the target parameters of the target object based on the first data; The feature acquisition module is used to acquire a first feature associated with the target data pattern when the target parameters of the target object match the description information; wherein, each target data pattern has a corresponding first feature; when the target parameters of the target object match the description information, it indicates that the target object has a first feature that matches the target data pattern; The summary type acquisition module is used to determine the probability that each target object belongs to a preset first summary type based on the first feature associated with multiple target data patterns for each target object whose target parameters match the description information; to accumulate the probability that each target object in the cluster belongs to the first summary type to obtain a cluster probability; and to obtain the target summary type that matches the cluster probability as the cluster summary type. The message generation module is configured to: obtain a first summary template associated with the cluster summary type and a second summary template corresponding one-to-one with multiple first features of target objects that conform to the description information; extract first interest data of the cluster from the first data; sort the second summary template according to the number of target objects in the cluster that match the first features; extract second interest data matching the second summary template from the first data; fill the first interest data into the first summary template to obtain a first part of the summary message of the cluster; and fill the second interest data into the second summary template to obtain a second part of the summary message of the cluster.

10. An electronic device, comprising: include: One or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs being configured to perform the method as described in any one of claims 1-8.

11. A computer readable storage medium, characterized in that, The computer-readable storage medium stores program code that can be invoked by a processor to execute the method as described in any one of claims 1-8.

Images