Risk list managing system and method thereof

Abstract

This invention provides a risk list monitoring system comprising a database, a risk analysis unit, a risk list generation unit, and a server. The database stores account information and transaction flow data. The risk analysis unit uses a transaction risk model to analyze the transaction flow data to generate at least one risk factor corresponding to the transaction flow data, and calculates the weight of the at least one risk factor to generate a risk score. When the risk score exceeds a risk standard threshold, the risk list generation unit generates and sends a list of risky accounts. The server marks the accounts corresponding to the account information in the risky account list as temporarily restricted from withdrawal. This invention's risk list monitoring system can automatically identify high-risk accounts instantly, efficiently, and quickly, thereby improving efficiency and reducing labor costs.

Description

[Technical Field]

[0001] This invention relates to a monitoring system and method, and more particularly, to a risk list monitoring system and method for identifying high-risk abnormal trading accounts. [Previous Technology]

[0002] With the development of the internet and financial technology, people can choose other methods of transaction besides cash, such as electronic payment, online banking remittance, and online transfer. Since transfers and payments through automated devices (such as mobile banking, online banking, ATMs, and web ATMs) do not require face-to-face transactions, online fraud has also emerged. In recent years, with the updating of fraud methods and the increasing infiltration of financial institutions by fraud groups to engage in illegal activities, financial institutions typically take relevant regulatory measures against accounts suspected of being illegal or exhibiting abnormal transaction patterns.

[0003] Generally, financial institutions establish abnormal transaction warning indicators or rules. When an account's transaction data triggers these indicators or rules, a warning is generated, and subsequent actions are taken. However, with current technology, financial institutions manually review and audit transaction data one by one to decide whether to regulate the account. This not only consumes a lot of time and manpower in the review process, but also faces the problem of insufficient timeliness in monitoring high-risk abnormal accounts. In addition, existing warning indicators or rules are too rule-based, broad, and lack sufficient risk identification, resulting in a large number of repetitive invalid alerts, thereby reducing the accuracy of identifying abnormal accounts.

[0004] Therefore, a solution is needed to immediately monitor high-risk abnormal trading accounts after identification in order to solve the existing technical problems. [Summary of the Invention]

[0005] In view of the above, one aspect of the present invention is to provide a risk list monitoring system to solve the problems of the prior art.

[0006] In one specific embodiment, the risk list monitoring system includes a database, a risk analysis unit, a risk list generation unit, and a server. The database stores account information and corresponding transaction flow information. The risk analysis unit is connected to the database and includes a transaction risk model. The transaction risk model analyzes the transaction flow information to generate at least one risk factor corresponding to the transaction flow information, and calculates the weight of the at least one risk factor to generate a risk score. The risk list generation unit is connected to the risk analysis unit and pre-stores a risk standard threshold. When the risk score of the transaction flow information is greater than the risk standard threshold, the risk list generation unit generates and sends a list of risky accounts, wherein the risky account list includes account information. The server is connected to the risk list generation unit. The server receives the risky account list generated by the risk list generation unit and marks the accounts corresponding to the account information in the risky account list as temporarily blocked.

[0007] The risk list monitoring system further includes a plurality of storage devices connected to the risk list generation unit and a server. The risk account list generated by the risk list generation unit is stored in the storage devices in a distributed manner, and the server receives the risk account list from the storage devices.

[0008] Further, the server includes a verification unit. The verification unit is used to generate and send a confirmation signal based on the risk account list received by the server. When the risk account list generation unit does not receive the confirmation signal, it generates a warning signal and resends the risk account list.

[0009] Among them, the risk analysis unit updates the transaction risk model using machine learning based on the list of risk accounts, transaction flow data, and all the accounts that have been marked.

[0010] Furthermore, the risk analysis unit updates the trading risk model with a gradient enhancement algorithm.

[0011] The risk list monitoring system further includes a police database connected to a risk analysis unit. The police database contains information on multiple alerted accounts. The risk analysis unit updates the trading risk model using machine learning based on the risk account list, transaction flow data, all registered accounts, and such alerted account information.

[0012] One aspect of the present invention is to provide a risk list supervision method to solve the problems of the prior art.

[0013] In one specific embodiment, the risk list monitoring method includes the following steps: storing account information of an account and transaction flow information corresponding to the account; a risk analysis unit analyzes the transaction flow information using a transaction risk model to generate at least one risk factor corresponding to the transaction flow information, and calculates the weight of the at least one risk factor to generate a risk score; a risk list generation unit generates a risk account list when the risk score of the transaction flow information is greater than a risk standard threshold, wherein the risk account list includes account information; and a server receives the risk account list generated by the risk list generation unit and marks the accounts corresponding to the account information in the risk account list as temporarily banned from withdrawal.

[0014] The risk list monitoring method further includes the following steps: storing the risk account list in a plurality of storage devices in a distributed storage manner; and in the step of the server receiving the risk account list generated by the risk list generation unit, the step further includes the following steps: the server receiving the risk account list from the storage devices.

[0015] The step of the server receiving the risk account list generated by the risk list generation unit further includes the following steps: the server's verification unit generates and sends a confirmation signal based on the risk account list received by the server; and when the risk list generation unit does not receive the confirmation signal, it generates a warning signal and resends the risk account list.

[0016] The risk list supervision method further includes the following steps: the risk analysis unit updates the transaction risk model using machine learning based on the risk account list, transaction flow data, all the marked accounts, and multiple warning account data in the police database.

[0017] In summary, the risk list monitoring system of the present invention can automatically analyze and judge high-risk transactions and automatically identify high-risk accounts through an intelligent transaction risk model, without relying on manual interpretation, thereby improving accuracy and efficiency and reducing labor costs. Furthermore, the risk list monitoring system of the present invention can store and transmit the risk account list through a distributed file storage mechanism to ensure data transmission and interoperability. Moreover, the risk list monitoring system of the present invention includes a verification function for the risk account list to ensure the accuracy of the data. In addition, the risk list monitoring system of the present invention can update the transaction risk model through machine learning and can further analyze account data collected by government agencies, thereby improving the accuracy of identifying abnormal accounts. [Simplified Explanation of the Diagram]

[0018] Figure 1 is a functional block diagram illustrating a risk list monitoring system according to a specific embodiment of the present invention.

[0018] Figure 2 is a functional block diagram illustrating a risk list monitoring system according to a specific embodiment of the present invention.

[0018] Figure 3 is a flowchart illustrating the steps of a risk list monitoring method according to a specific embodiment of the present invention.

[0018] Figure 4 is a flowchart illustrating the steps of a risk list monitoring method according to a specific embodiment of the present invention.

[0018] Figure 5 is a flowchart illustrating the steps of a risk list monitoring method according to a specific embodiment of the present invention.

[0018] Figure 6 is a flowchart illustrating the steps of a risk list monitoring method according to a specific embodiment of the present invention.

Implementation Method

[0019] To make the advantages, spirit, and features of the present invention easier and clearer to understand, detailed descriptions and discussions will follow with reference to specific embodiments and the accompanying drawings. It is worth noting that these specific embodiments are merely representative examples of the present invention, and the specific methods, apparatuses, conditions, materials, etc., exemplified are not intended to limit the present invention or the corresponding specific embodiments. Furthermore, the devices in the figures are only used to express their relative positions and are not drawn to scale; this is to be stated beforehand.

[0020] In various embodiments of this disclosure, the expression "or" includes any or all combinations of the words listed simultaneously. For example, the expression "A or B" may include A, may include B, or may include both A and B. Furthermore, the indefinite articles "a," "an," and "an" preceding the means or elements of the present invention do not impose a limit on the quantity (i.e., the number of times) of the means or elements. Therefore, "a" should be interpreted as including one or at least one, and singular means or elements also include plural forms, unless the quantity clearly refers to the singular form.

[0021] In the description of this specification, references to terms such as "one specific embodiment," "another specific embodiment," or "partial specific embodiment" mean that a specific feature, structure, material, or characteristic described in connection with that embodiment is included in at least one embodiment of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments.

[0022] Please refer to Figure 1. Figure 1 is a functional block diagram illustrating a risk list monitoring system 1 according to a specific embodiment of the present invention. As shown in Figure 1, in this specific embodiment, the risk list monitoring system 1 includes a database 10, a risk analysis unit 11, a risk list generation unit 12, and a server 13. The risk analysis unit 11 is connected to the database 10, the risk list generation unit 12 is connected to the risk analysis unit 11, and the server 13 is connected to the risk list generation unit 12. In practice, the risk analysis unit 11 and the risk list generation unit 12 may be analysis chips or processing chips. The risk analysis unit 11 and the risk list generation unit 12 may each be a single chip, or they may be integrated into the same chip. Furthermore, the risk analysis unit 11 and the risk list generation unit 12 may also be integrated into a computing device (such as a computer or server), and the computing device and the server 13 may communicate with each other via wired or wireless connection.

[0023] In this specific embodiment, the database 10 is used to store account information for a plurality of accounts and transaction flow information for a plurality of accounts. In practice, the database 10 may store an account list, and the account list includes a plurality of accounts and their account information (e.g., customer name, account number, account status, etc.). Transaction flow information may be the information generated by account transactions (e.g., deposits, withdrawals, transfers, deductions, etc.), and each transaction flow information may correspond to one account information. In practical applications, the database 10 may be connected to the computers of financial institution staff, or to ATMs or other transaction devices. When a customer makes a transaction, the computer or transaction device will store each transaction flow information in the database 10.

[0024] In this specific embodiment, the risk analysis unit 11 includes a transaction risk model 111, which is used to analyze the transaction flow data stored in the database 10 to generate at least one risk factor corresponding to the transaction flow data. In practice, the risk factor can be a risk indicator item of abnormal flow, such as: transaction type, account status, transaction amount, transaction frequency, transaction account, etc. The transaction risk model 111 can analyze multiple historical abnormal account data and historical abnormal transaction data through machine learning (such as: supervised learning, unsupervised learning, etc.) to summarize and generate risk factors. In practical applications, the risk analysis unit 11 will analyze all the transaction flow data stored in the database 10 one by one and find the risk factor for each transaction flow data.

[0025] Further, the trading risk model 111 calculates the weights of the risk factors in the trading flow data to generate a risk score for the corresponding trading flow data. In practice, each risk factor can correspond to a risk weight score. The risk weight score can be determined based on the importance or risk level of the risk factor, or it can be determined by the trading risk model 111 through machine learning analysis of multiple historical abnormal account data and historical abnormal transaction data. In practical applications, after the risk analysis unit 11 identifies all the risk factors in the trading flow data, the risk analysis unit 11 calculates the weights of all risk factors to generate a risk score for the trading flow data between 0 and 1. It is worth noting that the risk score for the trading flow data is not limited to the aforementioned format; the range of the risk score can also be between 0 and 100, and the risk score can also be presented as a risk level.

[0026] In this specific embodiment, the risk list generation unit 12 pre-stores a risk standard threshold, and generates a risk account list based on the risk score of the transaction flow data and the risk standard threshold. In practice, the risk standard threshold can be a threshold value used to judge abnormal transactions, and can be determined based on historical data or professional experience. In practical applications, when the risk score of the transaction flow data generated by the transaction risk model 111 is greater than the risk standard threshold, it indicates that the transaction is a high-risk abnormal transaction. At this time, the risk list generation unit 12 generates a risk account list, and the risk account list contains account information corresponding to the transaction flow data of that transaction.

[0027] Further, the risk list generation unit 12 will send the risk account list to the server 13. In practice, the risk list generation unit 12 may send the risk account list to the server 13 on each business day or at other specific times to publish information on high-risk abnormal accounts within the financial industry. In addition, before sending the risk account list, the risk list generation unit 12 will first confirm the communication status between the computing device and the server 13. Only after the risk list generation unit 12 confirms that the connection status between the computing device and the server 13 is normal will the risk list generation unit 12 send the risk account list to the server 13.

[0028] In this specific embodiment, server 13 is used to receive the risk account list generated by risk list generation unit 12, and to mark the account corresponding to the account information in the risk account list as temporarily restricted from withdrawal. In practice, server 13 can be a computer or server of the central system of a financial institution, and server 13 can also connect to database 10 and obtain the aforementioned account list. Further, server 13 may include a marking unit 131, and the marking unit 131 may be a chip. The marking unit 131 can mark the account corresponding to the account information in the account list as temporarily restricted from withdrawal according to the risk account list. Temporary restriction of an account means that the account cannot conduct any transaction activities, such as: being unable to use debit cards, transfers, electronic payment functions, or conduct financial services such as account opening, loans, and remittances. In addition, in practical applications, after server 13 marks the accounts in the account list according to the risk account list, server 13 can further transmit the marked account list to the computer of the financial institution's staff for subsequent processing. In one specific embodiment, server 13 can also transmit the list of marked accounts to the financial institution's account system, which can temporarily disable the trading function of accounts marked as temporarily suspended in the account list. Therefore, the risk list monitoring system of the present invention can automatically analyze and judge high-risk transactions and automatically mark abnormal accounts through intelligent transaction risk models, without relying on manual interpretation, thereby improving accuracy and efficiency and reducing labor costs.

[0029] Please refer to Figure 2. Figure 2 is a functional block diagram illustrating a risk list monitoring system 1 according to a specific embodiment of the present invention. As shown in Figure 2, in this specific embodiment, the risk list monitoring system 1 further includes a plurality of storage devices 15 connected to a risk list generation unit 12 and a server 13. After the risk list generation unit 12 generates a list of risky accounts, the risk list generation unit 12 stores the risky account list in a distributed storage manner to the plurality of storage devices 15. In practice, the risk list generation unit 12 can distribute the risky account list files to the plurality of storage devices 15 through distributed file system software. In practical applications, the risk list generation unit 12 can divide the risky account list files into a plurality of sub-files and store each sub-file in at least one storage device 15. The server 13 can read the plurality of sub-files from the plurality of storage devices 15 to receive and obtain the risky account list. Since each sub-file is stored in multiple storage devices 15. Therefore, when one of the storage devices 15 is damaged or disconnected, the server 13 can still obtain the list of risky accounts from the other storage devices 15. Thus, the risk list monitoring system of the present invention can store and transmit the list of risky accounts through a distributed file storage mechanism to ensure data transmission and interoperability.

[0030] In this specific embodiment, the server 13 further includes a verification unit 132, which may be a chip. The verification unit 132 is used to generate and send a confirmation signal based on the risk account list received by the server 13. In practice, when the server 13 has indeed received the risk account list, the verification unit 132 will generate a confirmation signal and immediately send it back to the risk list generation unit 12. When the server 13 has not received the risk account list, the verification unit 132 will not generate a confirmation signal. Further, when the risk list generation unit 12 receives the confirmation signal, it indicates that the risk account list has been successfully transmitted to the server 13. When the risk list generation unit 12 does not receive the confirmation signal, it indicates that the risk account list has not been transmitted to the server 13. At this time, the risk list generation unit 12 generates a warning signal, and financial institutions can check whether there is any abnormality in the connection between the risk list generation unit 12 and the server 13 based on the warning signal, wherein the warning signal may be text, sound, etc. The risk list generation unit 12 can resend the risk account list to the server 13 for subsequent monitoring operations.

[0031] Furthermore, in this specific embodiment, the verification unit can use the account information of all registered accounts and the account information of the risk account list. In practice, since the registration of accounts will directly affect all customer transactions, the verification unit 132 can further compare the account information of all accounts in the account list registered by the registration unit 131 and the account information of the risk account list. In practical applications, the verification unit 132 can compare the number of accounts in the registered account list and the number of accounts in the risk account list, and can also compare the account information content of the registered account list and the risk account list. When the information of the registered account list and the information of the risk account list do not match, it indicates that the server 13 has not received a complete risk account list. At this time, the verification unit 132 will also generate a warning signal, and the server 13 will send the warning signal to the risk list generation unit 12. Further, when the risk list generation unit 12 receives the warning signal, the risk list generation unit 12 will resend the risk account list according to the warning signal. Therefore, the risk list monitoring system of the present invention includes a verification function for the risk account list to ensure the accuracy of the data.

[0032] In this specific embodiment, after the risk list generation unit 12 generates the risk account list, the risk analysis unit 11 updates the transaction risk model 111 using machine learning based on the risk account list, transaction flow data, and all the accounts already annotated. In practice, the risk analysis unit 11 can use the transaction flow data stored in the database 10, the risk account list generated by the risk list generation unit 12, and all account data in the account list annotated by the annotation unit 131 as input data, and analyze this data using a gradient boosting algorithm to update the transaction risk model 111, thereby enabling the transaction risk model 111 to summarize more risk factors and adjust / update the weight of each risk factor, thereby improving accuracy.

[0033] In this specific embodiment, the risk list monitoring system 1 further includes a police database 18 connected to the risk list generation unit 12. In practice, the police database 18 may be a database of a police unit and contains information on a plurality of alert accounts. The alert account information may be information on abnormal transaction accounts collected by the police unit. The risk analysis unit 11 may receive information on a plurality of alert accounts from the police database 18, and may update the transaction risk model using machine learning based on the risk account list, transaction flow data, all registered accounts, and such alert account information. Therefore, the risk list monitoring system of the present invention can also be further analyzed with account information collected by government agencies, thereby improving accuracy.

[0034] Please refer to Figure 3. Figure 3 is a flowchart illustrating the steps of a risk list monitoring method according to a specific embodiment of the present invention. The steps in Figure 3 can be executed through the risk list monitoring system of Figure 1. As shown in Figures 1 and 3, the risk list monitoring method includes the following steps: Step S1: Store account information and corresponding transaction flow information of the account to database 10; Step S2: Risk analysis unit 11 analyzes transaction flow information using transaction risk model 111 to generate at least one risk factor for the corresponding transaction flow information, and calculates the weight of the at least one risk factor to generate a risk score for the corresponding transaction flow information; Step S3: Risk list generation unit 12 generates a risk account list when the risk score of the transaction flow information is greater than the risk standard threshold, wherein the risk account list includes account information; and Step S4: Server 13 receives the risk account list generated by risk list generation unit 12, and marks the accounts corresponding to the account information in the risk account list as temporarily banned.

[0035] Please refer to Figure 4. Figure 4 is a flowchart illustrating the steps of a risk list monitoring method according to a specific embodiment of the present invention. The steps of Figure 4 can be executed through the risk list monitoring system of Figure 2. As shown in Figures 2 and 4, after step S3 of the risk list monitoring method, the following step is further included: Step S5: The risk account list is stored in a plurality of storage devices 15 in a distributed storage manner. Furthermore, in the step of the server receiving the risk account list generated by the risk list generation unit in step S4 of Figure 1, the following step is further included: Step S41: The server 13 receives the risk account list from the storage devices 15.

[0036] Please refer to Figure 5. Figure 5 is a flowchart illustrating the steps of a risk list monitoring method according to a specific embodiment of the present invention. The steps in Figure 5 can be executed through the risk list monitoring system of Figure 2. As shown in Figures 2 and 5, after step S3 of the risk list monitoring method, the following steps are further included: Step S41: The verification unit 131 of the server 13 generates and sends a confirmation signal based on the risk account list received by the server 13; and Step S42: The risk list generation unit 12 determines whether a confirmation signal has been received. If the determination result is negative, then step S43 is executed: The risk list generation unit 12 generates a warning signal and resends the risk account list, and then step S41 is executed again; if the determination result is positive, then step S44 is executed: The server 13 marks the accounts corresponding to the account information in the risk account list as temporarily blocked. Furthermore, after step S44 of the risk list monitoring method, the following steps are further included: Step S6: The verification unit 131 of the server 13 compares all the registered accounts with the risk account list; and Step S7: The verification unit 131 generates a warning signal when the registered accounts and the risk account list do not match.

[0037] Please refer to Figure 6. Figure 6 is a flowchart illustrating the steps of a risk list monitoring method according to a specific embodiment of the present invention. The steps in Figure 6 can be executed through the risk list monitoring system of Figure 2. As shown in Figures 2 and 6, after step S4 of the risk list monitoring method, the following step is further included: Step S8: The risk analysis unit 11 updates the transaction risk model 111 using machine learning based on the risk account list, transaction flow data, all registered accounts, and multiple alert account data in the police database 18. It is worth noting that the steps in Figures 4 to 6 can be arbitrarily combined, and steps S6 and S7 in Figure 5 and step S8 in Figure 6 can be executed simultaneously.

[0038] In summary, the risk list monitoring system of the present invention can automatically analyze and judge high-risk transactions and automatically identify high-risk accounts through an intelligent transaction risk model, without relying on manual interpretation, thereby improving accuracy and efficiency and reducing labor costs. Furthermore, the risk list monitoring system of the present invention can store and transmit the risk account list through a distributed file storage mechanism to ensure data transmission and interoperability. Moreover, the risk list monitoring system of the present invention includes a verification function for the risk account list to ensure the accuracy of the data. In addition, the risk list monitoring system of the present invention can update the transaction risk model through machine learning and can further analyze account data collected by government agencies, thereby improving the accuracy of identifying abnormal accounts.

[0039] The detailed description of the preferred embodiments above is intended to more clearly illustrate the features and spirit of the present invention, and is not intended to limit the scope of the present invention by the preferred embodiments disclosed above. Rather, the aim is to cover various modifications and equivalent arrangements within the scope of the patent claims of the present invention. Therefore, the scope of the patent claims of the present invention should be interpreted in the broadest possible sense based on the foregoing description, so as to cover all possible modifications and equivalent arrangements.

Claims

1. A risk list monitoring system, comprising: a database for storing account information and corresponding transaction flow information for an account; a police database for storing information on a plurality of alert accounts; a risk analysis unit connected to the database and the police database and including a transaction risk model, the transaction risk model being used to analyze the transaction flow information to generate at least one risk factor corresponding to the transaction flow information, and calculating the weight of the at least one risk factor to generate a risk score; and a risk list generation unit connected to the risk analysis unit and pre-stored a risk standard threshold, wherein when the risk score of the transaction flow information is... When the risk exceeds the risk threshold, the risk list generation unit generates and sends a list of risky accounts, which includes the account information; and a server, connected to the risk list generation unit and including a verification unit, which receives the risky account list generated by the risk list generation unit, and the verification unit generates and sends a confirmation signal based on the risky account list received by the server, the server marks the account corresponding to the account information in the risky account list as temporarily blocked, and the verification unit compares the marked account with the risky account list; wherein, When the risk list generation unit does not receive the confirmation signal, it generates an alert signal and resends the risk account list; wherein, the verification unit generates the alert signal when the recorded account and the risk account list do not match; wherein, the risk analysis unit updates the transaction risk model using machine learning based on the risk account list, the transaction flow data, all recorded accounts and the alert account data.

2. The risk list monitoring system as described in claim 1 further includes a plurality of storage devices connected to the risk list generating unit and the server, wherein the risk account list generated by the risk list generating unit is stored in the storage devices in a distributed manner, and the server receives the risk account list from the storage devices.

3. The risk list monitoring system as described in claim 1, wherein the risk analysis unit updates the transaction risk model using machine learning based on the risk account list, the transaction flow data, and all the accounts that have been marked.

4. The risk list monitoring system as described in claim 3, wherein the risk analysis unit updates the transaction risk model using a gradient enhancement algorithm.

5. A risk list monitoring method, comprising the following steps: storing account information of an account and corresponding transaction flow information of the account; a risk analysis unit analyzing the transaction flow information using a transaction risk model to generate at least one risk factor corresponding to the transaction flow information, and calculating the weight of the at least one risk factor to generate a risk score; a risk list generation unit generating a risk account list when the risk score of the transaction flow information is greater than a risk standard threshold, wherein the risk account list includes the account information; a server receiving the risk account list generated by the risk list generation unit, and assigning the account information corresponding to the risk account information in the risk account list to the risk account list. The account is marked as temporarily suspended; a verification unit of the server generates and sends a confirmation signal based on the risk account list received by the server; the verification unit compares the marked account with the risk account list; if the risk list generation unit does not receive the confirmation signal, it generates an alert signal and resends the risk account list; the verification unit generates an alert signal when the marked account and the risk account list do not match; and the risk analysis unit updates the transaction risk model using machine learning based on the risk account list, the transaction flow data, all marked accounts, and multiple alert account data in a police database.

6. The risk list monitoring method as described in claim 5 further includes the following steps: storing the risk account list in a distributed storage manner in a plurality of storage devices; and, in the step of the server receiving the risk account list generated by the risk list generation unit, the step further includes the following step: the server receiving the risk account list from the storage devices.

Images