CN112258309A - Wind control decision method and device - Google Patents

Abstract

The invention discloses a wind control decision method and a device, wherein the method comprises the following steps: performing feature processing on the features to generate high-order features, training the high-order features by using GBDT to obtain a two-classifier, predicting the high-order features, and constructing new features according to the prediction probability value; performing univariate binning on the features by using a decision tree; introducing the characteristics of the GBDT structure and the characteristics of the decision tree after binning into a logistic regression model for training to obtain risk scores; processing transaction data into real-time characteristics by using a distributed stream data flow engine (Flink), and bringing the real-time characteristics into a decision tree model to generate a high-risk rule; and generating a wind control decision matrix according to the risk score and the high risk rule so as to identify the risk level of the transaction merchant. The invention can at least improve the identification method of the risk commercial tenant and provide the intelligent wind control decision service which can be iterated rapidly.

Description

Wind control decision method and device

Technical Field

The invention relates to the technical field of internet, in particular to a wind control decision method and a wind control decision device.

Background

In the current era, the payment market of China is rapidly developed, the payment service scenes are increasingly rich, the payment infrastructure is increasingly perfect, and the financial innovation and the economic sustainable development of China are promoted. The network payment leads the innovative development of the retail field, plays a positive role in promoting the entity economic business model innovation, but the application of the emerging technology brings new risks, the network payment risks present new trends of concealment, complexity and the like, the account stealing, money laundering and fraud cases present high-emergence situations, and serious loss is caused to the payment mechanism, so the payment mechanism should construct an intelligent payment wind control decision service consisting of new technologies such as big data, artificial intelligence, cloud computing and the like, and the risk prevention and control capability is improved.

Therefore, based on the development background of the payment industry, the remittance provides an intelligent wind control decision service for a service provider accessing a remittance payment channel in the domestic payment industry for the first time, and provides risk identification capability and disposal capability of subordinate merchants for customers through a wind control security service integrated with a payment tool.

Disclosure of Invention

Aiming at the problems in the related art, the invention provides a wind control decision method and a wind control decision device, which can improve the identification method of risk merchants and provide an intelligent wind control decision service capable of fast iteration.

According to an aspect of the present invention, there is provided a wind control decision method, including:

performing feature processing on the features to generate high-order features, training the high-order features by using GBDT to obtain a two-classifier, predicting the high-order features, and constructing new features according to the prediction probability value;

performing univariate binning on the features using a decision tree;

introducing the characteristics constructed by the GBDT and the characteristics subjected to decision tree binning into a logistic regression model for training to obtain a risk score;

processing transaction data into real-time characteristics by using a distributed stream data flow engine (Flink), and bringing the real-time characteristics into a decision tree model to generate a high-risk rule;

and generating a wind control decision matrix according to the risk score and the high risk rule so as to identify the risk level of the transaction merchant.

According to an embodiment of the invention, the feature processing comprises: missing value filling, null value processing, outlier processing and feature importance screening.

According to the embodiment of the invention, constructing the original features according to the prediction probability values comprises the following steps: and recording the leaf node position to which the prediction probability value obtained by calculating each tree in the model belongs as 1, and constructing the new feature.

According to the embodiment of the invention, the wind control decision method further comprises the following steps: dividing the sample into a training set and a testing set; wherein the GBDT is used to train samples in the training set and the prediction is performed on samples in the test set.

According to another aspect of the present invention, there is provided a wind control decision device, including:

the characteristic module is used for carrying out characteristic processing on the characteristics, generating high-order characteristics, training the high-order characteristics by using GBDT to obtain a two-classifier, predicting the high-order characteristics and constructing new characteristics according to the prediction probability value;

the binning module is used for carrying out univariate binning on the characteristics by using a decision tree;

the model training module is used for substituting the characteristics of the GBDT structure and the characteristics after the decision tree is subjected to binning into a logistic regression model for training to obtain a risk score;

the real-time characteristic module is used for processing transaction data into real-time characteristics by using a distributed stream data flow engine Flink, and bringing the real-time characteristics into a decision tree model to generate a high risk rule;

and the wind control strategy module is used for generating a wind control decision matrix according to the risk score and the high risk rule so as to identify the risk level of the transaction merchant.

According to an embodiment of the invention, the feature processing comprises: missing value filling, null value processing, outlier processing and feature importance screening.

According to an embodiment of the invention, the feature module is configured to: and recording the leaf node position to which the prediction probability value obtained by calculating each tree in the model belongs as 1, and constructing the new feature.

According to an embodiment of the invention, the feature module is further configured to: the samples are divided into a training set and a test set. Wherein, GBDT is used to train the samples in the training set and predict the samples in the testing set.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings needed in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings without creative efforts.

FIG. 1 is a flow chart of a method of wind control decision according to an embodiment of the invention;

FIG. 2 is a flow chart of a method of wind control decision according to an embodiment of the present invention;

FIG. 3 is a flow diagram of an exemplary real-time computing process according to an embodiment of the present invention;

FIG. 4 is a flow diagram of an exemplary generate high risk rule flow, according to an embodiment of the present invention;

FIG. 5 is a flow diagram of an exemplary generate risk rating and risk rule flow, according to an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments that can be derived by one of ordinary skill in the art from the embodiments given herein are intended to be within the scope of the present invention.

At present, the payment industry generally adopts an integrated tree model such as logistic regression and GBDT or a deep learning neural network to solve the problem of two-classification when identifying high-risk merchants. To facilitate an understanding of the present invention, these techniques are briefly described as follows:

(1) GBDT + LR algorithm principle

(a) GBDT algorithm

GBDT is one of the ensemble learning Boosting algorithms, which classifies or regresses data by using additive models (i.e., linear combinations of basis functions) and continuously reducing the residual errors generated by the training process.

The GBDT generates a weak classifier through multiple iterations, each iteration generates a weak classifier, and each classifier is trained on the residual error of the last classifier. The requirements for weak classifiers are generally simple enough and are low variance and high variance. Since the training process is to reduce the bias to continuously improve the accuracy of the final classifier, the weak classifier is generally selected as CART TREE (i.e., classification regression TREE). The regression tree depth for each class is not very deep due to the high variance and simplicity requirements described above. The final overall classifier is obtained by weighted summation (i.e. addition model) of the weak classifiers obtained from each training round.

(b) LR algorithm

LR (Logistic Regression) Logistic Regression is a generalized linear model and thus has much in common with multiple linear Regression analysis. They are essentially identical in model form, all with w ' x + b, where w and b are the parameters to be solved, logistic regression maps w ' x + b to a hidden state p, p ═ L (w ' x + b) by a function L, and then the value of the dependent variable is determined according to the size of p and 1-p.

The purpose of LR is a classification model in traditional machine learning, which is very widely used in practice due to the simplicity and efficiency of the algorithm.

(2) Principle of neural network algorithm

The neural network algorithm is a general name of a computer algorithm constructed by simulating a biological neural network and is formed by interconnecting a plurality of artificial neuron nodes (neurons for short). The neurons are connected with each other through synapses, and the strength (weight) of the connection between the neurons is recorded by the synapses. The human brain reacts to various stimuli such as vision, hearing and the like through billions of neurons and trillion synapses, and the learning process is the process that the neurons change the mutual connection mode, so that the human can reasonably react to the stimuli, and the neural network simulates the process of the work of the human brain nerves.

The LR model has the advantages of stability, difficult overfitting and strong interpretability. But the problems are that the model effect is effectively improved, the accuracy is not high, and the discrimination is relatively low. The GBDT model used alone has the advantages of good accuracy and high discrimination during model training, but actually has poor performance after line operation, is easy to overfit, and has poor interpretability. The neural network can greatly improve the accuracy of the model, but a large amount of data is often needed to train the model, some businesses lack a large amount of data in the early development stage, and overfitting is easily generated by using deep learning on a small data set.

The invention (coldnight) provides a wind control decision method of GBDT + LR. Fig. 1 is a flowchart of a wind control decision method according to an embodiment of the present invention. As shown in fig. 1, the wind control decision method may be performed by the following steps S101-S105.

S101, performing feature processing on the features, generating high-order features through the feature processing, training the high-order features by using GBDT to obtain a two-classifier, predicting the high-order features, and constructing new features according to the prediction probability value. Specifically, the leaf node position to which the prediction probability value obtained by calculating each tree in the model belongs may be recorded as 1, and the constructed new feature is the original feature. In some embodiments, the samples may be divided into a training set and a test set, and then the samples in the training set are trained using GBDT to predict the samples in the test set.

At this step, the features may be feature processed to generate higher order features before they are trained using GBDTs. The feature processing may include: missing value filling, null value processing, abnormal value processing, characteristic importance screening and the like.

In this description, the processing at this step may be referred to as automated feature engineering. Feature engineering maximizes the extraction of features from raw data for use by algorithms and models through processing of the raw data, including but not limited to, such as outlier processing, missing value processing, discrete features, feature derivation, etc. Feature engineering is often the most critical step in determining model performance, and the most time-consuming part in machine learning is just feature engineering, and automated feature engineering aims at automatically creating candidate features from a dataset and selecting a number of best features from them for training according to feature importance.

S102, carrying out univariate binning on the original features by using a decision tree;

s103, substituting the GBDT structural characteristics and the characteristics after the decision tree is subjected to binning into an LR model for training to obtain risk scores;

and S104, processing the transaction data into real-time characteristics in real time, and bringing the real-time characteristics into a decision tree model to generate a high-risk rule. In some embodiments, the transaction data may be processed into real-time features using a distributed stream data flow engine Flink. In this description, the processing of this step may be referred to as real-time computing (real computing). The invention discloses a method for calculating a large-volume data stream in real time, which is characterized in that a calculation with low time complexity is calculated in real time, and a Flink distributed stream data stream engine is used for carrying out high-performance and low-delay processing and calculation on the large-volume data stream.

And S105, generating a wind control decision matrix according to the risk score and the high risk rule so as to identify the risk level of the transaction merchant.

According to the technical scheme, on the basis of using GBDT + LR, a high-order characteristic training model is generated by combining a univariate decision tree box and an automatic characteristic engineering, so that the discrimination of the model is improved, and the interpretability of the model is ensured; high-risk rules are automatically generated through a real-time computing technology and combined with an offline model to form a decision matrix, and complex and variable fraudulent behaviors can be found in time.

The invention uses automatic characteristic engineering to reduce the labor cost in the characteristic engineering, applies the GBDT + LR model to the risk commercial tenant identification scene, and forms a decision matrix with real-time high risk rules to output risk scores. On one hand, the discrimination of the offline model is improved and the interpretability of the model is ensured; on the other hand, the real-time high-risk strategy can automatically generate according to real-time data, change of fraudulent transaction behaviors of illegal merchants can be found in time, and risks can be screened more quickly.

Fig. 2 is a flowchart of a wind control decision method according to an embodiment of the present invention. As shown in fig. 2, in this embodiment, the method is generally divided into two relatively independent processes: an online rule detection process and a model offline training process. And processing real-time characteristics by the online rule through a real-time computing platform, automatically generating a high-risk rule by using a decision tree model, and forming a decision matrix with the offline model to finally give the risk rating of the merchant. And (3) performing model offline training in a supervised learning mode, deriving high-order variables by using an automatic characteristic engineering and performing scoring and grading on all traded merchants by using a GBDT + LR improved algorithm training model for calling and verifying an intelligent wind control decision service. The specific embodiment comprises the following steps:

1. model training procedure

1) Sample preparation and pretreatment

Firstly, an automatic feature engineering algorithm package is used for completing the following feature processing:

a) missing value filling: default value filling modes such as default value filling, mean value filling, median filling and the like can be configured;

b) and (4) null value processing: the configurable threshold value rejects the characteristics with null value exceeding X%;

c) abnormal value processing: the configurable parameters adopt extreme value capping processing, missing processing or rejecting and other operations on numerical values of maximum and minimum values (less than 0.05 quantile and more than 0.95 quantile);

d) and (3) screening the feature importance: the configurable parameters cull features whose feature importance is below a threshold.

After the feature processing, fast IV (an algorithm for automatically generating high-order features) high-order feature derivation algorithm packages are used for generating high-order features, and the features with higher IV are provided for subsequent modeling.

2) Model training

a) Dividing the sample into a training set and a testing set;

b) using GBDT to train the processed features to obtain a two-classifier and predict the original data, recording the leaf node position of the prediction probability value obtained by calculating each tree in the model as 1, and constructing a new feature;

c) carrying out univariate binning on the original features by using a decision tree, carrying out correlation test after binning, and removing according to the magnitude of the IV value;

d) and performing WOE conversion on the GBDT structural characteristics and the characteristics subjected to decision tree binning to bring the GBDT structural characteristics and the characteristics into an LR model for training to obtain a final risk score.

The traditional method has the defects that LR or GBDT is used independently in two categories, an LR model is a linear model, the learning capacity is limited, manual prior knowledge or experiments are usually needed to obtain effective combination characteristics, manpower is consumed excessively, GBDT achieves data classification by adopting an addition model (namely linear combination of basis functions) and continuously reducing residual errors generated in a training process, the model is good in effect generally, but overfitting is easy to occur, and the interpretability is poor. The invention uses the GBDT + LR combined model for reference, utilizes the characteristics of the GBDT algorithm to explore the characteristic combination with the discrimination, optimizes the characteristic combination on the basis, synthesizes various methods such as automatic characteristic engineering to automatically generate high-order characteristics, uses a decision tree model to perform univariate binning on the original characteristics, finally brings the high-order characteristics into the LR model to improve the discrimination of the model, ensures the interpretability of the model and reduces the labor cost in the characteristic engineering.

3) Modeling results

The model training results were as follows:

the LR model alone has poor discrimination, high-order features are generated by using automatic feature engineering, single variables are subjected to binning by using a decision tree and then brought into LR, so that the accuracy of the model is improved, and the results of generating a plurality of combined features by combining GBDT are brought into LR, so that the accuracy and the discrimination of the model are improved, as shown in the following table 1.

TABLE 1

AUC (Area under the dark of ROC): namely the area under the ROC curve, an AUC value is a common index for evaluating the quality of the two-classification model, and a higher AUC value generally indicates that the model has better effect.

ROC (receiver operating characteristic curve): in the binary model, a single sample prediction has four outcomes:

true Positive (TP, True Positive): judging the test result to be positive, and actually judging the test result to be positive;

false Positive (FP): judging the sample to be negative, but actually positive;

true Negative (TN, True Negative): judging the sample to be negative, and actually judging the sample to be negative;

false Negative (FN, False Negative): the result was judged to be negative, but actually positive.

These four results can be plotted as a 2 x 2 confusion matrix, as shown in table 2:

TABLE 2

The ROC curve defines the False Positive Rate (FPR) as the X-axis and the True Positive Rate (TPR) as the Y-axis. Wherein:

a) TPR: among all the actually positive samples, the rate of the sample correctly judged to be positive.

b) FPR: among all the samples that were actually negative, the sample rate that was erroneously determined to be positive.

c)TPR＝TP/(TP+FN)

d)FPR＝FP/(FP+TN)

Calculating (X is FPR, Y is TPR) coordinate points according to the real values and the predicted values of all the test set sample points, and finally drawing an ROC curve

KS: the KS curve takes TPR and FPR as vertical coordinates, the sample number as horizontal coordinates, the KS value is Max (TPR-FPR), and the larger KS indicates that the discrimination capability of the model is better.

2. Online rule detection flow

Processing and processing real-time transaction data through a real-time computing technology to generate real-time characteristics, automatically generating high-risk rules by using a decision tree model, generating a wind control decision matrix by combining the scores of an offline model and the high-risk rules, and finally identifying the risk level of a transaction merchant on line.

1) Real-time computing

Real-time computing uses Flink real-time computing power to process transaction data into real-time features in real-time. An exemplary real-time computing process may be as shown in fig. 3.

2) Automatic generation of high-risk rules for decision trees

And substituting the real-time characteristics into the decision tree model to automatically generate high-risk rules. An exemplary generate high risk rule flow may be as shown in fig. 4.

3) Wind control decision matrix

As shown in fig. 5, the generated high risk rules are combined with the offline model to generate a decision matrix, and finally a risk rating and risk rules are generated, as shown in table 3.

TABLE 3

The present invention is not limited to the above preferred embodiments, and any modifications, equivalent substitutions, improvements, etc. within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims (8)

1. A method for wind control decision-making, comprising:

performing feature processing on the features to generate high-order features, training the high-order features by using GBDT to obtain a two-classifier, predicting the high-order features, and constructing new features according to the prediction probability value;

performing univariate binning on the features using a decision tree;

introducing the characteristics constructed by the GBDT and the characteristics subjected to decision tree binning into a logistic regression model for training to obtain a risk score;

processing transaction data into real-time characteristics by using a distributed stream data flow engine (Flink), and bringing the real-time characteristics into a decision tree model to generate a high-risk rule;

and generating a wind control decision matrix according to the risk score and the high risk rule so as to identify the risk level of the transaction merchant.

2. The wind control decision method of claim 1, wherein the feature processing comprises: missing value filling, null value processing, outlier processing and feature importance screening.

3. The wind control decision method of claim 1, wherein constructing the raw features from the predicted probability values comprises:

and recording the leaf node position to which the prediction probability value obtained by calculating each tree in the model belongs as 1, and constructing the new feature.

4. The wind control decision method of claim 1, further comprising:

dividing the sample into a training set and a testing set;

wherein the GBDT is used to train samples in the training set and the prediction is performed on samples in the test set.

5. A wind-controlled decision-making apparatus, comprising:

the characteristic module is used for carrying out characteristic processing on the characteristics, generating high-order characteristics, training the high-order characteristics by using GBDT to obtain a two-classifier, predicting the high-order characteristics and constructing new characteristics according to the prediction probability value;

the binning module is used for carrying out univariate binning on the characteristics by using a decision tree;

the model training module is used for substituting the characteristics of the GBDT structure and the characteristics after the decision tree is subjected to binning into a logistic regression model for training to obtain a risk score;

the real-time characteristic module is used for processing transaction data into real-time characteristics by using a distributed stream data flow engine Flink, and bringing the real-time characteristics into a decision tree model to generate a high risk rule;

and the wind control strategy module is used for generating a wind control decision matrix according to the risk score and the high risk rule so as to identify the risk level of the transaction merchant.

6. The wind control decision device of claim 5, wherein the feature processing comprises: missing value filling, null value processing, outlier processing and feature importance screening.

7. The wind control decision device of claim 5, wherein the characterization module is configured to:

and recording the leaf node position to which the prediction probability value obtained by calculating each tree in the model belongs as 1, and constructing the new feature.

8. The wind control decision device of claim 5, wherein the characterization module is further configured to:

dividing the sample into a training set and a testing set;

wherein the GBDT is used to train samples in the training set and the prediction is performed on samples in the test set.

Images