CN109767326A - Suspicious transaction reporting generation method, device, computer equipment and storage medium - Google Patents
Suspicious transaction reporting generation method, device, computer equipment and storage medium Download PDFInfo
- Publication number
- CN109767326A CN109767326A CN201811560423.3A CN201811560423A CN109767326A CN 109767326 A CN109767326 A CN 109767326A CN 201811560423 A CN201811560423 A CN 201811560423A CN 109767326 A CN109767326 A CN 109767326A
- Authority
- CN
- China
- Prior art keywords
- risk
- transaction
- feature
- sample
- suspicious
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 34
- 239000013598 vector Substances 0.000 claims abstract description 79
- 239000011159 matrix material Substances 0.000 claims abstract description 45
- 238000003062 neural network model Methods 0.000 claims abstract description 29
- 238000012549 training Methods 0.000 claims description 33
- 238000012544 monitoring process Methods 0.000 claims description 32
- 238000004590 computer program Methods 0.000 claims description 19
- 238000013507 mapping Methods 0.000 claims description 17
- 238000012545 processing Methods 0.000 claims description 14
- 238000013528 artificial neural network Methods 0.000 claims description 11
- 230000011218 segmentation Effects 0.000 claims description 6
- 239000000284 extract Substances 0.000 claims description 5
- 210000004218 nerve net Anatomy 0.000 claims description 2
- 238000005406 washing Methods 0.000 description 10
- 238000010586 diagram Methods 0.000 description 6
- 230000000306 recurrent effect Effects 0.000 description 4
- 238000004900 laundering Methods 0.000 description 3
- 210000005036 nerve Anatomy 0.000 description 3
- 230000008901 benefit Effects 0.000 description 2
- 235000013399 edible fruits Nutrition 0.000 description 2
- 239000000203 mixture Substances 0.000 description 2
- 238000012502 risk assessment Methods 0.000 description 2
- 208000001613 Gambling Diseases 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 239000012141 concentrate Substances 0.000 description 1
- 238000012937 correction Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 239000003550 marker Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003252 repetitive effect Effects 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 230000001360 synchronised effect Effects 0.000 description 1
Landscapes
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
This application involves a kind of suspicious transaction reporting generation method, device, computer equipment and the storage mediums of big data field.The described method includes: obtaining transaction data, identify whether the transaction data is suspicious transaction；When the transaction data is suspicious transaction, the corresponding risk classifications of the suspicious transaction are identified；The risk classifications correspond to multiple feature of risk；Calculate the corresponding vector matrix of the multiple feature of risk；Multiple vector matrixs are input to neural network model, suspicious transaction reporting corresponding with the risk classifications is exported by the neural network model.The working efficiency for completing suspicious transaction reporting can be effectively improved using this method.
Description
Technical field
This application involves field of computer technology, more particularly to a kind of suspicious transaction reporting generation method, device, calculating
Machine equipment and storage medium.
Background technique
Money laundering is a kind of behavior that illicit gain legalizes, and belongs to economic crime, is made to the safety and stability of financial system
At threat.Therefore, it is necessary to the work that financial institution actively carries out anti money washing.Financial institution pair transaction relevant to money laundering is supervised
Control, if it find that suspicious transaction needs in time to be reported.On financial institution of giving the correct time need in the form reported to suspicious friendship
Easily it is described.In traditional mode, suspicious transaction reporting is completed by manually.If in face of a large amount of suspicious transaction
Corresponding report is all write by manually, then it is lower to will lead to working efficiency.
Summary of the invention
Based on this, it is necessary in view of the above technical problems, provide a kind of suspicious transaction reporting for effectively improving working efficiency
Generation method, device, computer equipment and storage medium.
A kind of suspicious transaction reporting generation method, which comprises
Transaction data is obtained, identifies whether the transaction data is suspicious transaction；
When the transaction data is suspicious transaction, the corresponding risk classifications of the suspicious transaction are identified；The risk class
Type corresponds to multiple feature of risk；
Calculate the corresponding vector matrix of the multiple feature of risk；
Multiple vector matrixs are input to neural network model, pass through neural network model output and the risk class
The corresponding suspicious transaction reporting of type.
It is described in one of the embodiments, to identify whether the transaction data is suspicious transaction using the feature of risk
Include:
Extract the customer ID in the transaction data and multiple transaction fields；
According to the customer ID, multiple feature fields corresponding with the feature of risk are searched for by big data platform；
Multiple feature fields that the transaction field and the big data platform search are input to monitoring model, are led to
It crosses the monitoring model and carries out suspicious transaction identification；
When identifying the transaction data is suspicious transaction, corresponding early warning event is generated.
The identification suspicious corresponding risk classifications of trading include: in one of the embodiments,
According to the search result of big data platform, code corresponding with the feature of risk is called；
Risk identification is carried out to individual features field using the code of the feature of risk, exports corresponding risk label；
The suspicious corresponding risk classifications of trading according to multiple risk tag recognitions.
In one of the embodiments, the method also includes:
The suspicious transaction reporting of a variety of history is obtained, the suspicious transaction reporting of the history is labeled as sample file；The sample
This document includes multiple sample sentences and risk classifications；
Identify the corresponding feature of risk of the sample sentence；
Obtain reflecting between the corresponding report template of the risk classifications and the report template and the feature of risk
Penetrate relationship；
Generate the corresponding training vector matrix of each sample sentence；
Neural network is trained using the training vector matrix and the mapping relations.
The corresponding training vector matrix of each sample sentence that generates includes: in one of the embodiments,
Subordinate sentence processing is carried out to the sample file, obtains multiple sample sentences；
Word segmentation processing is carried out to the sample sentence, obtains multiple sample words；
Sample word frequency of each sample word in the sample file is counted, calculates each sample using the sample word frequency
The corresponding term vector of this word；
Using the corresponding term vector of sample words multiple in each sample sentence, the corresponding vector of each sample sentence is generated
Matrix.
A kind of suspicious transaction reporting generating means, described device include:
First identification module identifies whether the transaction data is suspicious transaction for obtaining transaction data；
Second identification module, for when the transaction data is suspicious transaction, identifying the corresponding wind of the suspicious transaction
Dangerous type；The risk classifications correspond to multiple feature of risk；
Vector calculating mould is fast, for calculating the corresponding vector matrix of the multiple feature of risk；
Report generation module passes through the neural network mould for multiple vector matrixs to be input to neural network model
Type exports suspicious transaction reporting corresponding with the risk classifications.
First identification module is also used to extract the customer ID in the transaction data in one of the embodiments,
And multiple transaction fields；According to the customer ID, searched for by big data platform corresponding with the feature of risk multiple
Feature field；Multiple feature fields that the transaction field and the big data platform search are input to monitoring model,
Suspicious transaction identification is carried out by the monitoring model；When identifying the transaction data is suspicious transaction, generate corresponding pre-
Alert event.
Described device in one of the embodiments, further include:
The suspicious transaction reporting of the history is labeled as sample for obtaining the suspicious transaction reporting of a variety of history by training module
This document；The sample file includes multiple sample sentences and risk classifications；Identify that the corresponding risk of the sample sentence is special
Sign；The mapping obtained between the corresponding report template of the risk classifications and the report template and the feature of risk is closed
System；Generate the corresponding training vector matrix of each sample sentence；Utilize the training vector matrix and the mapping relations pair
Neural network is trained.
A kind of computer equipment, including memory and processor, the memory are stored with computer program, the processing
Device realizes the step in above-mentioned each embodiment of the method when executing the computer program.
A kind of computer readable storage medium, is stored thereon with computer program, and the computer program is held by processor
The step in above-mentioned each embodiment of the method is realized when row.
Above-mentioned suspicious transaction reporting generation method, device, computer equipment and storage medium are when recognizing transaction data
When suspicious transaction, its corresponding risk classifications is further identified.The report template as used by different risk classifications is different, often
Kind risk classifications include kinds of risks feature, by calculating the corresponding vector matrix of suspicious transaction risk feature, by moment of a vector
Battle array is input to neural network model, and thus, it is possible to make neural network model output suspicious transaction report corresponding with risk classifications
It accuses.To realize the report for being automatically performed suspicious transaction.In this process, it is participated in without artificial, effectively increases work
Efficiency.
Detailed description of the invention
Fig. 1 is the application scenario diagram of suspicious transaction reporting generation method in one embodiment；
Fig. 2 is the flow diagram of suspicious transaction reporting generation method in one embodiment；
Fig. 3 is to identify whether the transaction data is suspicious transaction step using the feature of risk in one embodiment
Flow diagram；
Fig. 4 is the flow diagram of neural network model training step in one embodiment；
Fig. 5 is the structural block diagram of suspicious transaction reporting generating means in one embodiment；
Fig. 6 is the internal structure chart of computer equipment in one embodiment.
Specific embodiment
It is with reference to the accompanying drawings and embodiments, right in order to which the objects, technical solutions and advantages of the application are more clearly understood
The application is further elaborated.It should be appreciated that specific embodiment described herein is only used to explain the application, not
For limiting the application.
Suspicious transaction reporting generation method provided by the present application, can be applied in application environment as shown in Figure 1.Its
In, terminal 102 is communicated by network with server 104.Wherein, terminal 102 can be, but not limited to be various individual calculus
Machine, laptop, smart phone, tablet computer and portable wearable device, server 104 can use independent server
The either server cluster of multiple servers composition is realized.Server 104 obtains transaction data, and whether identification transaction data
For suspicious transaction.When transaction data is suspicious transaction, server 104 further identifies the corresponding risk classifications of suspicious transaction,
Risk classifications correspond to multiple feature of risk.Server 104 obtains in suspicious transaction according to the suspicious feature of risk traded and be related to
Take corresponding transaction field.The spy that server 104 is searched using the corresponding transaction field of feature of risk and big data platform
It levies field and calculates vector matrix.Neural network model has been pre-established on server 104.Server 104 is by multiple vector matrixs
It is input to neural network model, suspicious transaction reporting corresponding with risk classifications is exported by neural network model.Server 104
Suspicious transaction reporting is sent to terminal 102.
In one embodiment, it as shown in Fig. 2, providing a kind of suspicious transaction reporting generation method, applies in this way
It is illustrated for server in Fig. 1, comprising the following steps:
Step 202, transaction data is obtained, whether identification transaction data is suspicious transaction.
Database is deployed on server.After execution, corresponding transaction data can be stored in database for each transaction.
Server can obtain transaction data according to predeterminated frequency in the database, to recognize whether the suspicious friendship of anti money washing
Easily.Server can also monitor database in real time, and when having listened to transaction data deposit database, server is obtained
The transaction data, to identify whether as suspicious transaction.
Monitoring model has been pre-established on server.Monitoring model has multiple feature of risk, basic including client
Information, transaction frequently, the block trade of suspend mode account, transaction amount be more than preset value, transaction address is false, trading account is expired,
Connected transaction has treasury trade etc. with blacklist client.Feature of risk can also be considered as the dimension of monitoring.Different feature of risk
As different dimensions.Each feature of risk all includes multiple feature fields.Wherein, feature field may include transaction field.
Server searches for associated various features field according to customer ID in big data platform.Big data search result with work as
Transaction field in preceding transaction data can be used as the corresponding field of feature of risk.Server is by transaction field and big data
The feature field that platform searches is input to monitoring model, carries out suspicious transaction identification by monitoring model.Wherein, transaction field
Feature of risk can also be corresponded to, i.e. transaction field can belong to the same feature of risk with feature field.When identification transaction data
When for suspicious transaction, corresponding early warning event is generated.
Step 204, when transaction data is suspicious transaction, the corresponding risk classifications of suspicious transaction are identified；Risk classifications pair
Answer multiple feature of risk.
The feature of risk that different suspicious transaction is related to can be different.In the search result of big data platform,
If not including the feature field of some feature of risk, then it represents that suspicious transaction is not directed to the feature of risk.Big data platform
Search result in include the corresponding feature field of some feature of risk, then it represents that suspicious transaction is related to the feature of risk.It can
In the doubtful multiple feature of risk that are related to of trading, the corresponding feature field of each feature of risk be can be different.
When server recognizes suspicious transaction, according to big data search result, can learn involved by suspicious transaction
Feature of risk.Server calls code corresponding with these feature of risk carries out risk analysis.As the corresponding spy of feature of risk
When sign field meets risk rule, server adds corresponding risk label to big data search result.Risk label can be with
Feature of risk is same or like.Due to the different corresponding monitor control index differences of risk model, i.e. corresponding risk label
The risk classifications of suspicious transaction can be recognized accurately according to the corresponding multiple risk labels of suspicious transaction for difference, server.
Step 206, the corresponding vector matrix of multiple feature of risk is calculated.
Server obtains corresponding transaction field according to the suspicious feature of risk traded and be related to.One feature of risk can
With a corresponding transaction field, multiple transaction fields can also be corresponded to.The corresponding transaction field of server by utilizing feature of risk with
And the feature field that big data platform searches calculates vector matrix.Wherein, transaction field includes field name and field value.Big number
It also include field name and field value according to the feature field searched.
Specifically, trained dictionary has been stored in advance in server.It include the corresponding word of multiple trained words in training dictionary
Vector.Wherein, training word may include field name and field value etc..Server can be to the corresponding transaction word of feature of risk
Section and feature field carry out word segmentation processing, obtain multiple words.Server is searched corresponding with feature of risk in training dictionary
Multiple words term vector.For numbers such as time and the amount of money etc., server can use term vector model and calculate its correspondence
Term vector.The corresponding multiple term vectors of each feature of risk of server by utilizing generate corresponding vector matrix.
Step 208, multiple vector matrixs are input to neural network model, pass through neural network model output and risk class
The corresponding suspicious transaction reporting of type.
Neural network model has been pre-established on server.Neural network model can be Recognition with Recurrent Neural Network.The nerve
Network model can first pass through a variety of sample files in advance and be trained.Since suspicious transaction includes a variety of different risk classifications,
Report template corresponding to different risk classifications is different.Therefore, the sample file of server by utilizing difference risk classifications is to nerve
Network is trained in advance.In training, server is according to the risk classifications of suspicious transaction to multiple sentences in report template
Son establishes corresponding mapping relations with kinds of risks feature.Mapping relations between different report templates and feature of risk are not
Together.
The corresponding vector matrix of multiple feature of risk is input to neural network model by server, neural network model according to
The mapping relations of sentence in vector matrix and report template, carry out calculation process, export according to the format of report template corresponding
Suspicious transaction reporting.
In the present embodiment, when recognizing transaction data is suspicious transaction, its corresponding risk classifications is further identified.By
The report template used by different risk classifications is different, and every kind of risk classifications include kinds of risks feature, suspicious by calculating
The corresponding vector matrix of risk feature of trading, is input to neural network model for vector matrix, thus, it is possible to make nerve net
Network model exports suspicious transaction reporting corresponding with risk classifications.To realize the report for being automatically performed suspicious transaction.At this
During a, participated in without artificial, effectively increase working efficiency.
In one embodiment, the step of whether transaction data is suspicious transaction identified using feature of risk, such as Fig. 3 institute
Show, specifically include:
Step 302, customer ID and the multiple transaction fields in transaction data are extracted.
Step 304, according to customer ID, multiple feature fields corresponding with feature of risk are searched for by big data platform.
Step 306, multiple feature fields transaction field and big data platform searched are input to monitoring model, lead to
It crosses monitoring model and carries out suspicious transaction identification.
Step 308, when identifying transaction data is suspicious transaction, corresponding early warning event is generated.
A variety of data relevant to client, including client's essential information, historical trading number are stored in big data platform
It is a variety of according to, connected transaction, reference information and crisis management information etc..It wherein not only include client itself in client's essential information
Essential information further include other staff relevant to client information, be referred to as with client have social relationships personnel
Information.For example, the information of kinsfolk, relatives' information, information of personnel with investment relation etc..In order to ensure big data
Information in platform is effective, and the data in big data platform can also be updated according to specific period.
Monitoring model has been pre-established on server.Monitoring model has multiple feature of risk, basic including client
Information, transaction frequently, the block trade of suspend mode account, transaction amount be more than preset value, transaction address is false, trading account is expired,
Connected transaction has treasury trade etc. with blacklist client.
Server extracts customer ID and multiple transaction fields in transaction data.It include client's mark in transaction data
Knowledge and multiple transaction fields.Transaction field includes type of transaction, transaction amount, exchange hour, trading object etc..Server root
Various features field associated with customer ID is searched in big data platform according to customer ID.It is hereby achieved that with the friendship
The associated a variety of data of easy data, and it is not limited solely to the historical trading data of same client, and it is combined with more dimensions
The data of degree expand the data area for identifying suspicious transaction, so as to effectively improve the accuracy of suspicious transaction identification.
The feature field associated with customer ID and transaction field that search can be input to monitoring by server
Model.Monitoring model calls corresponding anti money washing rule according to transaction field and multiple feature fields, a transaction field or
Feature field can call an anti money washing rule, can also call a plurality of anti money washing rule.Each anti money washing rule is all preparatory
Provided with corresponding score.Monitoring model obtains the corresponding rule of every anti money washing rule according to called anti money washing rule
Score.Monitoring model can add up multinomial regular score, obtain the corresponding monitoring score of transaction data.Monitoring model will
Monitoring score is compared with threshold value, when monitoring score more than threshold value, then transaction data is labeled as suspicious transaction.Work as identification
When transaction data is suspicious transaction, monitoring model carries out early warning to transaction data, exports corresponding early warning event.
Further, each feature of risk can be considered as a dimension, each feature of risk can be pre-arranged
Corresponding weight.Weight between different feature of risk may be the same or different.The different characteristic word of same feature of risk
Section can be set to identical weight.Server by utilizing weight is modified the scoring of each anti money washing rule respectively, will correct
Regular score afterwards adds up, and obtains monitoring score corresponding with transaction data.Since the feature of risk of different dimensions is anti-
Significance level is different in money laundering identification, by being modified to the scoring of anti money washing rule, can be directed to the risk of different dimensions
Feature is adjusted, thus, it is possible to obtain more reasonably monitoring score, so as to more efficiently improve the suspicious friendship of identification
Easy accuracy.
In one embodiment, identify that the corresponding risk classifications of suspicious transaction include: the search knot according to big data platform
Fruit calls code corresponding with feature of risk；Risk identification, output are carried out to individual features field using the code of feature of risk
Corresponding risk label；According to the corresponding risk classifications of the suspicious transaction of multiple risk tag recognitions.
In traditional mode, when carrying out the identification of risk classifications to suspicious transaction, in order to ensure identifying all wind
Dangerous type, server need suspicious transaction being input to the corresponding risk model of every kind of risk classifications, and risk model utilizes each
The feature field of feature of risk is analyzed, and identifies suspicious transaction with the presence or absence of corresponding risk with this.In conventional manner
Risk model is to concentrate in together the code analyzed each feature of risk.And in different risk models, it will usually
It is related to the same or like feature of risk in part.For example, the risk model of the risk model of illegal fund collection, multiple level marketing is being raised funds
Mode, payee, the amount of money etc. are similar.If the code of each risk model is individually write, it will cause more repetitions
The work of property.
In the present embodiment, for the corresponding feature of risk of every kind of risk model, write accordingly according to risk rule respectively
Code, every kind of feature of risk have corresponding risk label.When server recognizes suspicious transaction, is searched for and tied according to big data
Multiple feature fields in fruit call code corresponding with feature of risk to carry out risk analysis.When the corresponding tagged word of feature of risk
When Duan Fuhe risk rule, server adds corresponding risk label to big data search result.Due to different risk models
Corresponding monitor control index is different, i.e., corresponding risk label is different, and server is according to the corresponding multiple risk marks of suspicious transaction
The risk classifications of suspicious transaction can be recognized accurately in label.
In the present embodiment, by carrying out written in code to each monitor control index, the corresponding code of monitor control index can use
Risk identification is carried out to feature field, effectively saves the repetitive operation of written in code.And the code of monitor control index can be with
Original all risk models are covered, after exporting risk label by the code of monitor control index, suspicious transaction can be recognized
Every kind of risk classifications being related to, so as to ensure the comprehensive and accuracy of suspicious Transaction Exposure Type.
In one embodiment, this method further include: the step of neural network model training, as shown in figure 4, specific packet
It includes:
Step 402, the suspicious transaction reporting of a variety of history is obtained, the suspicious transaction reporting of history is labeled as sample file；Sample
This document includes multiple sample sentences and risk classifications.
Step 404, the corresponding feature of risk of identification sample sentence.
Step 406, the mapping obtained between the corresponding report template of risk classifications and report template and feature of risk is closed
System.
Step 408, the corresponding training vector matrix of each sample sentence is generated.
Step 410, neural network is trained using training vector matrix and mapping relations.
The history that the required sample file of neural network model training can be kinds of risks type in the database is suspicious
Transaction reporting.Sample file can write multistage content.It all include multiple sentences in every section of content.It include multiple words in sentence
Language.Server carries out subordinate sentence processing to sample file, obtains multiple sample sentences.Server carries out at participle sample sentence
Reason, obtains multiple sample words.Server by utilizing sample word generates the corresponding training vector matrix of each sample sentence.
Generating the corresponding training vector matrix of each sample sentence in one of the embodiments, includes: to sample file
Subordinate sentence processing is carried out, multiple sample sentences are obtained；Word segmentation processing is carried out to sample sentence, obtains multiple sample words；Statistics is every
Sample word frequency of a sample word in sample file calculates the corresponding term vector of each sample word using sample word frequency；Benefit
With the corresponding term vector of sample words multiple in each sample sentence, the corresponding vector matrix of each sample sentence is generated.
(i.e. each sample word is in all sample words for word frequency of each sample word of server statistics in sample file
In accounting), establish word frequency inverse matrix.Server by utilizing word frequency inverse matrix obtains the corresponding term vector of each sample word.I.e.
Each column in word frequency inverse matrix can extract, as the corresponding term vector of each sample word.Server can use
Multiple sample words and its corresponding term vector establish training dictionary.Server according to multiple sample words in sample sentence,
The term vector that corresponding volume is obtained in training dictionary generates the corresponding vector matrix of sample sentence using multiple term vectors.Service
Device can generate the corresponding vector matrix of each sample sentence in this way, and natural language is thus mapped to vector space.
Server obtains the report template of kinds of risks type, includes: the overview of suspicious transaction, suspicious friendship in report template
The multistages content such as the easy basic condition of main body, the feature of suspicious transaction and background information, preliminary conclusion.All include in every section of content
Multiple sentences.In the report template of different risk classifications, such as in the report templates such as network gambling, illegal fund collection, network multiple level marketing,
Sentence in paragraph can be different.The corresponding vector matrix of sentence and report template are to circulation in server by utilizing sample file
Neural network is trained.
Specifically, in the available sample file of server can the corresponding risk classifications of suspicious transaction, by the risk class
Phenotypic marker is the corresponding risk classifications of sample file.Server carries out subordinate sentence processing for the sample file of different risk classifications,
The corresponding vector matrix of sample sentence is calculated.Server identifies that the sample sentence institute in sample file is right according to risk classifications
The feature field answered establishes the mapping relations between the sentence in feature field and report template.The server by utilizing mapping is closed
System and the corresponding vector matrix of every kind of risk classifications are trained Recognition with Recurrent Neural Network.Recognition with Recurrent Neural Network can be double
To Recognition with Recurrent Neural Network, by calculating forward and the two-way reckoning training that calculates backward.Thus, it is possible to make the mind after training
Through network model according to the format in report template, the context for compareing each sentence exports suspicious transaction reporting.
Further, in order to ensure the content of suspicious transaction reporting is accurate, suspicious friendship is completed in neural network model
Easily after report, suspicious transaction reporting can also be distributed to corresponding staff and checked by server.Specifically, service
Device obtains information of multiple staff, including business scope, professional grade, task amount etc..Server will be according to suspicious transaction
The risk classifications of report and the corresponding relationship of business scope, and according in suspicious transaction reporting risk class and staff
The corresponding relationship of professional grade distributes suspicious transaction reporting to corresponding staff.It is checked by staff, by
This can the problems in the suspicious transaction reporting of timely correction, so that it is guaranteed that the content reported is accurate.
It should be understood that although each step in the flow chart of Fig. 2-4 is successively shown according to the instruction of arrow,
These steps are not that the inevitable sequence according to arrow instruction successively executes.Unless expressly stating otherwise herein, these steps
Execution there is no stringent sequences to limit, these steps can execute in other order.Moreover, at least one in Fig. 2-4
Part steps may include that perhaps these sub-steps of multiple stages or stage are not necessarily in synchronization to multiple sub-steps
Completion is executed, but can be executed at different times, the execution sequence in these sub-steps or stage is also not necessarily successively
It carries out, but can be at least part of the sub-step or stage of other steps or other steps in turn or alternately
It executes.
In one embodiment, as shown in figure 5, providing a kind of suspicious transaction reporting generating means, comprising: the first identification
Module 502, the second identification module 504, vector calculate that mould is fast 506, report generation module 508, in which:
First identification module 502, for obtaining transaction data, whether identification transaction data is suspicious transaction.
Second identification module 504, for when transaction data is suspicious transaction, identifying the corresponding risk class of suspicious transaction
Type；Risk classifications correspond to multiple feature of risk.
Vector calculates mould fast 506, for calculating the corresponding vector matrix of multiple feature of risk.
Report generation module 508 passes through neural network model for multiple vector matrixs to be input to neural network model
Export suspicious transaction reporting corresponding with risk classifications.
In one embodiment, the first identification module is also used to extract the customer ID in transaction data and multiple transaction
Field；According to customer ID, multiple feature fields corresponding with feature of risk are searched for by big data platform；By transaction field with
And multiple feature fields that big data platform searches are input to monitoring model, carry out suspicious transaction identification by monitoring model；
When identifying transaction data is suspicious transaction, corresponding early warning event is generated.
In one embodiment, the second identification module is also used to the search result according to big data platform, calling and risk
The corresponding code of feature；Risk identification is carried out to individual features field using the code of feature of risk, exports corresponding risk mark
Label；According to the corresponding risk classifications of the suspicious transaction of multiple risk tag recognitions.
In one embodiment, device further include: training module will for obtaining the suspicious transaction reporting of a variety of history
The suspicious transaction reporting of history is labeled as sample file；Sample file includes multiple sample sentences and risk classifications；；Identify sample
The corresponding feature of risk of sentence；Obtain reflecting between the corresponding report template of risk classifications and report template and feature of risk
Penetrate relationship；Generate the corresponding training vector matrix of each sample sentence；Using training vector matrix and mapping relations to nerve
Network is trained.
In one embodiment, training module is also used to carry out subordinate sentence processing to sample file, obtains multiple sample sentences；
Word segmentation processing is carried out to sample sentence, obtains multiple sample words；Count sample word of each sample word in sample file
Frequently, the corresponding term vector of each sample word is calculated using sample word frequency；Utilize multiple sample words pair in each sample sentence
The term vector answered generates the corresponding vector matrix of each sample sentence.
Specific restriction about suspicious transaction reporting generating means may refer to generate above for suspicious transaction reporting
The restriction of method, details are not described herein.Modules in above-mentioned suspicious transaction reporting generating means can be fully or partially through
Software, hardware and combinations thereof are realized.Above-mentioned each module can be embedded in the form of hardware or independently of the place in computer equipment
It manages in device, can also be stored in a software form in the memory in computer equipment, in order to which processor calls execution or more
The corresponding operation of modules.
In one embodiment, a kind of computer equipment is provided, which can be server, internal junction
Composition can be as shown in Figure 6.The computer equipment include by system bus connect processor, memory, network interface and
Database.Wherein, the processor of the computer equipment is for providing calculating and control ability.The memory packet of the computer equipment
Include non-volatile memory medium, built-in storage.The non-volatile memory medium is stored with operating system, computer program and data
Library.The built-in storage provides environment for the operation of operating system and computer program in non-volatile memory medium.The calculating
The database of machine equipment is for store transaction data, sample file etc..The network interface of the computer equipment is used for and outside
Terminal passes through network connection communication.To realize a kind of suspicious transaction reporting generation side when the computer program is executed by processor
Method.
It will be understood by those skilled in the art that structure shown in Fig. 6, only part relevant to application scheme is tied
The block diagram of structure does not constitute the restriction for the computer equipment being applied thereon to application scheme, specific computer equipment
It may include perhaps combining certain components or with different component layouts than more or fewer components as shown in the figure.
In one embodiment, a kind of computer readable storage medium is provided, computer program is stored thereon with, is calculated
Machine program performs the steps of when being executed by processor
Transaction data is obtained, whether identification transaction data is suspicious transaction；
When transaction data is suspicious transaction, the corresponding risk classifications of suspicious transaction are identified；Risk classifications correspond to multiple wind
Dangerous feature；
Calculate the corresponding vector matrix of multiple feature of risk；
Multiple vector matrixs are input to neural network model, are exported by neural network model corresponding with risk classifications
Suspicious transaction reporting.
In one embodiment, it is also performed the steps of when computer program is executed by processor
Extract the customer ID in transaction data and multiple transaction fields；
According to customer ID, multiple feature fields corresponding with feature of risk are searched for by big data platform；
Multiple feature fields that transaction field and big data platform are searched are input to monitoring model, by monitoring mould
Type carries out suspicious transaction identification；
When identifying transaction data is suspicious transaction, corresponding early warning event is generated.
In one embodiment, it is also performed the steps of when computer program is executed by processor
According to the search result of big data platform, code corresponding with feature of risk is called；
Risk identification is carried out to individual features field using the code of feature of risk, exports corresponding risk label；
According to the corresponding risk classifications of the suspicious transaction of multiple risk tag recognitions.
In one embodiment, it is also performed the steps of when computer program is executed by processor
The suspicious transaction reporting of a variety of history is obtained, the suspicious transaction reporting of history is labeled as sample file；Sample file packet
Include multiple sample sentences and risk classifications；
Identify the corresponding feature of risk of sample sentence；
Obtain the mapping relations between the corresponding report template of risk classifications and report template and feature of risk；
Generate the corresponding training vector matrix of each sample sentence；
Neural network is trained using training vector matrix and mapping relations.
In one embodiment, it is also performed the steps of when computer program is executed by processor
Subordinate sentence processing is carried out to sample file, obtains multiple sample sentences；
Word segmentation processing is carried out to sample sentence, obtains multiple sample words；
Sample word frequency of each sample word in sample file is counted, calculates each sample word pair using sample word frequency
The term vector answered；
Using the corresponding term vector of sample words multiple in each sample sentence, the corresponding vector of each sample sentence is generated
Matrix.
Those of ordinary skill in the art will appreciate that realizing all or part of the process in above-described embodiment method, being can be with
Relevant hardware is instructed to complete by computer program, the computer program can be stored in a non-volatile computer
In read/write memory medium, the computer program is when being executed, it may include such as the process of the embodiment of above-mentioned each method.Wherein,
To any reference of memory, storage, database or other media used in each embodiment provided herein,
Including non-volatile and/or volatile memory.Nonvolatile memory may include read-only memory (ROM), programming ROM
(PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM) or flash memory.Volatile memory may include
Random access memory (RAM) or external cache.By way of illustration and not limitation, RAM is available in many forms,
Such as static state RAM (SRAM), dynamic ram (DRAM), synchronous dram (SDRAM), double data rate sdram (DDRSDRAM), enhancing
Type SDRAM (ESDRAM), synchronization link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM
(RDRAM), direct memory bus dynamic ram (DRDRAM) and memory bus dynamic ram (RDRAM) etc..
Each technical characteristic of above embodiments can be combined arbitrarily, for simplicity of description, not to above-described embodiment
In each technical characteristic it is all possible combination be all described, as long as however, the combination of these technical characteristics be not present lance
Shield all should be considered as described in this specification.
The several embodiments of the application above described embodiment only expresses, the description thereof is more specific and detailed, but simultaneously
It cannot therefore be construed as limiting the scope of the patent.It should be pointed out that coming for those of ordinary skill in the art
It says, without departing from the concept of this application, various modifications and improvements can be made, these belong to the protection of the application
Range.Therefore, the scope of protection shall be subject to the appended claims for the application patent.
Claims (10)
1. a kind of suspicious transaction reporting generation method, which comprises
Transaction data is obtained, identifies whether the transaction data is suspicious transaction；
When the transaction data is suspicious transaction, the corresponding risk classifications of the suspicious transaction are identified；The risk classifications pair
Answer multiple feature of risk；
Calculate the corresponding vector matrix of the multiple feature of risk；
Multiple vector matrixs are input to neural network model, pass through neural network model output and the risk classifications pair
The suspicious transaction reporting answered.
2. the method according to claim 1, wherein described identify the transaction data using the feature of risk
It whether is that suspicious transaction includes:
Extract the customer ID in the transaction data and multiple transaction fields；
According to the customer ID, multiple feature fields corresponding with the feature of risk are searched for by big data platform；
Multiple feature fields that the transaction field and the big data platform search are input to monitoring model, pass through institute
It states monitoring model and carries out suspicious transaction identification；
When identifying the transaction data is suspicious transaction, corresponding early warning event is generated.
3. according to the method described in claim 2, it is characterized in that, the identification suspicious corresponding risk classifications packet of trading
It includes:
According to the search result of big data platform, code corresponding with the feature of risk is called；
Risk identification is carried out to individual features field using the code of the feature of risk, exports corresponding risk label；
The suspicious corresponding risk classifications of trading according to multiple risk tag recognitions.
4. method according to any one of claims 1 to 3, which is characterized in that the method also includes:
The suspicious transaction reporting of a variety of history is obtained, the suspicious transaction reporting of the history is labeled as sample file；The sample text
Part includes multiple sample sentences and risk classifications；
Identify the corresponding feature of risk of the sample sentence；
The mapping obtained between the corresponding report template of the risk classifications and the report template and the feature of risk is closed
System；
Generate the corresponding training vector matrix of each sample sentence；
Neural network is trained using the training vector matrix and the mapping relations.
5. according to the method described in claim 4, it is characterized in that, described generate the corresponding training vector square of each sample sentence
Battle array include:
Subordinate sentence processing is carried out to the sample file, obtains multiple sample sentences；
Word segmentation processing is carried out to the sample sentence, obtains multiple sample words；
Sample word frequency of each sample word in the sample file is counted, calculates each sample word using the sample word frequency
The corresponding term vector of language；
Using the corresponding term vector of sample words multiple in each sample sentence, the corresponding moment of a vector of each sample sentence is generated
Battle array.
6. a kind of suspicious transaction reporting generating means, which is characterized in that described device includes:
First identification module identifies whether the transaction data is suspicious transaction for obtaining transaction data；
Second identification module, for when the transaction data is suspicious transaction, identifying the corresponding risk class of the suspicious transaction
Type；The risk classifications correspond to multiple feature of risk；
Vector calculating mould is fast, for calculating the corresponding vector matrix of the multiple feature of risk；
Report generation module, it is defeated by the neural network model for multiple vector matrixs to be input to neural network model
Suspicious transaction reporting corresponding with the risk classifications out.
7. device according to claim 6, which is characterized in that first identification module is also used to extract the number of deals
Customer ID and multiple transaction fields in；According to the customer ID, pass through big data platform search and the risk
The corresponding multiple feature fields of feature；Multiple feature fields that the transaction field and the big data platform are searched are defeated
Enter to monitoring model, suspicious transaction identification is carried out by the monitoring model；When identifying the transaction data is suspicious transaction,
Generate corresponding early warning event.
8. device according to claim 6, which is characterized in that described device further include:
Training module, for obtaining the suspicious transaction reporting of a variety of history, by the suspicious transaction reporting of the history labeled as sample text
Part；The sample file includes multiple sample sentences and risk classifications；Identify the corresponding feature of risk of the sample sentence；It obtains
Take the mapping relations between the corresponding report template of the risk classifications and the report template and the feature of risk；It is raw
At the corresponding training vector matrix of each sample sentence；Using the training vector matrix and the mapping relations to nerve net
Network is trained.
9. a kind of computer equipment, including memory and processor, the memory is stored with computer program, and sign is,
The step of processor realizes any one of claims 1 to 5 the method when executing the computer program.
10. a kind of computer readable storage medium, is stored thereon with computer program, which is characterized in that the computer program
The step of method described in any one of claims 1 to 5 is realized when being executed by processor.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811560423.3A CN109767326A (en) | 2018-12-20 | 2018-12-20 | Suspicious transaction reporting generation method, device, computer equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811560423.3A CN109767326A (en) | 2018-12-20 | 2018-12-20 | Suspicious transaction reporting generation method, device, computer equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109767326A true CN109767326A (en) | 2019-05-17 |
Family
ID=66451412
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811560423.3A Pending CN109767326A (en) | 2018-12-20 | 2018-12-20 | Suspicious transaction reporting generation method, device, computer equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109767326A (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110956445A (en) * | 2019-11-18 | 2020-04-03 | 支付宝(杭州)信息技术有限公司 | Method and device for generating risk file |
| CN111476664A (en) * | 2020-05-04 | 2020-07-31 | 武汉众邦银行股份有限公司 | Risk perception and risk prediction method based on real-time data flow |
| CN111582886A (en) * | 2020-05-07 | 2020-08-25 | 支付宝(杭州)信息技术有限公司 | False resource transfer identification method, device, equipment and medium |
| CN111738848A (en) * | 2020-05-19 | 2020-10-02 | 深圳追一科技有限公司 | Feature data generation method and device, computer equipment and storage medium |
| CN113256121A (en) * | 2021-05-26 | 2021-08-13 | 杭州云象网络技术有限公司 | Artificial intelligent money laundering method and system |
| CN114662453A (en) * | 2020-12-23 | 2022-06-24 | 腾讯科技（深圳）有限公司 | Message generation method and device, computer equipment and storage medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107085812A (en) * | 2016-12-06 | 2017-08-22 | 雷盈企业管理（上海）有限公司 | The anti money washing system and method for block chain digital asset |
| US20180033006A1 (en) * | 2016-07-27 | 2018-02-01 | Intuit Inc. | Method and system for identifying and addressing potential fictitious business entity-based fraud |
| CN108536678A (en) * | 2018-04-12 | 2018-09-14 | 腾讯科技（深圳）有限公司 | Text key message extracting method, device, computer equipment and storage medium |
| CN108563782A (en) * | 2018-04-25 | 2018-09-21 | 平安科技（深圳）有限公司 | Merchandise news format processing method, device, computer equipment and storage medium |
| CN108876600A (en) * | 2018-08-20 | 2018-11-23 | 平安科技（深圳）有限公司 | Warning information method for pushing, device, computer equipment and medium |
-
2018
- 2018-12-20 CN CN201811560423.3A patent/CN109767326A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180033006A1 (en) * | 2016-07-27 | 2018-02-01 | Intuit Inc. | Method and system for identifying and addressing potential fictitious business entity-based fraud |
| CN107085812A (en) * | 2016-12-06 | 2017-08-22 | 雷盈企业管理（上海）有限公司 | The anti money washing system and method for block chain digital asset |
| CN108536678A (en) * | 2018-04-12 | 2018-09-14 | 腾讯科技（深圳）有限公司 | Text key message extracting method, device, computer equipment and storage medium |
| CN108563782A (en) * | 2018-04-25 | 2018-09-21 | 平安科技（深圳）有限公司 | Merchandise news format processing method, device, computer equipment and storage medium |
| CN108876600A (en) * | 2018-08-20 | 2018-11-23 | 平安科技（深圳）有限公司 | Warning information method for pushing, device, computer equipment and medium |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110956445A (en) * | 2019-11-18 | 2020-04-03 | 支付宝(杭州)信息技术有限公司 | Method and device for generating risk file |
| CN110956445B (en) * | 2019-11-18 | 2023-03-10 | 支付宝(杭州)信息技术有限公司 | Method and device for generating risk file |
| CN111476664A (en) * | 2020-05-04 | 2020-07-31 | 武汉众邦银行股份有限公司 | Risk perception and risk prediction method based on real-time data flow |
| CN111582886A (en) * | 2020-05-07 | 2020-08-25 | 支付宝(杭州)信息技术有限公司 | False resource transfer identification method, device, equipment and medium |
| CN111738848A (en) * | 2020-05-19 | 2020-10-02 | 深圳追一科技有限公司 | Feature data generation method and device, computer equipment and storage medium |
| CN111738848B (en) * | 2020-05-19 | 2024-03-19 | 深圳追一科技有限公司 | Method, device, computer equipment and storage medium for generating characteristic data |
| CN114662453A (en) * | 2020-12-23 | 2022-06-24 | 腾讯科技（深圳）有限公司 | Message generation method and device, computer equipment and storage medium |
| CN113256121A (en) * | 2021-05-26 | 2021-08-13 | 杭州云象网络技术有限公司 | Artificial intelligent money laundering method and system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109767326A (en) | Suspicious transaction reporting generation method, device, computer equipment and storage medium | |
| CN109767322A (en) | Suspicious transaction analysis method, apparatus and computer equipment based on big data | |
| WO2020253358A1 (en) | Service data risk control analysis processing method, apparatus and computer device | |
| CN109523153A (en) | Acquisition methods, device, computer equipment and the storage medium of illegal fund collection enterprise | |
| CN108876133B (en) | Risk assessment processing method, device, server and medium based on business information | |
| CN109858737B (en) | Grading model adjustment method and device based on model deployment and computer equipment | |
| CN110704633A (en) | Named entity recognition method and device, computer equipment and storage medium | |
| CN110489520A (en) | Event-handling method, device, equipment and the storage medium of knowledge based map | |
| CN109886554B (en) | Illegal behavior discrimination method, device, computer equipment and storage medium | |
| CN109657918A (en) | Method for prewarning risk, device and the computer equipment of association assessment object | |
| CN110489561A (en) | Knowledge mapping construction method, device, computer equipment and storage medium | |
| CN108876600A (en) | Warning information method for pushing, device, computer equipment and medium | |
| CN110490720A (en) | Financial data analysis and early warning method, apparatus, computer equipment and storage medium | |
| CN109636607A (en) | Business data processing method, device and computer equipment based on model deployment | |
| CN109829629A (en) | Generation method, device, computer equipment and the storage medium of risk analysis reports | |
| CN109816503A (en) | Financial details data creation method, device, computer equipment and storage medium | |
| CN109903045B (en) | Behavior track monitoring method, device, computer equipment and medium | |
| CN109801151A (en) | Financial fraud risk monitoring and control method, apparatus, computer equipment and storage medium | |
| CN109063921A (en) | Optimized treatment method, device, computer equipment and the medium of customer risk early warning | |
| CN109767226A (en) | Suspicious transaction statistical views generation method and device based on big data | |
| CN110442713A (en) | Abstract generation method, apparatus, computer equipment and storage medium | |
| CN109583682A (en) | Recognition methods, device and the computer equipment of business finance fraud risk | |
| CN111861729A (en) | Behavior scoring system and method based on lstm | |
| CN113052703A (en) | Transaction risk early warning method and device | |
| CN109711301A (en) | Driver's checking method, device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |