CN110334814B

CN110334814B - Method and system for constructing risk control model

Info

Publication number: CN110334814B
Application number: CN201910587071.9A
Authority: CN
Inventors: 金宏; 王维强; 赵闻飙
Original assignee: Advanced New Technologies Co Ltd
Current assignee: Advanced New Technologies Co Ltd; Advantageous New Technologies Co Ltd
Priority date: 2019-07-01
Filing date: 2019-07-01
Publication date: 2023-05-02
Anticipated expiration: 2039-07-01
Also published as: CN110334814A

Abstract

The present disclosure provides a method for efficiently building a risk control model, comprising: constructing a basic model library to select models in the basic model library when a new service is triggered to construct a default model; constructing a new model suitable for new business through automatic feature generation, automatic feature selection and automatic parameter adjustment; training a default model and a new model via transfer learning; automatically fusing the trained default model and the trained new model to generate a fused model; using the trained default model as an online model and using the trained new model and the fusion model as a backup model; and replacing the on-line model with the backup model when one of the backup models is better than the on-line model.

Description

Method and system for constructing risk control model

Technical Field

The present disclosure relates generally to risk control, and more particularly to risk control models.

Background

Risk control for internet finance involves transaction and funds risk prevention and control including theft, fraud, marketing cheating, spam registration identification, decision making, etc.

Taking a scenario that a mobile phone APP is used for payment at a supermarket cash desk as an example, a risk control system needs to check whether a mobile phone account is stolen, whether fraud is deceptively made, whether illegal cash is registered or not, and the like. In practice, different risk types can present different challenges to the construction and updating of models.

Currently, risk control models mainly encounter two relatively large problems in the process of development and deployment.

One problem is that the newly built model is complex in flow, and a great deal of manpower is consumed in data cleaning, model training and model deployment, so that on average, the time for developing and deploying a model is more than 1 month. This results in a slower model response speed for new traffic.

Another problem is that the model iteration period is long, and the updating of the whole model requires a lot of manpower and time to retrain and deploy. This results in a relatively poor risk countermeasure because the risk is not changing from time to time and is very resistant.

The field needs a high-efficiency method and a high-efficiency system for constructing a risk control model, and the method and the system can be used for quickly uploading the model to a new site and a new scene, so that a foundation is laid for quickly updating the risk and iterating the model for time change.

Disclosure of Invention

In order to solve the technical problems, the present disclosure provides an efficient solution for constructing a risk control model.

In one embodiment of the present disclosure, a method for efficiently building a risk control model is provided, comprising: constructing a basic model library to select models in the basic model library when a new service is triggered to construct a default model; constructing a new model suitable for new business through automatic feature generation, automatic feature selection and automatic parameter adjustment; training a default model and a new model via transfer learning; automatically fusing the trained default model and the trained new model to generate a fused model; using the trained default model as an online model and using the trained new model and the fusion model as a backup model; and replacing the on-line model with the backup model when one of the backup models is better than the on-line model.

In another embodiment of the present disclosure, building the default model further comprises: extracting a risk module for each scene; constructing a basic model aiming at each risk module, and constructing a basic model library based on the basic model; when a new service is triggered, selecting a corresponding basic model in a basic model library; and constructing a default model suitable for the new service by using the corresponding basic model.

In yet another embodiment of the present disclosure, the refined risk modules include active, passive, device, environment, behavior, relationship, conflict, mutation, and FTG (Fraud to Gross).

In another embodiment of the present disclosure, building the new model further comprises: acquiring an original variable pool; automatically generating different types of features based on the original variables in the original variable pool; selecting a variable suitable for a scene from the original variable pool and the automatically generated characteristics to generate a variable list; automatically adjusting parameters according to the variable list; and acquiring a new model suitable for the scene.

In yet another embodiment of the present disclosure, automatic feature generation includes converting, computing, and aggregating the original features to generate new candidate features.

In another embodiment of the present disclosure, automatic feature selection involves feature subset search and feature subset evaluation.

In yet another embodiment of the present disclosure, the automatic tuning employs one of a grid search, a random search, and a bayesian optimization.

In one embodiment of the present disclosure, a system for efficiently building a risk control model is provided, comprising: a default model building module that builds a base model library to select models in the base model library to build default models when a new service is triggered; a new model construction module for constructing a new model suitable for a new service through automatic feature generation, automatic feature selection and automatic parameter adjustment; a model training module that trains a default model and a new model via transfer learning; a fusion model generation module that automatically fuses the trained default model and the trained new model to generate a fusion model; an optimal model selection module that uses the trained default model as an online model and uses the trained new model and the fusion model as backup models, and replaces the online model with one of the backup models when the backup model is superior to the online model.

In another embodiment of the present disclosure, the default model building module further: extracting a risk module for each scene; constructing a basic model aiming at each risk module, and constructing a basic model library based on the basic model; when a new service is triggered, selecting a corresponding basic model in a basic model library; and constructing a default model suitable for the new service by using the corresponding basic model.

In yet another embodiment of the present disclosure, the refined risk modules may include active, passive, device, environment, behavior, relationship, conflict, mutation, and FTG (Fraud to Gross).

In another embodiment of the present disclosure, the new model building module further: acquiring an original variable pool; automatically generating different types of features based on the original variables in the original variable pool; selecting a variable suitable for a scene from the original variable pool and the automatically generated characteristics to generate a variable list; automatically adjusting parameters according to the variable list; and acquiring a new model suitable for the scene.

In yet another embodiment of the present disclosure, the new model building module performs automatic feature generation including converting, computing, and aggregating the original features to generate new candidate features.

In another embodiment of the present disclosure, the automatic feature selection by the new model building module involves feature subset search and feature subset evaluation.

In yet another embodiment of the present disclosure, the new model building module performs one of a mesh search, a stochastic search, and a bayesian optimization for automatic tuning.

In one embodiment of the present disclosure, a computer-readable storage medium is provided having stored thereon instructions that, when executed, cause a machine to perform a method as previously described.

This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

Drawings

The foregoing summary of the disclosure and the following detailed description will be better understood when read in conjunction with the accompanying drawings. It is to be noted that the drawings are merely examples of the claimed invention. In the drawings, like reference numbers indicate identical or similar elements.

FIG. 1 illustrates a flow chart of a method for efficiently building a risk control model in accordance with an embodiment of the present disclosure;

FIG. 2 illustrates a schematic diagram of a method for efficiently building a risk control model in accordance with an embodiment of the present disclosure;

FIG. 3 illustrates a flow chart of a process for building a default model according to an embodiment of the present disclosure;

FIG. 4 shows a schematic diagram of a process for building a default model according to an embodiment of the present disclosure;

FIG. 5 illustrates a flow chart of a process for automatically building a new model according to an embodiment of the present disclosure;

FIG. 6 shows a schematic diagram of a process for automatically building a new model according to another embodiment of the present disclosure;

FIG. 7 illustrates a block diagram of a system for efficiently building a risk control model in accordance with an embodiment of the present disclosure;

FIG. 8 illustrates a flowchart of a method for efficiently updating a risk control model in accordance with an embodiment of the present disclosure;

FIG. 9 illustrates a schematic diagram of a method for efficiently updating a risk control model in accordance with an embodiment of the present disclosure;

fig. 10 illustrates a block diagram of a system for efficiently updating a risk control model in accordance with an embodiment of the present disclosure.

Detailed Description

In order to make the above objects, features and advantages of the present disclosure more comprehensible, embodiments accompanied with figures are described in detail below.

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure, but the present disclosure may be practiced otherwise than as described herein, and thus the present disclosure is not limited to the specific embodiments disclosed below.

Risk control for internet finance involves transaction and fund risk prevention and control. Mobile payment, while bringing people with a convenient life, also faces the unprecedented challenges of network fraud. Hereinafter, the present disclosure will describe how to efficiently construct a risk control model to prevent network fraud, taking network fraud as an example. Those skilled in the art will appreciate that the risk control model constructed in the present disclosure is not limited to use for controlling network fraud, but may be widely used for risk control of various types of transactions and funding risks.

The present disclosure proposes a scheme for efficiently constructing a risk control model. Aiming at the problems that the flow of a newly built model in the current field is complex, and a large amount of manpower is required for data cleaning, model training and model deployment, the technical scheme of the present disclosure is based on basic model construction, automatic model construction and fusion model generation, and a model with continuously increased risk feature mining and optimization algorithm iteration is efficiently constructed through real-time competition of an online model and a backup model.

The present disclosure also proposes a scheme for efficiently updating a risk control model. According to the scheme, the rapid updating and iteration of the model can be realized aiming at the risks of time variation, the self-adaptive capacity of the model is greatly improved, and the prevention and control capacity of risks is improved. Meanwhile, the periods of model training and deployment are greatly shortened by automatic refitting (refit), automatic retraining (retrain), online learning (online learning) and the like, and the efficiency of model development is improved.

Therefore, the technical solution of the present disclosure not only provides a general technical framework and solution, but also provides a model capability for adapting to different stages of service development.

Methods and systems for efficiently constructing a risk control model according to various embodiments of the present disclosure will be described in detail below based on the accompanying drawings.

Method for efficiently constructing risk control model

Fig. 1 illustrates a flow chart of a method 100 for efficiently building a risk control model in accordance with an embodiment of the present disclosure.

At 102, a base model library is built to select models in the base model library to build default models when a new service is triggered.

In the course of risk control, a number of risk modules may be refined, including active, passive, devices, environments, behaviors, relationships, conflicts, abrupt changes, FTG (Fraud to Gross), and so forth. These risk modules are actually characterized as variables, which can be divided into: a historical information summary class variable (variability class); derivative class variables including individual mutation and population probability; and relationship class variables, etc.

Taking account transfer as an example, two subjects involved are a payment account and a collection account. In the wind control event, besides the account transaction behavior, the operation behavior of the account, the log and other information are included, wherein the behavior of the paying account as an active party comprises paying, densification, friend adding, head changing and the like, and the behavior of the collecting account as a passive party comprises collecting, reported, friend adding and the like. For a transfer transaction, sequence mining analysis can be performed based on the behavior of a expenditure account and the behavior of a collection account, mining of different long and short time windows is performed according to the short-term behavior and the historical long-term behavior of the account, and abnormal behavior sequences of the account are identified, so that fraud prevention and control are improved.

For each risk module or variable, a different base model may be built, thereby building a base model library. For example, for an active party in the identity variables, a basic model of account maturity, information disclosure population, easy-to-steal population, security crowd and the like can be constructed based on a user gray list, transaction history information and the like. For behaviors, basic models of account operation behaviors, verification interaction behaviors, scene transfer behaviors, fund circulation behaviors and the like can be constructed based on short-term behaviors and historical long-term behaviors of the account. Aiming at the equipment, basic models such as abnormal login equipment, abnormal operation equipment, abnormal tampering equipment, running Trojan horse equipment and the like can be constructed. Similarly, for addresses, basic models such as an abnormal login address, an abnormal operation address, an abnormal tampering address, a false address and the like can be constructed. For the relationship, a basic model of relationship with each other, relationship with a scene, relationship with content, relationship with a position and the like can be constructed.

Those skilled in the art will appreciate that different base models may be constructed for different risk modules or variables according to different types thereof, and will not be described in detail herein.

When a new service or new site is triggered, the models in the base model library can be freely selected based on the base model library, and the default model suitable for the service/site can be automatically built. In building the default model, what is involved is actually a multiple variable merge modeling. Those skilled in the art will appreciate that for different businesses or sites, different models in the base model library may be selected to perform the merged modeling of different variables.

The process of building the default model according to an embodiment of the present disclosure will be described in detail below with reference to fig. 3 and 4.

At 104, a new model is built for the new business by automatic feature generation, automatic feature selection, and automatic tuning.

When a new model is automatically constructed, different variables can be automatically learned or characterized through feature engineering.

Automatic feature generation is the automatic construction of candidate features related to a target task based on a dataset, typically converting time and relational datasets into a feature matrix that can be used for machine learning.

Since the feature dimension of the collected data is not large, and the directly collected features cannot fully embody all information of the data, new meanings need to be found through combination of the existing data, and therefore feature derivation needs to be performed in combination with service requirements, namely, certain combination is performed on the existing features to generate new features with meanings, so that corresponding feature quantities are increased, and valuable features are mined and an optimal model is obtained.

Of course, sometimes, dimension reduction processing may be required due to excessive features, and feature commonalities are generally extracted from numerous features, so that modeling is facilitated.

The feature-derived operations in automatic feature generation are divided into conversion, computation and aggregation, i.e., conversion, computation and aggregation of the original features to generate new candidate features. For example, a single variable is subjected to basic transformations, such as by log transformation of the single variable, and so on. As another example, the variables are derived by adding a time dimension, such as 6 month transaction data, and the like. For another example, an operation on multiple variables, such as two variables add, multiply, or other operations. Of course, those skilled in the art will appreciate that the manner in which the features are derived is varied and, in particular, the corresponding processing is based on the needs of the business scenario.

Different means may be employed to obtain features for different variables. For example, for text variables, a Capsule Network (Capsule or vector neuron Network, hereinafter Capsule Network) algorithm may be used to obtain features; for sequence variables, LSTM (long short term memory network) may be used to obtain features; for historical information summary class (variability) variables, genetic algorithms and reinforcement learning may be used to obtain features; while FTRL (Follow The Regularized Leader) may be used for feature combinations for variable combinations (variable combination).

For text variables, the capsule network replaces single neuron nodes of the traditional neural network with neuron vectors, and trains the brand new neural network in a dynamic routing mode; it can intelligently generate features for partial and full (part-wide) relationships, automatically generalizing learned knowledge into different new scenarios. That is, the capsule network introduces new structural blocks to better express the layering relationship among the various features, namely, the capsule network has translational invariance (instead of translational invariance) and can identify the relative positions or the relative relationships among the different features, so that the capsule network can be widely generalized by using less data.

The LSTM network has a chain structure as a special RNN, and can learn long-term dependency and store long-term information, and is therefore suitable for acquiring characteristics of sequence variables.

For historical information summary class variables, genetic algorithms and reinforcement learning may be employed to obtain features. Both genetic algorithms and reinforcement learning are search methods that can be used to efficiently search the encoded feature space through selection, crossover and mutation genetic operations, targeting all individuals in a population, in the hope of quickly and accurately finding candidate features that are tailored to business needs.

FTRL (Follow The Regularized Leader) actually gives the model the capability of capturing the characteristic change on the line in real time, thereby laying a foundation for breaking through the limitation of fixed dimension and realizing the dynamic addition and deletion of the characteristic.

Those skilled in the art will appreciate that the feature generation or acquisition for different variables may be performed using different methods, and will not be described in detail herein.

Automatic feature selection for automatically generated features as well as for original features is generally considered in two ways:

whether the feature diverges: if a feature does not diverge, e.g., the variance is close to 0, that is, the sample has substantially no difference in that feature, this feature is not useful for distinguishing samples.

Correlation of features with targets: features that have high relevance to the target should preferably be selected.

In practice, both aspects above can be measured by the importance of the acquisition feature (i.e., feature Importance). For example, features_importants of a Light GBM may be measured by the number of splits of a feature or the gain after splitting with that feature. In general, the order of feature importance obtained by different metrics may vary. Features can be cross-selected by a variety of evaluation criteria, such as Permutation Importance and K-Fold Feature Importance.

In the Permutation Importance method, if a feature is set as a random number, the model effect is greatly reduced, which indicates that the feature is important; and vice versa. And in the K-Fold Feature Importance method, the characteristics are selected through K-Fold cross validation, and the prediction effect of different characteristic combinations on the model is compared.

The key links involved in automatic feature selection are feature subset search and feature subset evaluation. The feature selection method can be obtained by combining a feature subset search mechanism and a feature subset evaluation mechanism. The feature selection can be used for reducing the feature quantity and dimension, so that the generalization capability of the model is stronger, and the overfitting is reduced; and enhancing understanding between features and feature values. By automatic feature selection, the most efficient list of variables for a certain scenario/risk can be selected from the existing variable pool plus automatically generated features.

After feature selection is completed, automatic tuning (i.e., automatic tuning of parameters) is required. Parameters are further divided into model parameters and superparameters. Model parameters are parameters that the model used learns from the distribution of training data, which do not require human prior experience. The super-parameters are parameters whose values are set before the learning process is started, and are not parameter data obtained by training. In general, the super parameters need to be optimized, and a group of optimal super parameters is selected for the model so as to improve learning performance and effect. In general, the common super-parameter tuning method includes: grid search, random search, and bayesian optimization. In one embodiment of the present disclosure, bayesian optimization is employed for automatic tuning of parameters. Those skilled in the art will appreciate that other parameter tuning methods may alternatively be used, and will not be described in detail herein.

Thus, by automatic feature generation, automatic feature selection and automatic parameter tuning, a new model suitable for a new service can be constructed.

The process of constructing a new model according to an embodiment of the present disclosure will be described in detail with reference to fig. 5 and 6.

At 106, the default model and the new model are trained via transfer learning.

There is an interesting linear positive correlation between the scale of the model and the amount of training data required by the model. In general, the model should be large enough to adequately capture the connections between different parts of the data (e.g., textures and shapes in the image) and detailed information of the problem to be solved (e.g., the number of classifications). The hierarchy of model fronts is typically used to capture high-level associations of input data (e.g., image edges and subjects, etc.). The hierarchy of the model backend is typically used to capture information that helps make the final decision (typically detailed information that is used to distinguish the target output). Thus, the higher the complexity of the problem to be solved (e.g., image classification, etc.), the greater the number of parameters and the amount of training data required.

In most cases, it is not possible to find sufficiently sufficient training data in the face of a particular problem in a certain field. However, models trained from other data sources can be reused in similar fields through certain modifications and improvements due to the transfer learning technology. Transfer learning can be understood as defining a plurality of source domains (source domains) and one target domain (target domains), learning at the source domains, and transferring the learned knowledge to the target domains, thereby improving the learning effect (or performance) of the target domains.

The basic idea of transfer learning is to use a pre-trained model, i.e. a model that has been trained by means of an off-the-shelf data set. The developer needs to find a hierarchy in the pre-training model that can output reusable features and then use the output of the hierarchy as input features to train smaller scale neural networks that require fewer parameters. Because the pre-training model has learned the organization pattern (pattern) of the data previously, this smaller scale network only needs to learn specific links in the data for specific problems.

The advantages of the transfer learning are not limited to the reduction of the size of the training data, but the over fitting (overfit) can be effectively avoided, because the transfer learning allows the model to develop learning for different types of data, and thus the performance of the model in terms of the internal connection of capturing the problem to be solved is more excellent.

In one embodiment of the present disclosure, multi-task learning (one of the transfer learning) is employed to train the default model and the new model. Since the focus is typically on a single task, other information that may help optimize the metric, such as training signals from the relevant task, may be ignored. Multitasking can make the model better generalize the original tasks by sharing characterizations between related tasks (e.g., sharing data, sharing features, sharing parameters, etc.). Multitasking is also a generalized migration mechanism that improves generalization by training multiple tasks in parallel using shared tokens. Inductive migration focuses on methods that apply knowledge that solves one problem to a related problem, thereby improving the efficiency of learning. In addition, the use of shared tokens allows more efficient predictions as the number of data sources and the scale of overall model parameters are reduced when predicting multiple tasks simultaneously. Those skilled in the art will appreciate that other methods of migration learning may alternatively be used, and will not be described in detail herein.

Therefore, the model capability of the existing service and site can be quickly transplanted to other services and sites, so that the model can be quickly landed even if only a small amount of data and labels are needed when the model is built for a new scene, and the model has excellent performance.

At 108, the trained default model and the trained new model are automatically fused to generate a fused model.

Through the foregoing steps, different multidimensional features and multiple models have been generated. Ensemble learning (Ensemble Learning) can efficiently utilize these features and models to improve the performance of online models by fusing the models. In practice, ensemble learning accomplishes the learning task by building and integrating a plurality of learners. It is generally considered that learning by combining a plurality of learners is much more accurate than learning by a single learner. To obtain a good integrated learner, the basic learner has a certain accuracy and a variety, namely the learners have differences, so that a certain generalization capability is ensured.

Common ensemble learning frameworks are the bagging (parallel fusion), boosting (serial fusion) and stacking (stacked fusion) frameworks. In one embodiment of the present disclosure, a stacking framework is employed. Specifically, a scoring card mode is adopted, a plurality of models are scored, then scoring results are classified into boxes, then a logistic regression model is trained, and finally weighted scoring is carried out.

Therefore, the rapid integration of a plurality of models or a plurality of newly built models in the basic model library can be realized through automatic multi-model fusion, so that the performance of the online model is obviously improved.

At 110, the trained default model is used as an online model and the trained new model and the fusion model are used as backup models.

At 112, when one of the backup models is better than the online model, the online model is replaced with the backup model.

After having the trained default model, the trained new model and the fusion model, a champion/challenger test or a/B test is employed to compare the online model (i.e., the established strategy/champion strategy) with one or more alternative models (i.e., the challenge model).

In the champion/challenger mode, a trained default model is typically used as an online model, as it is built based on existing modules; while the trained new model and the fusion model are used as backup models. Once the backup model is found to perform better than the online model, the online model can replace the offline model, and the online model can become the backup model, so that the online model is ensured to be always in the optimal performance.

Fig. 2 shows a schematic diagram of a method for efficiently building a risk control model according to an embodiment of the present disclosure.

The scheme proposed by the present disclosure for efficiently building a risk control model is implemented by a wind control engine. The wind control engine is based on an intelligent and efficient risk recognition algorithm system, and comprises a conventional supervised learning algorithm, a large number of non-supervision feature generation algorithms based on deep learning and algorithms outside other supervision and non-supervision concepts.

The wind control engine is constructed through a risk perception (executed by a wind control engine perception center), risk recognition, intelligent decision (executed by a wind control engine intelligent center) and intelligent evolution (executed by a wind control engine guarantee center) system. Based on the wind control engine, real-time risk scanning can be performed on the payment behaviors of each user, and real-time risk countermeasure can be performed by automatically attaching the behavior characteristics of the user through a model with constantly added risk characteristic mining and optimization algorithm iteration. Furthermore, the wind control engine can also enable the system to dynamically and intelligently adjust the control intensity of the wind control engine according to transaction flow, risk attack change and user behavior migration, so that the risk disturbance rate is obviously reduced.

For the scheme for efficiently constructing the risk control model, a knowledge migration model construction system for constructing a model with continuously increasing risk feature mining and optimization algorithm iteration is actually adopted. The knowledge migration model construction system can sense new risk, new sites and new business through the wind control engine sensing center, so that the model is rapidly on line. And the wind control engine support center can provide the necessary monitoring capability, AB test capability and model rollback capability for the built model. Meanwhile, the constructed model can be provided for an intelligent center of the wind control engine to perform risk identification and intelligent decision.

The knowledge migration model building system comprises three major modules, namely Selection (Selection), reproduction (Reproduction) and Crossover (cross).

The selection module comprises two sub-modules of a base model library and a champion/challenger.

In the base model library sub-module, the ability to build default models will be provided. Risk modules that are abstracted from the wind control hierarchy include active, passive, device, environment, behavior, relationships, conflicts, mutations, and FTG (Fraud to Gross). Different base models can be built for different modules, for example, account value, a cheating crowd model, etc. can be built for the active party. After the base model library is provided, when a new service and a new site are triggered, the models in the base model library can be freely selected, and a default model suitable for the service/site can be automatically built.

For a certain scene and a certain service, an online model which directly affects the service is generally provided; in addition, there is a backup model that is scoring at the same time and does not directly affect the business, i.e. Champion/Challenger. In this champion/challenger sub-module, once the backup model is found to perform better than the online model, the backup model can be brought online instead of being taken off-line, and the online model can become the backup model, thereby ensuring that the online model is always in optimal performance.

The reproduction module mainly comprises modeling automation capability, including automatic feature generation, automatic feature selection and automatic parameter adjustment sub-modules.

Automatic feature generation is the automatic construction of candidate features related to a target task based on a dataset. The feature-derived operations in automatic feature generation are divided into conversion, computation and aggregation, i.e., conversion, computation and aggregation of the original features to generate new candidate features.

Automatic feature selection may be measured by the importance of the acquired features. The key links involved in automatic feature selection are feature subset search and feature subset evaluation. The feature selection method can be obtained by combining a feature subset search mechanism and a feature subset evaluation mechanism. The feature selection can be used for reducing the feature quantity and dimension, so that the generalization capability of the model is stronger, and the overfitting is reduced; and enhancing understanding between features and feature values. By automatic feature selection, the most efficient list of variables for a certain scenario/risk can be selected from the existing variable pool plus automatically generated features.

The crossing module comprises two sub-modules of multi-task learning and multi-model fusion.

The model capability of the existing service and site can be quickly transplanted to other services and sites through the multi-task learning sub-module, and the model capability is realized mainly through transfer learning. In one embodiment of the present disclosure, multitasking (a type of transfer learning) is employed to train a model by sharing data, sharing features, sharing parameters, etc. Therefore, when a model is built in a new scene, the model can be developed even if only a small amount of data and labels exist, quick landing is realized, and meanwhile, the model has excellent performance.

The multi-model fusion sub-module can realize automatic integration of models and is a sharp tool for improving the performance of the models. In one embodiment of the present disclosure, a scoring card mode is used, i.e., multiple models are binned into scoring results, then a logistic regression model is trained, and then a weighted score is made. The rapid integration of a plurality of models or a plurality of newly built models in the basic model library can be realized through automatic multi-model fusion, so that the model performance is remarkably improved.

For the scheme for efficiently updating the risk control model, a knowledge-enhanced model updating system for updating the model of constantly increasing risk feature mining and optimization algorithm iterations is adopted. The knowledge enhancement model updating system can sense new risk, new sites and new business through the wind control engine sensing center, so that the model can be updated rapidly. While the wind control engine support center may provide the necessary monitoring capabilities, AB testing capabilities, and model rollback capabilities for the updated model. At the same time, the updated model may be provided to a wind control engine intelligent center for risk identification and intelligent decision making.

The knowledge-enhanced model updating system comprises three modules, namely Self-tuning (Self-tuning), mutation (Mutation) and Adaptation (Adaptation).

The self-adjusting module can realize automatic re-fitting of the model. The model auto-re-fitting is enabled when a trigger condition is met, new training samples are introduced from the data warehouse and added to the training sample pool, different sample sets are formed based on the automatic selection of the training samples in the training sample pool, and the risk control model is re-fitted with the different sample sets.

Triggering conditions include monitoring for a decrease or a change in performance of the wind control model. Alternatively, the trigger condition may be a time condition, i.e., a periodic trigger time, such as one Week (week+1) or one Day (day+1). Alternatively still, the use of the model auto-re-fitting function may be triggered manually or manually.

The mutation module can realize automatic model retraining. In model automatic retraining, the ability to automate integrated modeling triggers automatic retraining of models by perceiving new risks, new traffic (e.g., changes in data distribution, changes in newly added events, etc.), thereby finding optimal models by changing algorithms, model parameters, etc.

The adaptation module includes an online learning module. Through online learning, frequent changes in risk forms can be perceived based on the streaming data, thereby quickly iterating the wind control model. The iterative model may be updated by an online learning correlation algorithm (e.g., FTRL, online Random Forests) as each qualitative transaction is entered.

The process of updating the wind control model using the knowledge-enhanced model update architecture will be described in detail below with reference to fig. 8 and 9.

FIG. 3 illustrates a flow chart of a process 300 for building a default model according to an embodiment of the present disclosure.

At 302, a risk module is refined for each scene. The refined risk modules may include active, passive, devices, environments, behaviors, relationships, conflicts, abrupt and FTG (Fraud to Gross), and so on. These risk modules can be characterized as variables, which are divided into: a historical information summary class variable (variability class); derivative class variables including individual mutation and population probability; and relationship class variables, etc.

At 304, a base model is built for each risk module and a base model library is built based on these base models.

A base model library may be constructed for each risk module or variable by constructing a different base model. For example, for an active party in the identity variables, a basic model of account maturity, information disclosure crowd, easy-to-steal crowd, security crowd and the like can be built based on a user gray list, transaction history information and the like. For behaviors, basic models of account operation behaviors, verification interaction behaviors, scene transfer behaviors, fund circulation behaviors and the like can be constructed based on short-term behaviors and historical long-term behaviors of the account. Aiming at the equipment, basic models such as abnormal login equipment, abnormal operation equipment, abnormal tampering equipment, running Trojan horse equipment and the like can be constructed. Similarly, for addresses, basic models such as an abnormal login address, an abnormal operation address, an abnormal tampering address, a false address and the like can be constructed. For the relationship, a basic model of relationship with each other, relationship with a scene, relationship with content, relationship with a position and the like can be constructed. Those skilled in the art will appreciate that different base models may be constructed for different risk modules or variables according to different types thereof, and will not be described in detail herein.

At 306, when a new service is triggered, a corresponding base model in the base model library is selected. When a new service or new site is triggered, the models in the base model library can be freely selected based on the base model library so as to automatically build a default model suitable for the service/site.

At 308, a default model suitable for the new service is built using the corresponding base model. In building the default model, what is involved is actually a multiple variable merge modeling. Those skilled in the art will appreciate that for different businesses or sites, different models in the base model library may be selected to perform the merged modeling of different variables.

Fig. 4 shows a schematic diagram of a process for building a default model according to another embodiment of the present disclosure.

For each risk module or variable, a different base model may be built, thereby building a base model library. For example, for the active party in the identity variable, basic models such as account maturity, information leakage crowd, easy-to-steal crowd, safety feeling crowd and the like can be constructed. Aiming at the behaviors, basic models such as account operation behaviors, verification interaction behaviors, scene transfer behaviors, fund circulation behaviors and the like can be constructed. Aiming at the equipment, basic models such as abnormal login equipment, abnormal operation equipment, abnormal tampering equipment, running Trojan horse equipment and the like can be constructed. Similarly, for addresses, basic models such as an abnormal login address, an abnormal operation address, an abnormal tampering address, a false address and the like can be constructed. For the relationship, a basic model of relationship with each other, relationship with a scene, relationship with content, relationship with a position and the like can be constructed.

When a new service or new site is triggered, the models in the base model library can be freely selected based on the base model library so as to automatically build a default model suitable for the service/site.

FIG. 5 illustrates a flow chart of a process 500 for automatically building a new model according to an embodiment of the present disclosure.

At 502, an original variable pool is obtained.

Taking account transfer as an example, two subjects involved are a payment account and a collection account. In the wind control event, besides the account transaction behavior, the operation behavior of the account, the log and other information are included, wherein the behavior of the paying account as an active party comprises paying, densification, friend adding, head changing and the like, and the behavior of the collecting account as a passive party comprises collecting, reported, friend adding and the like. That is, for a transfer transaction, the primary variables are primarily the behavior of the payout account and the behavior of the collection account.

Taking the account of transferring to the card scene as an example, the existing variables are group variables and FTG variables. The FTG variables that have been described in the context of transferring to cards at present are dimensions such as city, age, card bin (issuer identification code), etc.

Those skilled in the art will appreciate that in different scenarios, different native variables may be acquired to form a native variable pool.

At 504, different types of features are automatically generated based on the original variables in the original variable pool.

Taking account transaction as an example, the sequence mining analysis can be performed based on the behavior of the expenditure account and the behavior of the collection account, mining of different long-short time windows is performed according to the short-term behavior and the historical long-term behavior of the account, and abnormal behavior sequences of the account are identified, so that fraud prevention and control are improved.

For example, multiple behavior sequences may be constructed, such as a real-time event sequence of a payout account, a real-time RPC sequence, a historical event sequence, and so forth; real-time event sequence for a collection account, real-time RPC sequence, historical event sequence, etc. Further, based on these behavior sequences, real-time sequences of the payout account and the collection account may be combined as an active party sequence and a passive party sequence into one vector, for example.

Taking account of the situation of transferring to the card as an example, the difficulty is in the prevention and control of new cards. In order to further prevent and control the risk of a new card, from the thought of a group and FTG variables, deep learning sequence modeling is utilized to generate card dimension embedding (enabling), then the card dimension embedding is summarized again to the card bin dimension, and the summarized embedding refines the behavior information of the card bin, so that the behavior characteristics of the card bin of the new card can be obtained as long as the card bin appears. In the scene, the sparse matrix of the features is changed into a dense matrix by the ebadd, so that the purposes of generating different types of features and reducing the dimension are achieved.

Those skilled in the art will appreciate that in different scenarios, different methods may be employed to automatically generate different types of features based on the original variables.

At 506, a scene-suitable variable is selected from the original variable pool and the automatically generated features to generate a variable list.

The features in the original variable pool and the automatically generated features can be combined into one variable pool, and then a proper variable list is selected for a specific scene.

Feature selection may be measured by obtaining the importance of the feature. The key links involved in automatic feature selection are feature subset search and feature subset evaluation. The feature selection method can be obtained by combining a feature subset search mechanism and a feature subset evaluation mechanism. By automatic feature selection, the most efficient list of variables for a certain scenario/risk can be selected from the existing variable pool plus automatically generated features.

At 508, automatic referencing is performed against the variable list.

After the variable list is selected, automatic tuning (i.e., automatic tuning of parameters) is required. Parameters are further divided into model parameters and superparameters. Model parameters are parameters that the model used learns from the distribution of training data, which do not require human prior experience. The super-parameters are parameters whose values are set before the learning process is started, and are not parameter data obtained by training. In general, the super parameters need to be optimized, and a group of optimal super parameters is selected for the model so as to improve learning performance and effect. In general, the common super-parameter tuning method includes: grid search, random search, and bayesian optimization. In one embodiment of the present disclosure, bayesian optimization is employed for automatic tuning of parameters. Those skilled in the art will appreciate that other parameter tuning methods may alternatively be used, and will not be described in detail herein.

At 510, a new model is acquired that fits the scene.

Thus, by means of feature generation, feature selection and automatic parameter tuning, a new model suitable for a scene can be obtained.

Fig. 6 shows a schematic diagram of a process for automatically building a new model according to another embodiment of the present disclosure.

The construction of the new model begins with receiving input of the original data, which includes the event and the tag. Events and tags may correspond to different variables/features, which are the original variables/features.

The construction of the new model comprises feature generation, feature selection and automatic parameter adjustment.

The feature generation is based on the original variable pool and automatically generated features to form features of different categories, such as event attribute features (property), event accumulation features (property), event sequence features (sequence), relationship topology features (graph), text expression features (text info), variable combination features (variable combination) and the like.

Based on these different classes of features, a suitable variable may be selected among them for a particular scene, i.e. feature selection is made. Feature selection may be measured by obtaining the importance of the feature. The key links involved in automatic feature selection are feature subset search and feature subset evaluation. The feature selection method can be obtained by combining a feature subset search mechanism and a feature subset evaluation mechanism. By automatic feature selection, the most efficient list of variables for a certain scenario/risk can be selected from the existing variable pool plus automatically generated features.

After the variable list is selected, automatic tuning is required. In general, the usual parameter tuning methods are: grid search, random search, and bayesian optimization. Those skilled in the art will appreciate that the specific parameter tuning method may be used as needed, and will not be described in detail herein.

Through feature generation, feature selection and automatic parameter tuning, a new model suitable for a scene can be output.

The present disclosure proposes a scheme for efficiently constructing a risk control model. Aiming at the problems that the flow of a newly built model in the current field is complex, and a large amount of manpower is required for data cleaning, model training and model deployment, the technical scheme of the present disclosure is based on basic model construction, automatic model construction and fusion model generation, and a model with continuously increased risk feature mining and optimization algorithm iteration is efficiently constructed through real-time competition of an online model and a backup model. Therefore, the technical solution of the present disclosure not only provides a general technical framework and solution, but also provides a model capability for adapting to different stages of service development.

System for efficiently building risk control models

Fig. 7 illustrates a block diagram of a system 700 for efficiently building a risk control model in accordance with an embodiment of the present disclosure.

The system 700 includes a default model building module 702, a new model building module 704, a model training module 706, a fusion model generation module 708, and an optimal model selection module 710.

The default model building module 702 builds a base model library to select models in the base model library to build default models when a new service is triggered.

During risk control, the default model building module 702 may refine out a number of risk modules including active, passive, device, environment, behavior, relationships, conflicts, abrupt changes, FTG (Fraud to Gross), and so forth. These risk modules are actually characterized as variables, which can be divided into: a historical information summary class variable (variability class); derivative class variables including individual mutation and population probability; and relationship class variables, etc.

The default model building module 702 may build a different base model for each risk module or variable, thereby building a base model library. For example, for an active party in the identity variables, a basic model of account maturity, information disclosure population, easy-to-steal population, security crowd and the like can be constructed based on a user gray list, transaction history information and the like. For behaviors, basic models of account operation behaviors, verification interaction behaviors, scene transfer behaviors, fund circulation behaviors and the like can be constructed based on short-term behaviors and historical long-term behaviors of the account. Aiming at the equipment, basic models such as abnormal login equipment, abnormal operation equipment, abnormal tampering equipment, running Trojan horse equipment and the like can be constructed. Similarly, for addresses, basic models such as an abnormal login address, an abnormal operation address, an abnormal tampering address, a false address and the like can be constructed. For the relationship, a basic model of relationship with each other, relationship with a scene, relationship with content, relationship with a position and the like can be constructed. Those skilled in the art will appreciate that different base models may be constructed for different risk modules or variables, according to their different types.

When a new business or new site is triggered, default model building module 702 may freely select models in the base model library based on the base model library, automatically build a default model appropriate for the business/site. In building the default model, what is involved is actually a multiple variable merge modeling. Those skilled in the art will appreciate that for different businesses or sites, different models in the base model library may be selected to perform the merged modeling of different variables.

The new model construction module 704 constructs a new model suitable for the new business through automatic feature generation, automatic feature selection, and automatic tuning.

When automatically building a new model, the new model building module 704 may automatically learn or characterize different variables through feature engineering based on the original data. Automatic feature generation is the automatic construction of candidate features related to a target task based on a dataset, typically converting time and relational datasets into a feature matrix that can be used for machine learning.

The feature-derived operations in automatic feature generation are divided into conversion, computation and aggregation, i.e., conversion, computation and aggregation of the original features to generate new candidate features. Of course, those skilled in the art will appreciate that the manner in which the features are derived is varied and, in particular, the corresponding processing is based on the needs of the business scenario.

The new model building module 704 may employ different means to obtain features for different variables. For example, for text variables, a Capsule Network (Capsule or vector neuron Network, hereinafter Capsule Network) algorithm may be used to obtain features; for sequence variables, LSTM (long short term memory network) may be used to obtain features; for historical information summary class (variability) variables, genetic algorithms and reinforcement learning may be used to obtain features; while FTRL (Follow The Regularized Leader) may be used for feature combinations for variable combinations (variable combination). Those skilled in the art will appreciate that the feature generation or acquisition for different variables may be performed using different methods.

The new model building module 704 performs automatic feature selection for automatically generated features as well as for original features. This may be done by taking the importance of the feature (i.e., feature Importance). The key links involved in automatic feature selection are feature subset search and feature subset evaluation. The feature selection method can be obtained by combining a feature subset search mechanism and a feature subset evaluation mechanism. The feature selection can be used for reducing the feature quantity and dimension, so that the generalization capability of the model is stronger, and the overfitting is reduced; and enhancing understanding between features and feature values. By automatic feature selection, the most efficient list of variables for a certain scenario/risk can be selected from the existing variable pool plus automatically generated features.

After feature selection is completed, the new model building module 704 needs to perform auto-tuning (i.e., auto-tuning of parameters). In general, the usual parameter tuning methods are: grid search, random search, and bayesian optimization. Those skilled in the art will appreciate that the parameter tuning method may be selected as desired.

Thus, by automatic feature generation, automatic feature selection, and automatic tuning, the new model construction module 704 can construct a new model that is suitable for a new business.

Model training module 706 trains the default model and the new model via transfer learning.

In most cases, it is not possible to find sufficiently sufficient training data in the face of a particular problem in a certain field. However, models trained from other data sources can be reused in similar fields through certain modifications and improvements due to the transfer learning technology. The migration learning is to define a plurality of source domains (source domains) and a target domain (target domains), learn at the source domains, migrate the learned knowledge to the target domains, and promote the learning effect (or performance) of the target domains.

In one embodiment of the present disclosure, model training module 706 employs Multi-task learning (one of the migration learning) to train the default model and the new model. Those skilled in the art will appreciate that other methods of transfer learning may alternatively be used.

Thus, the model training module 706 can quickly migrate the model capability of the existing service and site to other services and sites, so that the model can be quickly landed even with a small amount of data and labels when the model is built for a new scene, and the model has excellent performance.

Fusion model generation module 708 automatically fuses the trained default model and the trained new model to generate a fusion model.

The fusion model generation module 708 may fuse the models through ensemble learning (Ensemble Learning) to efficiently utilize multiple features and multiple models to promote performance of the online model. Therefore, the fusion model generation module 708 can realize the rapid integration of a plurality of models or a plurality of newly-built models in the basic model library through automatic multi-model fusion, so that the performance of the online model is obviously improved.

The optimal model selection module 710 uses the trained default model as an online model and the trained new model and the fusion model as backup models. When one of the backup models is better than the online model, the optimal model selection module 710 replaces the online model with the backup model.

After having the trained default model, the trained new model, and the fusion model, the optimal model selection module 710 uses a champion/challenger test or a/B test to compare the online model (i.e., the established strategy/champion strategy) with one or more alternative models (i.e., the challenge model).

In the champion/challenger mode, the optimal model selection module 710 will typically use the trained default model as an online model because it is built based on existing modules; while the trained new model and the fusion model are used as backup models. Once the backup model is found to perform better than the online model, the online model can replace the offline model, and the online model can become the backup model, so that the online model is ensured to be always in the optimal performance.

Thus, the system 700 for efficiently building a risk control model may output an optimal dynamic model.

Method for efficiently updating risk control model

Fig. 8 illustrates a flowchart of a method 800 for efficiently updating a risk control model in accordance with an embodiment of the present disclosure.

At 802, performance changes and changes in input data of a risk control model are monitored.

The risk control model has performance changes including performance degradation or dissimilarity of the risk control model. In another embodiment of the present disclosure, the monitoring trigger may be a periodic trigger (e.g., week+1, day+1, etc.). In yet another embodiment of the present disclosure, the monitoring trigger may also be a manual trigger. These trigger patterns all rely on automation of the underlying data, i.e., both the sample tags and the variable data can be automatically prepared and updated at timing. For example, the tag and variable data may be selected from the interior and exterior of different underlying data warehouses.

The change in the input data of the risk control model includes a change in the distribution of the input data and a change in the event of an augmentation. The variation of the distribution of the input data can lead to the increase or decrease of the variables in the model, which can be realized through the feature engineering, namely, as described above, the feature engineering is used for automatically learning or describing new different variables, and the feature screening is carried out on the original variables and the new variables, so that the proper model structure parameters are obtained. While a change in the event of a new increase may result in a change in the black and white label of the sample, thereby resulting in a possible need for adjustments to the hyper-parameters of the model.

At 804, when there is a performance change in the risk control model, the risk control model is re-fitted to obtain a re-fitted risk control model.

When there is a change in performance, particularly a decrease or a change in performance, in the risk control model, it is often necessary to evaluate the performance of the model on-line and several candidate models and select a preferred model from them. Alternative candidate models may be homogeneous models with different hyper-parameters.

When there is a degradation or a malfunction in the model performance, problems often occur: one is under fitting, namely high bias (high bias), the model does not train the characteristics of the data set, so that the accuracy of the model on the training set and the testing set is low; the other is model overfitting, i.e., high variance, which trains all features including noise, resulting in a model with very high accuracy in the training set, but low accuracy when applied to the new data set. At this time, the wind control model can be re-fitted with consideration of model complexity and data set size. The selection of the complexity of the model is not described in detail herein, and may be found in the automated modeling process above.

The size of the data set has a profound effect on the model performance. For overfitting, noise weights can be attenuated by taking more data samples, as the model trains all the features including noise. For under-fitting, adding training data may enable the model to train out the features of the dataset.

Thus, consider the introduction of new samples from the data warehouse and the addition of sample pools. Based on the automatic selection of samples in the sample cell, different sample sets are formed. The risk control model is then re-fitted with a different sample set. In this way, the generalization ability of the model can be improved.

At 806, the risk control model is retrained to obtain a retrained risk control model when there is a change in the input data of the risk control model.

When the input data of the risk control model is changed, the distribution of the input data is changed to cause the increase or decrease of the variables in the model, and the method can be realized through feature engineering, namely, new different variables are automatically learned or characterized through the feature engineering, and feature screening is carried out on the original variables and the new variables, so that proper model structure parameters are obtained. While a change in the event of a new increase may result in a change in the black and white label of the sample, thereby resulting in a possible need for adjustments to the hyper-parameters of the model.

The retraining risk control model further includes: adjusting structural parameters of the risk control model; and adjusting the hyper-parameters of the risk control model.

Adjusting structural parameters of the risk control model further includes: automatically generating new features based on the change in data; feature screening is carried out on the features of the risk control model; and adjusting structural parameters of the risk control model using the screened features. Adjusting structural parameters of the risk control model may be accomplished substantially through an automated modeling process.

The adjusting of the hyper-parameters of the risk control model is performed by one of grid search, random search and Bayesian optimization.

At 808, the re-fitted risk control model or the re-trained risk control model is updated with the streaming data through incremental learning.

Updating the re-fitted risk control model or the re-trained risk control model with streaming data through incremental learning is performed using an online learning algorithm, such as FTRL algorithm and online random forest (Online Random Forest) algorithm.

The online learning algorithm belongs to incremental learning, and emphasizes the real-time property of training. When the streaming data is oriented, the full data is not used in each training, and the model is updated once by one sample each time based on the parameters trained before, so that the model is updated quickly and the timeliness of the model is improved.

On-line learning pursues a strategy that is optimal for all knowledge that is known, then the gap from this optimal strategy becomes regret: the regret does not select this strategy from the beginning. Desirably, the gap becomes smaller with increasing time. Thus, online learning pursues no remorse (no-regret).

Through online/incremental learning, frequent changes in risk forms (embodied as streaming data) can be perceived based on the streaming data, thereby rapidly iterating the wind control model.

At 810, the risk control model is used as an online model and the updated, re-fitted risk control model and the retrained risk control model are used as backup models.

At 812, when one of the backup models is better than the online model, the online model is replaced with the backup model.

The performance of the model can be compared by comparing the evaluation indexes (such as AUC, F1 and KS) of the model.

Likewise, the comparison and replacement of the online model and the backup model may be performed by the Champion/Challenger (Champion & Challenger) mode as described above. In the champion/challenger sub-module, once the backup model is found to be better than the online model, the backup model can be online to replace the offline model, and the online model can be changed into the backup model, so that the online model is ensured to be always in the optimal performance.

Fig. 9 shows a schematic diagram of a method for efficiently updating a risk control model according to an embodiment of the present disclosure. In fig. 9, a schematic diagram including model automatic re-fitting, model automatic re-training, and incremental learning is shown.

In model automatic re-fitting, triggers include performance monitoring awareness and model operation triggers. As previously described, monitored is a performance degradation or dissimilarity of the risk control model. Alternatively, the monitoring trigger may be a periodic trigger (e.g., week+1, day+1, etc.). Alternatively still, the monitoring trigger may also be a manual trigger. These trigger patterns all rely on automation of the underlying data, i.e., both the sample tags and the variable data can be automatically prepared and updated at timing.

Model re-fitting mainly includes automatic selection of samples and automatic fitting of models. The automatic selection of samples includes introducing new samples from the data warehouse and adding to the sample pool and forming different sample sets based on the automatic selection of samples in the sample pool. Automatic fitting of the model the risk control model is re-fitted by using a different sample set. This can improve the generalization ability of the model.

And then carrying out model evaluation, namely automatically comparing the performances of the models, and then carrying out model scheme selection. After the model scheme is selected, the model can be put on line. In this embodiment, the selected model is manually deployed, and the policies do not need to be adjusted.

In the automatic model retraining, new different variables are automatically learned or depicted through feature engineering due to the triggering of new risks or new services, and feature screening is performed on the original variables and the new variables, so that the structural parameters of the model are adjusted. And the change of the black-and-white label of the sample caused by the change of the newly added event can enable the super-parameters of the model to be adjusted. This process may be essentially implemented by an automated modeling process.

In incremental learning, a qualitative transaction will trigger the incremental learning. Based on the knowledge base and the streaming data, the full data are not used in each training, and the model is updated once by using one sample each time based on the parameters trained before, so that the model is updated quickly, and the timeliness of the model is improved.

System for efficiently updating risk control models

Fig. 10 illustrates a block diagram of a system 1000 for efficiently updating a risk control model in accordance with an embodiment of the present disclosure.

The system 1000 includes a monitoring module 1002, a model re-fitting module 1004, a model re-training module 1006, an incremental learning module 1008, and an optimal model selection module 1010.

The monitoring module 1002 monitors performance changes of the risk control model and changes in the input data. The risk control model has performance changes including performance degradation or dissimilarity of the risk control model. The change in the input data of the risk control model includes a change in the distribution of the input data and a change in the event of an augmentation.

The model re-fitting module 1004 re-fits the risk control model when there is a change in performance of the risk control model to obtain a re-fitted risk control model.

The model re-fitting module 1004 re-fits the risk control model further includes: introducing new samples from the data warehouse and adding the new samples into the sample pool; forming different sample sets based on the automatic selection of samples in the sample cell; the risk control model is re-fitted with a different sample set.

Model retraining module 1006 retrains the risk control model when there is a change in the input data of the risk control model to obtain a retrained risk control model.

Model retraining module 1006 retrains the risk control model further includes: adjusting structural parameters of the risk control model; and adjusting the hyper-parameters of the risk control model.

Model retraining module 1006 adjusts structural parameters of the risk control model further includes: automatically generating new features based on the change in data; feature screening is carried out on the features of the risk control model; and adjusting structural parameters of the risk control model using the screened features.

Model retraining module 1006 adjusts the hyper-parameters of the risk control model using one of a mesh search, a stochastic search, and a bayesian optimization.

The incremental learning module 1008 updates the re-fitted risk control model or the retrained risk control model with the streaming data through incremental learning.

The incremental learning module 1008 updates the re-fitted risk control model or the re-trained risk control model with streaming data via incremental learning using FTRL algorithm and online random forest (Online Random Forest) algorithm.

The optimal model selection module 1010 uses the risk control models as an online model and uses the updated re-fitted risk control models and the retrained risk control models as backup models, and replaces the online model with one of the backup models when the backup model is superior to the online model.

The present disclosure proposes a scheme for efficiently updating a risk control model. According to the scheme, the rapid updating and iteration of the model can be realized aiming at the risks of time variation, the self-adaptive capacity of the model is greatly improved, and the prevention and control capacity of risks is improved. Meanwhile, the periods of model training and deployment are greatly shortened by automatic refitting (refit), automatic retraining (retrain), online learning (online learning) and the like, and the efficiency of model development is improved. Therefore, the technical solution of the present disclosure not only provides a general technical framework and solution, but also provides a model capability for adapting to different stages of service development.

The various steps and modules of the above-described methods and systems for efficiently building risk control models and methods and systems for efficiently updating risk control models may be implemented in hardware, software, or a combination thereof. If implemented in hardware, the various illustrative steps, modules, and circuits described in connection with the invention may be implemented or performed with a general purpose processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or other programmable logic component, a hardware component, or any combination thereof. A general purpose processor may be a processor, microprocessor, controller, microcontroller, state machine, or the like. If implemented in software, the various illustrative steps, modules, described in connection with the invention may be stored on or transmitted as one or more instructions or code on a computer readable medium. Software modules implementing various operations of the invention may reside in storage media such as RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, a removable disk, a CD-ROM, cloud storage, etc. A storage medium may be coupled to the processor such that the processor can read information from, and write information to, the storage medium, as well as execute corresponding program modules to implement the various steps of the present invention. Moreover, software-based embodiments may be uploaded, downloaded, or accessed remotely via suitable communication means. Such suitable communication means include, for example, the internet, world wide web, intranet, software applications, cable (including fiber optic cable), magnetic communications, electromagnetic communications (including RF, microwave and infrared communications), electronic communications, or other such communication means.

It is also noted that the embodiments may be described as a process which is depicted as a flowchart, a flow diagram, a structure diagram, or a block diagram. Although a flowchart may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. Additionally, the order of the operations may be rearranged.

The disclosed methods, apparatus, and systems should not be limited in any way. Rather, the invention encompasses all novel and non-obvious features and aspects of the various disclosed embodiments (both alone and in various combinations and subcombinations with one another). The disclosed methods, apparatus and systems are not limited to any specific aspect or feature or combination thereof, nor do any of the disclosed embodiments require that any one or more specific advantages be present or that certain or all technical problems be solved.

The embodiments of the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to the above-described embodiments, which are merely illustrative and not restrictive, and many modifications may be made by those of ordinary skill in the art without departing from the spirit of the present invention and the scope of the appended claims, which fall within the scope of the present invention.

Claims

1. A method for efficiently building a risk control model, comprising:

constructing a basic model library to select models in the basic model library when a new service is triggered, and constructing a default model;

constructing a new model suitable for the new service through automatic feature generation, automatic feature selection and automatic parameter adjustment;

training the default model and the new model via transfer learning;

automatically fusing the trained default model and the trained new model to generate a fused model;

using the trained default model as an online model and using the trained new model and the fusion model as a backup model; and

replacing the on-line model with the backup model when one of the backup models is better than the on-line model;

the setting up of the default model further comprises:

extracting a risk module for each scene;

constructing a basic model aiming at each risk module, and constructing a basic model library based on the basic model;

when a new service is triggered, selecting a corresponding basic model in the basic model library; and

setting up a default model suitable for new service by using the corresponding basic model;

the building of the new model further comprises:

Acquiring an original variable pool;

automatically generating different types of features based on the original variables in the original variable pool;

selecting a variable suitable for a scene from the original variable pool and the automatically generated features to generate a variable list;

automatically adjusting parameters according to the variable list; and

a new model is acquired that fits the scene.

2. The method of claim 1, wherein the refined risk modules may include active, passive, device, environment, behavior, relationships, conflicts, abrupt changes, and FTG (Fraud to Gross).

3. The method of claim 1, wherein the automatic feature generation comprises converting, computing, and aggregating original features to generate new candidate features.

4. The method of claim 1, wherein the automatic feature selection involves feature subset search and feature subset evaluation.

5. The method of claim 1, wherein the automatic call-in employs one of a grid search, a random search, and a bayesian optimization.

6. A system for efficiently building a risk control model, comprising:

a default model building module that builds a base model library to select models in the base model library to build default models when a new service is triggered;

A new model construction module for constructing a new model suitable for the new service through automatic feature generation, automatic feature selection and automatic parameter adjustment;

a model training module that trains the default model and the new model via transfer learning;

a fusion model generation module that automatically fuses the trained default model and the trained new model to generate a fusion model;

an optimal model selection module that uses the trained default model as an online model and uses the trained new model and the fusion model as backup models, and replaces the online model with one of the backup models when the backup model is better than the online model;

the default model building module further:

extracting a risk module for each scene;

the new model building module further:

acquiring an original variable pool;

automatically adjusting parameters according to the variable list; and

a new model is acquired that fits the scene.

7. The system of claim 6, wherein the refined risk modules may include active, passive, device, environment, behavior, relationships, conflicts, abrupt changes, and FTG (Fraud to Gross).

8. The system of claim 6, wherein the new model building module performs automatic feature generation comprising converting, computing, and aggregating the original features to generate new candidate features.

9. The system of claim 6, wherein the automatic feature selection by the new model building module involves feature subset search and feature subset evaluation.

10. The system of claim 6, the new model building module performs one of automatic tuning using grid search, random search, and bayesian optimization.

11. A computer readable storage medium storing instructions that, when executed, cause a machine to perform the method of any of claims 1-5.