Disclosure of Invention
In order to solve the above technical problems, an object of the present invention is to provide an operation risk monitoring method and system, which can early warn a designated person about an illegal operation of a user in advance, so as to eliminate a possible risk in time and reduce a related loss caused by the illegal operation of the user.
To achieve the above object, the operation risk monitoring method provided by the present invention specifically comprises: obtaining identity information data in a preset relation database according to an identity of a user to be monitored, and obtaining transaction information data of the user in a preset transaction database according to the identity information data; matching the transaction information data with a plurality of preset evaluation rules respectively, and obtaining a risk evaluation result according to a matching result; training through a machine learning algorithm according to the identity information data, the transaction information data and the risk assessment result of the user to obtain a risk prediction model; and monitoring the real-time transaction data of the user to be monitored, and acquiring a risk evaluation result of the user to be monitored according to the real-time transaction data and the risk prediction model.
In the above operation risk monitoring method, preferably, the identity information data includes identity basic information, asset information, and relationship information stored in the DCDS system by the user to be monitored; the trading information data comprises trading settlement information and security trading information of the user to be monitored, which are recorded on a predetermined trading platform.
In the above-mentioned job risk monitoring method, preferably, the comparing the transaction information data with a plurality of preset thresholds, and obtaining a risk assessment result according to the comparison result includes: matching the transaction information data with a plurality of preset evaluation rules respectively to obtain a plurality of matching results; and comparing and judging the combination of one or more matching results with a preset corresponding table to obtain a risk evaluation result.
In the above method for monitoring job risk, preferably, the obtaining transaction information data of the user from the predetermined transaction database according to the identity information data includes: and acquiring a family relation map of the user according to the identity information data, and inquiring transaction information data of the user to be monitored and the corresponding family members according to the family relation map.
In the above job risk monitoring method, preferably, matching the transaction information data with a plurality of preset evaluation rules, respectively, and obtaining a risk assessment result according to a matching result includes: matching the transaction information data with a plurality of preset evaluation rules through a preset rule engine and a risk engine, and obtaining a risk evaluation result according to a matching result; generating a prompt strategy according to the risk evaluation result and the prompt category in a preset prompt corresponding table; and executing corresponding promotion processing according to the prompt strategy.
In the above job risk monitoring method, preferably, matching the transaction information data with a plurality of preset evaluation rules, respectively, and obtaining a risk assessment result according to a matching result includes: when a fund flow exists between the user to be monitored and the corresponding family member and is transferred to the account of the user to be monitored, or security trading is carried out, and a first evaluation result is generated; obtaining a second evaluation result of the user to be monitored according to the cash transfer transaction flow record of the user to be monitored in the transaction information data; when the user to be monitored has various loans and all or part of loans are released to a trading market, generating a third evaluation result; when the existence of the user to be monitored is borrowed in real time and the whole or part of borrowed funds are released to a trading market, generating a fourth evaluation result; traversing corresponding prompt categories in a preset prompt corresponding table according to one or more combinations of the first evaluation result, the second evaluation result, the third evaluation result and the fourth evaluation result to obtain a prompt strategy; and executing corresponding promotion processing according to the prompt strategy.
The invention also provides an operation risk monitoring system, which comprises a data acquisition module, a data processing module, a model construction module and an analysis and evaluation module; the data acquisition module is used for acquiring identity information data in a preset relation database according to the identity of a user to be monitored, and acquiring transaction information data of the user in a preset transaction database according to the identity information data; monitoring real-time transaction data of the user to be monitored; the data processing module is used for matching the transaction information data with a plurality of preset evaluation rules respectively and obtaining a risk evaluation result according to a matching result; the model construction module is used for training through a machine learning algorithm according to the identity information data, the transaction information data and the risk evaluation result of the user to obtain a risk prediction model; and the analysis and evaluation module is used for obtaining a risk evaluation result of the user to be monitored according to the real-time transaction data and the risk prediction model.
In the above operation risk monitoring system, preferably, the data acquisition module includes a real-time data acquisition unit and an offline data acquisition unit; the real-time data acquisition unit is used for monitoring real-time transaction data of the user to be monitored; the off-line data acquisition unit is used for acquiring identity information data in a preset relation database according to the identity of the user to be monitored, and acquiring transaction information data of the user in a preset transaction database according to the identity information data.
The invention also provides a computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method when executing the computer program.
The present invention also provides a computer-readable storage medium storing a computer program for executing the above method.
The invention has the beneficial technical effects that: through stream type calculation, the abnormal transaction behavior of the user can be monitored in real time and early-warning is given; meanwhile, compared with the existing manual inspection, the efficiency is higher and the real-time performance is stronger; meanwhile, the rule definition has stronger adjustability and adaptability and more comprehensive detection.
Detailed Description
The following detailed description of the embodiments of the present invention will be provided with reference to the drawings and examples, so that how to apply the technical means to solve the technical problems and achieve the technical effects can be fully understood and implemented. It should be noted that, unless otherwise specified, the embodiments and features of the embodiments of the present invention may be combined with each other, and the technical solutions formed are within the scope of the present invention.
In the description of the present specification, the terms "comprising," "including," "having," "containing," and the like are used in an open-ended fashion, i.e., to mean including, but not limited to. Reference to the description of the terms "one embodiment," "a particular embodiment," "some embodiments," "for example," etc., means that a particular feature, structure, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the application. In this specification, the schematic representations of the terms used above do not necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. The sequence of steps involved in the embodiments is for illustrative purposes to illustrate the implementation of the present application, and the sequence of steps is not limited and can be adjusted as needed.
Additionally, the steps illustrated in the flow charts of the figures may be performed in a computer system such as a set of computer-executable instructions and, although a logical order is illustrated in the flow charts, in some cases, the steps illustrated or described may be performed in an order different than here.
Referring to fig. 1, the operation risk monitoring method provided by the present invention specifically includes: s101, obtaining identity information data in a preset relation database according to an identity of a user to be monitored, and obtaining transaction information data of the user in a preset transaction database according to the identity information data; s102, the transaction information data are respectively matched with a plurality of preset evaluation rules, and a risk evaluation result is obtained according to a matching result; s103, training through a machine learning algorithm according to the identity information data, the transaction information data and the risk assessment result of the user to obtain a risk prediction model; s104, monitoring the real-time transaction data of the user to be monitored, and acquiring a risk evaluation result of the user to be monitored according to the real-time transaction data and the risk prediction model. Therefore, in the actual use process, when the operation risk supervision method is applied to the traditional banking field, the data inside and outside the bank can be integrated and analyzed, and an expert rule base is established through relevant evaluation rules of information integration such as expert rules and model elements provided by auditors and risk management and control personnel, so that flexibly configurable risk rule causes and risk score causes are formed. Giving corresponding risk corresponding processing strategies according to the risk level of the evaluation rule, and monitoring and reminding the staff in real time; according to the operation risk supervision method, the fact that internal personnel have great risks or have great possible loss events is forecasted, early warning is conducted in advance, and offline responsible personnel supervise and check to prevent major events.
Referring to fig. 2, in the above embodiment, the identity information data includes identity basic information, asset information, and relationship information stored in the DCDS system by the user to be monitored; the trading information data comprises trading settlement information and security trading information of the user to be monitored, which are recorded on a predetermined trading platform. Specifically, related files such as personal client basic information files, asset information files, inline information and the like can be obtained through a DCDS system, and mass data obtained in real time or in batch are analyzed and calculated; in this embodiment, specific contents of the identity information data and the transaction information data may be as shown in fig. 3.
In an embodiment of the present invention, comparing the transaction information data with a plurality of preset thresholds, and obtaining a risk assessment result according to the comparison result includes: matching the transaction information data with a plurality of preset evaluation rules respectively to obtain a plurality of matching results; and comparing and judging the combination of one or more matching results with a preset corresponding table to obtain a risk evaluation result. Specifically, matching the transaction information data with a plurality of preset evaluation rules, and obtaining a risk assessment result according to a matching result may further include: matching the transaction information data with a plurality of preset evaluation rules through a preset rule engine and a risk engine, and obtaining a risk evaluation result according to a matching result; generating a prompt strategy according to the risk evaluation result and the prompt category in a preset prompt corresponding table; executing corresponding promotion processing according to the prompt strategy; in this embodiment, one matching result may be compared with a correspondence table set in advance by a worker, or a plurality of matching results may be compared with the correspondence table to obtain a more comprehensive processing policy; the corresponding table can be set by the staff in advance, for example, the corresponding table is processed by adopting which processing strategy when a certain condition occurs so as to eliminate the potential risk; of course, in practical work, a person skilled in the art may set the corresponding table in other ways, and the present invention is not limited herein.
In an embodiment of the present invention, obtaining the transaction information data of the user in the predetermined transaction database according to the identity information data comprises: acquiring a family relation map of a user according to the identity information data, and inquiring transaction information data of the user to be monitored and corresponding family members according to the family relation map; based on this embodiment, please refer to fig. 4, the matching the transaction information data with a plurality of preset evaluation rules, and obtaining the risk assessment result according to the matching result may further include: when a fund flow exists between the user to be monitored and the corresponding family member and is transferred to the account of the user to be monitored, or security trading is carried out, and a first evaluation result is generated; obtaining a second evaluation result of the user to be monitored according to the cash transfer transaction flow record of the user to be monitored in the transaction information data; when the user to be monitored has various loans and all or part of loans are released to a trading market, generating a third evaluation result; when the existence of the user to be monitored is borrowed in real time and the whole or part of borrowed funds are released to a trading market, generating a fourth evaluation result; traversing corresponding prompt categories in a preset prompt corresponding table according to one or more combinations of the first evaluation result, the second evaluation result, the third evaluation result and the fourth evaluation result to obtain a prompt strategy; executing corresponding promotion processing according to the prompt strategy; it should be noted that the drawings and the above embodiments are only one processing and evaluating method provided by the present invention, and the whole scheme is not further limited, and those skilled in the art can select an appropriate processing method, feedback result and approval process according to actual needs.
Referring to fig. 5, the present invention further provides an operation risk monitoring system, which includes a data acquisition module, a data processing module, a model building module, and an analysis and evaluation module; the data acquisition module is used for acquiring identity information data in a preset relation database according to the identity of a user to be monitored, and acquiring transaction information data of the user in a preset transaction database according to the identity information data; monitoring real-time transaction data of the user to be monitored; the data processing module is used for matching the transaction information data with a plurality of preset evaluation rules respectively and obtaining a risk evaluation result according to a matching result; the model construction module is used for training through a machine learning algorithm according to the identity information data, the transaction information data and the risk evaluation result of the user to obtain a risk prediction model; and the analysis and evaluation module is used for obtaining a risk evaluation result of the user to be monitored according to the real-time transaction data and the risk prediction model.
In the operation risk monitoring system, the data acquisition module may include a real-time data acquisition unit and an offline data acquisition unit; the real-time data acquisition unit is used for monitoring real-time transaction data of the user to be monitored; the off-line data acquisition unit is used for acquiring identity information data in a preset relation database according to the identity of the user to be monitored, and acquiring transaction information data of the user in a preset transaction database according to the identity information data.
Referring to fig. 7, when the operation risk monitoring system provided by the present invention is used to perform risk prediction in actual work, the principle is to determine a specific group with major abnormality by machine learning according to specific transaction characteristics. The module is a simple two-classification model, a support vector machine is adopted for model training, and the trained model is loaded into a production system, so that a prediction result is obtained. Specifically, please refer to fig. 7, which mainly includes data acquisition, data processing, feature engineering, feature storage, and generation of a machine learning model, and several parts are generated as a result; wherein, the data acquisition: the system comprises internal system data (such as core bank balance and the like), external system data (such as Unionpay transaction data), and real-time receiving data (data of real-time transaction of a client); data processing: preprocessing acquired data, such as null filling and the like; characteristic engineering: analyzing and generating features, such as feature screening, feature combination, and the like; and (4) feature storage: storing the characteristics into a specified wide table, and providing the characteristics for training of a machine learning model; and (3) generating a machine learning model: and (3) carrying out model training by adopting an SVM (support vector machine) to generate a model file. The above steps can be implemented respectively by those skilled in the art through the prior art, and the invention is not described herein; referring to fig. 8 again, based on the model file established in the above embodiment, the corresponding risk prediction may be performed, that is, whether there is a high risk is determined through two links of real-time data reception and online prediction, and then the corresponding processing is performed according to the determination result.
The invention also provides a computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method when executing the computer program.
The present invention also provides a computer-readable storage medium storing a computer program for executing the above method.
The invention has the beneficial technical effects that: through stream type calculation, the abnormal transaction behavior of the user can be monitored in real time and early-warning is given; meanwhile, compared with the existing manual inspection, the efficiency is higher and the real-time performance is stronger; meanwhile, the rule definition has stronger adjustability and adaptability and more comprehensive detection.
As shown in fig. 6, the computer device 600 may further include: communication module 110, input unit 120, audio processing unit 130, display 160, power supply 170. It is noted that the computer device 600 does not necessarily include all of the components shown in FIG. 6; furthermore, the computer device 600 may also comprise components not shown in fig. 6, as can be seen in the prior art.
As shown in fig. 6, the central processor 100, sometimes referred to as a controller or operational control, may comprise a microprocessor or other processor device and/or logic device, the central processor 100 receiving input and controlling the operation of the various components of the computer apparatus 600.
The memory 140 may be, for example, one or more of a buffer, a flash memory, a hard drive, a removable media, a volatile memory, a non-volatile memory, or other suitable device. The information relating to the failure may be stored, and a program for executing the information may be stored. And the central processing unit 100 may execute the program stored in the memory 140 to realize information storage or processing, etc.
The input unit 120 provides input to the cpu 100. The input unit 120 is, for example, a key or a touch input device. The power supply 170 is used to provide power to the computer device 600. The display 160 is used to display an object to be displayed, such as an image or a character. The display may be, for example, an LCD display, but is not limited thereto.
The memory 140 may be a solid state memory such as Read Only Memory (ROM), Random Access Memory (RAM), a SIM card, or the like. There may also be a memory that holds information even when power is off, can be selectively erased, and is provided with more data, an example of which is sometimes called an EPROM or the like. The memory 140 may also be some other type of device. Memory 140 includes buffer memory 141 (sometimes referred to as a buffer). The memory 140 may include an application/function storage section 142, and the application/function storage section 142 is used to store application programs and function programs or a flow for executing the operation of the computer apparatus 600 by the central processing unit 100.
Memory 140 may also include a data store 143, the data store 143 for storing data, such as contacts, digital data, pictures, sounds, and/or any other data used by a computer device. The driver storage 144 of the memory 140 may include various drivers for the computer device for communication functions and/or for performing other functions of the computer device (e.g., messaging applications, directory applications, etc.).
The communication module 110 is a transmitter/receiver 110 that transmits and receives signals via an antenna 111. The communication module (transmitter/receiver) 110 is coupled to the central processor 100 to provide an input signal and receive an output signal, which may be the same as in the case of a conventional mobile communication terminal.
Based on different communication technologies, a plurality of communication modules 110, such as a cellular network module, a bluetooth module, and/or a wireless local area network module, may be provided in the same computer device. The communication module (transmitter/receiver) 110 is also coupled to a speaker 131 and a microphone 132 via an audio processor 130 to provide audio output via the speaker 131 and receive audio input from the microphone 132 to implement general telecommunications functions. Audio processor 130 may include any suitable buffers, decoders, amplifiers and so forth. In addition, an audio processor 130 is also coupled to the central processor 100, so that recording on the local can be enabled through a microphone 132, and so that sound stored on the local can be played through a speaker 131.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The above-mentioned embodiments are intended to illustrate the objects, technical solutions and advantages of the present invention in further detail, and it should be understood that the above-mentioned embodiments are only exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made within the spirit and principle of the present invention should be included in the scope of the present invention.