CN114155085A - Method and system for automatically early warning risk index based on expression engine - Google Patents
Method and system for automatically early warning risk index based on expression engine Download PDFInfo
- Publication number
- CN114155085A CN114155085A CN202111354217.9A CN202111354217A CN114155085A CN 114155085 A CN114155085 A CN 114155085A CN 202111354217 A CN202111354217 A CN 202111354217A CN 114155085 A CN114155085 A CN 114155085A
- Authority
- CN
- China
- Prior art keywords
- early warning
- monitoring
- index
- formula
- risk
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 40
- 230000014509 gene expression Effects 0.000 title claims abstract description 31
- 238000012544 monitoring process Methods 0.000 claims abstract description 183
- 230000002159 abnormal effect Effects 0.000 claims abstract description 51
- 239000013598 vector Substances 0.000 claims description 26
- 230000001960 triggered effect Effects 0.000 claims description 18
- 238000012545 processing Methods 0.000 claims description 11
- 238000007619 statistical method Methods 0.000 claims description 8
- 230000008569 process Effects 0.000 claims description 4
- 230000005856 abnormality Effects 0.000 abstract description 9
- 238000013473 artificial intelligence Methods 0.000 abstract description 2
- 238000006243 chemical reaction Methods 0.000 description 6
- 239000002245 particle Substances 0.000 description 6
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 2
- 230000008859 change Effects 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 230000009897 systematic effect Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000003203 everyday effect Effects 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 238000007711 solidification Methods 0.000 description 1
- 230000008023 solidification Effects 0.000 description 1
- 238000011425 standardization method Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000001360 synchronised effect Effects 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 230000007704 transition Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/03—Credit; Loans; Processing thereof
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
- G06F17/10—Complex mathematical operations
- G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F40/00—Handling natural language data
- G06F40/10—Text processing
- G06F40/166—Editing, e.g. inserting or deleting
- G06F40/186—Templates
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0635—Risk analysis of enterprise or organisation activities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0639—Performance analysis of employees; Performance analysis of enterprise or organisation operations
- G06Q10/06393—Score-carding, benchmarking or key performance indicator [KPI] analysis
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Human Resources & Organizations (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Strategic Management (AREA)
- Economics (AREA)
- Entrepreneurship & Innovation (AREA)
- Development Economics (AREA)
- Marketing (AREA)
- Operations Research (AREA)
- Educational Administration (AREA)
- Data Mining & Analysis (AREA)
- General Business, Economics & Management (AREA)
- Mathematical Optimization (AREA)
- Quality & Reliability (AREA)
- Finance (AREA)
- General Engineering & Computer Science (AREA)
- Mathematical Physics (AREA)
- Accounting & Taxation (AREA)
- Tourism & Hospitality (AREA)
- Game Theory and Decision Science (AREA)
- Computational Mathematics (AREA)
- Mathematical Analysis (AREA)
- Pure & Applied Mathematics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Databases & Information Systems (AREA)
- General Health & Medical Sciences (AREA)
- Evolutionary Biology (AREA)
- Computational Linguistics (AREA)
- Audiology, Speech & Language Pathology (AREA)
- Probability & Statistics with Applications (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Algebra (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Technology Law (AREA)
Abstract
The invention discloses a method and a system for automatically early warning risk indexes based on an expression engine, belongs to the technical field of artificial intelligence and big data, and aims to solve the problems of excessive report monitoring indexes, overlong manual reading time and the like in the prior art. Through system configuration, automatic early warning when tens of thousands of indexes are abnormal is realized, manual reading is replaced by system monitoring, efficiency is greatly improved, and timeliness for discovering the abnormality are guaranteed.
Description
Technical Field
The invention belongs to the technical field of artificial intelligence and big data, and particularly relates to a risk index automatic early warning method and system based on an expression engine.
Background
With the continuous and high-speed development of the Chinese economy, the Chinese financial industry has also acquired unprecedented development, but at the same time, the financial institutions face severe financial risks, such as: market risk, credit risk, operational risk, etc. One of the risk management of financial institutions is the continuous monitoring of various risk indicators. The current common practice of the industry is mainly realized by report monitoring. For example, CN202011611286.9, "report monitoring method, apparatus, computer-readable storage medium, and electronic device" provides a method for generating and monitoring reports; for example, CN201810362197.1, "report monitoring method, apparatus, computer device, and storage medium" provides a report monitoring method, which aims to solve the technical problem that the existing monitoring tool does not support asynchronous loading type report monitoring. However, when a certain index of the report is abnormal, how to carry out automatic early warning is carried out; how to free the monitoring personnel from reading tens of thousands of report indexes every day, and no record of related technical schemes is left for a while.
Disclosure of Invention
Therefore, in order to solve the problems of excessive report monitoring indexes, overlong manual reading time and the like, the invention provides a method and a system for automatically early warning risk indexes based on an expression engine. Through system configuration, automatic early warning when tens of thousands of indexes are abnormal is realized, manual reading is replaced by system monitoring, efficiency is greatly improved, and timeliness for discovering the abnormality are guaranteed.
The technical scheme adopted by the invention is as follows:
a risk index automatic early warning method based on an expression engine mainly comprises the following steps:
step 1: the batch running processor sets batch running time through a timer according to the monitoring index system and is used for carrying out batch running on the set batch running time of the source data table of each service system;
step 2: the monitoring index calculator forms a source data set based on a table structure of each source data according to monitoring index requirements set by a monitoring task, establishes a table structure corresponding to the original data set in a storage medium, and automatically processes risk indexes of the original data set according to the monitoring indexes;
and step 3: the formula memory constructs an early warning formula set based on monitoring indexes according to service scenes corresponding to different monitoring tasks, configures early warning formula vectors, and establishes a set data structure for storing the early warning formula set in a storage medium;
and 4, step 4: the formula calculator carries out batch operation based on the deployed and configured early warning formula vectors, configures warning information according to the abnormal early warning records, and the system automatically gives a warning according to the pre-configured content and generates abnormal early warning records;
and 5: and the system automatically generates an exception report according to the triggered exception early warning record.
By adopting the scheme, the risk index is generated based on automatic batch running of the system through the abstract solidification report index template, and the index abnormity early warning formula is constructed through the expression engine, so that the multi-form automatic early warning of the abnormity of the risk index is realized.
Further, the step 1 specifically includes:
step 1.1: the set batch running time is processed by selecting a T + n mode or an asynchronous processing mode, the T + n mode refers to that n time interval units are processed after the date of occurrence of the business, the time of T refers to the time of occurrence of the business, the T + n refers to the nth time interval unit after the time of T, n is any natural number, and the time interval units comprise year, month, day, time, minute, second and the like. Asynchronous processing mode, as opposed to real-time synchronous processing, refers to the manner in which a current thread is not blocked from waiting for processing to complete, but rather subsequent operations are allowed until other threads are ready to complete, and the thread is notified back.
Step 1.2: and (4) collecting source data tables from all the service systems, wherein the source data related to the monitoring index system are different in different service scenes. Such as: in a risk management monitoring index system of a financial institution, source data comprises a plurality of source tables such as a credit flow water meter, a borrow overdue table, a financial flow water meter and a strategy hit distribution table.
Further, the step 2 specifically includes:
step 2.1: and abstracting an index statistical method, abstracting the index statistical method realized based on a database language into dimension, time dimension, category dimension and index dimension, and forming a report index solidified template based on the combination of the dimension, wherein the report index solidified template is applicable to all risk monitoring index systems. Specifically, the time dimension is a time as a description, and expresses a metric scale of the index. For the investigation of economic indexes, the dimension of time must be added in the analysis to accurately express economic variables when the economic variables can be expressed by time units. The time dimension typically includes year, month, day, hour and deciliter 5 dimensions. The category dimension refers to the result under a certain classification in space. Such as: collaboration enterprises, channels, product categories, provinces, cities, etc. The index dimension, i.e. the risk monitoring index, refers to a statistical value of a change condition in a certain risk field and capable of being monitored periodically. Such as: credit applicant number, reject ratio, credit balance, etc.;
step 2.2: and classifying the statistical index clusters, constructing a risk monitoring index system according to an industry mode and a service mode, and classifying the risk monitoring index system into different statistical index clusters according to different monitoring contents, namely monitoring the distribution condition of a certain type of index statistical value under a certain time dimension and a certain category dimension. For example, in the field of anti-fraud risk management of internet credit services, a fraud risk monitoring index system mainly comprises a service condition monitoring cluster, a fraud policy monitoring cluster, a post-loan risk condition monitoring cluster and the like;
further, step 2.2 specifically includes:
step 2.2.1: and monitoring the service condition. The method mainly refers to the statistical monitoring of the service conditions under a certain time dimension and a certain category dimension. The time dimension includes 5 dimensions including year, month, day, hour, and minute. The category dimension includes 3 dimensions, referring to product major categories, channel names, cities. The monitoring indexes comprise registration number, real-name authentication number, credit application number, cash withdrawal number, registration and credit application number, conversion rate from registration to credit application, credit and cash withdrawal number, conversion rate from credit application to cash withdrawal and the like.
Step 2.2.2: fraud policy monitoring clusters. The method mainly refers to statistical monitoring of fraud policy conditions in a certain time dimension and a certain category dimension. The time dimension includes 4 dimensions, namely year, month, day, hour. The category dimension comprises 4 dimensions, which refer to product major categories, channel names, event names, and policy rule codes. The monitoring indexes comprise the number of events, the number of strategy hit events, the strategy hit rate, the number of decision passing events, the number of decision rejection events, the number of manual events, the number of authentication events, the strategy passing rate, the strategy rejection rate, the strategy manual rate, the strategy authentication rate, the strategy fraud rate and the like.
Step 2.2.3: post-loan risk condition monitoring clusters. Mainly means that the method carries out statistical monitoring on the risk condition after the loan under a certain time dimension and a certain category dimension. The time dimension includes 3 dimensions, namely year, month, and day. The category dimension comprises 2 categories, namely a product category and a channel name. The monitoring indexes comprise the number of borrowed persons, the number of borrowed data, the number of per capita borrowed data, the loan amount, the loan balance, the per capita loan amount, the number of borrowed data which is 30 days or more overdue, the overdue rate of the borrowed data which is 30 days or more overdue, the loan amount which is 30 days or more overdue, the overdue rate of the loan amount which is 30 days or more overdue, the number of intermediary fraud persons, the intermediary fraud ratio, the telecommunication fraud number, the telecommunication fraud ratio and the like.
Step 2.3: and counting the index cluster batch, setting a timing task, calculating the monitoring index set of each cluster by batch, storing the index sets of different clusters into different data tables, and storing the index sets of different clusters into different data tables. And writing the incremental statistical information increment into a corresponding data table during each batch running. Such as: the data table associated with the service condition monitoring cluster is defined as businessMonSet, the data table associated with the fraud policy monitoring cluster is defined as froudStrategMonSet, and the data table associated with the post-credit risk condition monitoring cluster is postLoanMonSet.
Specifically, the early warning formula in step 3 is to define the abnormal condition of the monitoring index statistical value in a configuration mode of an expression engine interface. The expression engine is a means for realizing dynamic coding, and can dynamically configure expected values and expressions. The index abnormality includes 2 cases, i.e., a threshold abnormality and a fluctuation abnormality. The threshold value abnormal means that when the statistic value of a certain index reaches a certain critical point which is unlikely to occur, the critical point is called an abnormal threshold value. The fluctuation abnormity refers to that when the statistic value of a certain index has an inconsistent change trend compared with the historical situation, the current index is considered to have fluctuation. Because the statistical index cluster comprises the characteristics of a plurality of dimensions, each early warning formula corresponds to a multi-dimensional early warning formula vector. Assuming that a certain statistical index cluster includes M time dimensions, N category dimensions, and K monitoring indexes, one early warning formula vector includes M × N × K one-dimensional formulas.
Specifically, the early warning formula set in step 3 includes a threshold anomaly early warning formula set and a fluctuation anomaly early warning formula set.
The abnormal early warning formula set refers to an early warning formula set formed by a current statistical value, a threshold value and a logic symbol of a certain index. Assume that each monitored indicator corresponds to a threshold anomaly formula. Defining the vector names of threshold abnormal formulas as FT1，FT2，……，FTk，……，FTK(ii) a The monitoring indexes (T +0, current statistical value) are respectively
The corresponding upper threshold is thon1，thon2，……，thonk，……，thonK(ii) a The lower threshold is thoff1，thoff2，……，thoffk，……，thoffKThen the threshold anomaly early warning formula set is
Where K is 1,2, … …, K. For the kth monitoring index, the corresponding threshold value abnormity early warning formula vector FTkM x N one-dimensional early warning formulas of the monitoring index in time and category dimensions are included, wherein k is 1,2,……,K。
the fluctuation abnormity early warning formula group refers to an early warning formula set which is composed of a current statistical value of a certain index, a historical statistical value of a certain index, a threshold value and a logic symbol. Assume that each monitored indicator corresponds to a fluctuating anomaly formula vector. Defining the names of the vectors of the fluctuation abnormal formula as FV1，FV2，……，FVk，……，FVK(ii) a The monitoring indexes (T +0, current statistical value) are respectively
The monitoring indexes (T +1, the historical statistics of the latest period) are respectively
The fluctuation anomaly early warning formula vector set is
Where K is 1,2, … …, K. Then for the kth monitoring index, the corresponding fluctuation abnormity early warning formula vector FVkM × N one-dimensional warning formulas of the monitoring index in time and category dimensions are included, where K is 1,2, … …, K.
Further, step 4 specifically includes: and 3, performing batch operation based on the deployed and configured early warning formula vectors, and generating an abnormal early warning record when any one-dimensional early warning formula is triggered in the step 3. And configuring an alarm group, an alarm mode and alarm content, and automatically performing early warning by the system according to the pre-configured content. An alert group is a list consisting of a series of alert recipients. Different alarm groups can set different alarm modes. The warning mode refers to a mode that when the early warning formula is triggered, the system notifies the related personnel of the abnormal information, and the warning mode comprises mail warning, mobile phone number warning and micro-signal warning. Content of alarm, fingerWhen the alarm is triggered, the system informs the content information carried by the related personnel. The alert content generally includes: alarm time, alarm risk level, monitoring index cluster name, early warning formula set, time dimension, category dimension, monitoring index name, statistic value and abnormal rate. For a threshold anomaly class formula, the anomaly rate is defined as the ratio of the maximum absolute difference of the statistic to the threshold and the statistic, i.e. for a threshold anomaly formula FTkLet the abnormal rate be FTRatekThen, then
For the fluctuation anomaly formula, the anomaly rate is defined as the ratio of the current statistic value to the historical statistic value, i.e. for the fluctuation anomaly formula FVkAssuming that the abnormality rate is FVratekThen, then
The larger the abnormal rate is, the larger the risk of the current statistical value of the monitoring index is. Since one alarm formula vector corresponds to M × N × K one-dimensional alarm formulas, one alarm formula vector corresponds to M × N × K abnormal early warning records at most.
Further, the step 5 specifically includes: and automatically generating an exception report according to the early warning formula group and the exception early warning record triggered by the exception early warning module. For monitoring personnel, the abnormal points of the whole monitoring index system can be known only by reading the abnormal report, so that the efficiency is greatly saved. And different alarm groups generate different abnormal reports according to different configured alarm formula groups. The abnormal report is in PDF format, and the system automatically informs each alarm group member of the abnormal information in a mail mode. The exception report comprises two contents of a header and a body. And the header generates report name, report generation time and alarm group 3 part of content in a self-defined way. The report text comprises all the abnormal early warning details and the time trend graph of the abnormal index. And displaying the abnormity early warning details in a table form, wherein the abnormity early warning details comprise monitoring cluster names, early warning formula groups, time dimensions, category dimensions, monitoring index names, statistical values and abnormity rates, and sorting the monitoring cluster names, the early warning formula groups, the time dimensions, the category dimensions, the monitoring index names, the statistical values and the abnormity rates in a descending order according to the abnormity rates. The time trend graph of the abnormal index shows the trend of the statistical values corresponding to the latest 30 time dimensions of the index.
An expression engine based automatic risk indicator warning system for use in the method of any one of claims 1 to 6, comprising
A dataset collection module: extracting a source data set for completing a monitoring task;
index statistics batch running module: calculating monitoring indexes in the monitoring tasks based on the source data set extracted by the data set collection module, and further, the index statistical batching module comprises 3 sub-modules of index statistical method abstraction, statistical index cluster classification and statistical index cluster batching;
the early warning formula configuration module: constructing an early warning formula set by monitoring indexes, and configuring an early warning formula vector;
an abnormity early warning module: performing batch operation based on the configured early warning formula vectors to generate abnormal early warning records;
an exception report generation module: automatically generating an exception report according to the exception early warning record triggered by the early warning formula group and the exception early warning module
The system comprises a data set collection module, an index statistical batching module, an early warning formula configuration module, an abnormity early warning module and an abnormity report generation module which are 5 modules in total. The data set collection module integrates data tables from all the service systems, the index counting batch module carries out counting processing on risk indexes based on a sampled risk index monitoring system and the data sets, the early warning formula configuration module configures a risk index early warning formula through a system interface, and when the early warning formula is automatically batched, the abnormity early warning module carries out automatic early warning on the triggered early warning formula and generates a risk index abnormity expression report. The abnormity early warning module and the abnormity report generation module form a unified closed loop, automatic monitoring early warning of a monitoring index system in tens of thousands is realized, systematic automatic early warning prompt is realized when indexes are abnormal, and risks are automatically found in time.
In summary, due to the adoption of the technical scheme, the invention has the beneficial effects that:
the invention comprehensively applies big data technology and distributed processing concept, solves the problem of manual report index monitoring based on various industries at present through the setting of various technical means such as report template standardization, early warning formula vectorization, abnormity early warning discretization and the like, realizes full-process automatic monitoring and early warning of risk indexes, and greatly improves the efficiency.
The data set collection module, the index statistics batch running module, the early warning formula module, the abnormity early warning module and the abnormity report generation module of the risk index automatic early warning system based on the expression engine form a unified closed loop, the problems that report calculation and index monitoring in the current industry are decoupled and an integrated system is not available are solved, automatic monitoring and early warning on tens of thousands of monitoring index systems are realized, risks are timely and automatically found, and a new scheme is provided for monitoring the risk index systems.
The method solves the problems of various reports of various industries and industries, different report formats and the like at present, provides a report method with a standard format for the industry, can adapt to the index monitoring requirements of various scenes of various industries and industries, and has strong expansibility and universality.
4, 2 quantized early warning formula standardization methods are abstracted, batch parallel operation is carried out on the early warning formulas in the same cluster in a vectorization mode, normalization processing of hundreds of early warning formulas is achieved, configuration difficulty is greatly simplified, efficiency is improved, the problem that a quantitative and concise monitoring method in the current industry is few is solved, the method can be adapted to index monitoring requirements of all scenes in all industries, and strong expansibility and universality are achieved.
Drawings
The invention will now be described, by way of example, with reference to the accompanying drawings, in which:
FIG. 1 is a flow chart of a risk indicator automatic early warning method based on an expression engine according to the present invention;
fig. 2 is a structural diagram of a risk indicator automatic early warning system based on an expression engine according to the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all the embodiments. The components of embodiments of the present application, generally described and illustrated in the figures herein, may be arranged and designed in a wide variety of different configurations. Thus, the following detailed description of the embodiments of the present application, presented in the accompanying drawings, is not intended to limit the scope of the claimed application, but is merely representative of selected embodiments of the application. All other embodiments, which can be derived by a person skilled in the art from the embodiments of the present application without making any creative effort, shall fall within the protection scope of the present application.
In the description of the embodiments of the present application, it should be noted that the terms "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the drawings or orientations or positional relationships that the products of the present invention are usually placed in when used, and are only used for convenience of description and simplicity of description, but do not indicate or imply that the devices or elements that are referred to must have a specific orientation, be constructed and operated in a specific orientation, and thus, should not be construed as limiting the present application. Furthermore, the terms "first," "second," "third," and the like are used solely to distinguish one from another and are not to be construed as indicating or implying relative importance.
The present invention will be described in detail with reference to fig. 1 and 2.
The invention provides an expression engine-based automatic risk index early warning method, which comprises the following steps: 1) the batch running processor sets batch running time through a timer according to the monitoring index system and is used for carrying out batch running on the set batch running time of the source data table of each service system; 2) the monitoring index calculator forms a source data set based on a table structure of each source data according to monitoring index requirements set by a monitoring task, establishes a table structure corresponding to the original data set in a storage medium, and automatically processes risk indexes of the original data set according to the monitoring indexes; 3) the formula memory constructs an early warning formula set based on monitoring indexes according to service scenes corresponding to different monitoring tasks, configures early warning formula vectors, and establishes a set data structure for storing the early warning formula set in a storage medium; 4) the formula calculator carries out batch operation based on the deployed and configured early warning formula vectors, configures warning information according to the abnormal early warning records, and the system automatically gives a warning according to the pre-configured content and generates abnormal early warning records; 5) and the system automatically generates an exception report according to the triggered exception early warning record.
The following detailed description is provided for a risk indicator automatic early warning method based on an expression engine, which includes:
step 1: and setting batch running time according to the monitoring index system, and collecting source data tables from all the service systems. Suppose the monitoring task name is 'credit product fraud risk monitoring'.
Step 1.1: and the set batch running time is processed by selecting a T + n mode or an asynchronous processing mode. For the monitoring task "credit product fraud risk monitoring," the batch time was set to the T +1 mode and was specified as 5:00 batches each morning.
Step 1.2: and (4) collecting source data tables from all the service systems, wherein the source data related to the monitoring index system are different in different service scenes. For the monitoring task 'credit product fraud risk monitoring', the specified data sources comprise a credit borrowing data table, a repayment schedule table, a credit contract information table, a customer event flow water meter and a customer strategy hit condition table.
Step 2: indexes in the monitoring index system are combed, similar indexes are collected, and different types of monitoring indexes are classified.
Step 2.1: and abstracting the index statistical method, wherein the index statistical method realized based on the database language is abstracted into 3 dimensions, namely a time dimension, a category dimension and an index dimension. For the monitoring task 'credit product fraud risk monitoring', a report system is established, and the time dimension comprises: 4 dimensions of year, month, week and day; the category dimension comprises 1 dimension of a product channel, and values such as good person credit, good merchant credit and other 30 channels are taken; the index dimension should contain as much as possible a fraud index dimension that can measure the risk of fraud, such as: the number of registrants, the number of real-name authentications, the number of credit applications, the number of cash-outs, the number of registered and credit applications, the rate of conversion of registration to credit applications, the number of credit and cash-outs, the rate of conversion of credit applications to cash-outs, the number of events, the number of policy hit events, the rate of policy hit, the number of decision passing events, the number of decision rejection events, the number of manual transitions, the number of authentication events, the rate of policy passing, the rate of policy rejection, the rate of policy turnaround labor, the rate of policy authentication, the rate of policy fraud, and the like. The monitoring indexes comprise the number of borrowed persons, the number of borrowed data, the number of per capita borrowed data, the loan amount, the loan balance, the per capita loan amount, the number of borrowed data which is 30 days or more overdue, the overdue rate of the borrowed data which is 30 days or more overdue, the loan amount which is 30 days or more overdue, the overdue rate of the loan amount which is 30 days or more overdue, the number of intermediary fraud persons, the intermediary fraud ratio, the telecommunication fraud number, the telecommunication fraud ratio and the like.
Step 2.2: and classifying the statistical index clusters, constructing a risk monitoring index system according to an industry mode and a service mode, and classifying the risk monitoring index system into different statistical index clusters according to different monitoring contents, namely monitoring the distribution condition of a certain type of index statistical value under a certain time dimension and a certain category dimension. For the monitoring task "credit product fraud risk monitoring", it is divided into 3 clusters: a service condition monitoring cluster, a fraud strategy monitoring cluster and a post-credit risk condition monitoring cluster.
Step 2.2.1: and monitoring the service condition. The method mainly refers to the statistical monitoring of the service conditions under a certain time dimension and a certain category dimension. The time dimension includes: 4 dimensions of year, month, week and day; the category dimension comprises 1 dimension of a product channel, and values such as good person credit, good merchant credit and other 30 channels are taken; the index dimension includes registration number, real-name authentication number, credit approval number, cash withdrawal number, registration and credit approval number, conversion rate from registration to credit approval, credit approval number, and conversion rate from credit approval to cash withdrawal.
Step 2.2.2: fraud policy monitoring clusters. The method mainly refers to statistical monitoring of fraud policy conditions in a certain time dimension and a certain category dimension. The time dimension includes: 4 dimensions of year, month, week and day; the category dimension comprises 1 dimension of a product channel, and values such as good person credit, good merchant credit and other 30 channels are taken; the index dimensions include number of events, number of policy hits, policy hit rate, number of decision passing events, number of decision rejection events, number of manual events to transfer, number of authentication events, policy pass rate, policy rejection rate, policy to manual rate, policy authentication rate, policy fraud rate.
Step 2.2.3: post-loan risk condition monitoring clusters. Mainly means that the method carries out statistical monitoring on the risk condition after the loan under a certain time dimension and a certain category dimension. The time dimension includes: 4 dimensions of year, month, week and day; the category dimension comprises 1 dimension of a product channel, and values such as good person credit, good merchant credit and other 30 channels are taken; the index dimensions comprise borrowed number, borrowed data number, per capita borrowed data number, loan amount, loan balance, per capita loan amount, borrowed data number of 30 days and above overdue, loan amount of 30 days and above overdue, intermediary fraud number, intermediary fraud ratio, telecommunication fraud number and telecommunication fraud ratio.
Step 2.3: and counting the running batch of the index clusters, setting a timing task, calculating the monitoring index set of each cluster by the running batch, and storing the index sets of different clusters into different data tables. And writing the incremental statistical information increment into a corresponding data table during each batch running. For the monitoring task of 'credit product fraud risk monitoring', the data table associated with the service condition monitoring cluster is defined as businessMonSet, the data table associated with the fraud policy monitoring cluster is defined as froudStrategMonSet, and the data table associated with the post-credit risk condition monitoring cluster is defined as postLoanMonSet.
And step 3: according to the service scenes corresponding to different monitoring tasks, the early warning formula set early warning formula is constructed based on the monitoring indexes, namely, the abnormal condition of the statistic value of the monitoring indexes is defined in an expression engine interface configuration mode. The expression engine is a means for realizing dynamic coding, and can dynamically configure expected values and expressions. The index abnormality includes 2 cases, i.e., a threshold abnormality and a fluctuation abnormality. For the monitoring task 'credit product fraud risk monitoring' } the service condition monitoring cluster comprises 8 monitoring indexes, 4 time dimensions and 30 category dimensions; the fraud policy monitoring cluster comprises 12 fraud indexes, 4 time dimensions and 30 category dimensions; the risk condition monitoring cluster after credit includes 14 fraud indexes, 4 time dimensions and 30 category dimensions, and a vector early warning formula corresponding to one monitoring index corresponds to 4 × 30-120 one-dimensional early warning formulas.
Step 3.1: and (4) a threshold abnormity early warning formula set. The threshold anomaly early warning formula set refers to an early warning formula set formed by current statistical values, thresholds and logic symbols of a certain index. Assume that each monitored indicator corresponds to a threshold anomaly formula. For the monitoring task "credit product fraud risk monitoring", for example, for the index of the number of registrants in the service condition monitoring cluster, the upper threshold limit is set to 100000, the lower threshold limit is set to 1000, that is, the threshold abnormal vector formula is: { current time particle registrant > -100000 or current time particle registrant <1000}, which corresponds to 120 one-dimensional warning formulas, such as: the number of good credit registrants per day is 100000 or the number of good credit registrants per day is <1000, the number of good credit registrants per week is 100000 x 7 or the number of good credit registrants per week is <1000 x 7, etc.
Step 3.2: and (5) a fluctuation abnormity early warning formula group. The threshold anomaly early warning formula group refers to an early warning formula set formed by a current statistical value of a certain index, a historical statistical value of a certain index, a threshold and a logic symbol.
For the monitoring task of 'credit product fraud risk monitoring', for example, for the registrant index of the service condition monitoring cluster, the fluctuation abnormal vector formula is as follows: { current time particle registries > -the average of the last 3 time particle registries 1.5 or current time particle registries < the average of the last 3 time particle registries 0.5}, which corresponds to 120 one-dimensional warning equations, such as: the number of good loan registrants on the day is 1.5 as the average of the number of good loan registrants on the last 3 days, or the number of good loan registrants on the day is 0.5 as the average of the number of good loan registrants on the last 3 days, the number of good loan registrants on the week is 1.5 as the average of the number of good loan registrants on the last 3 weeks, or the number of good loan registrants on the day is 0.5 as the average of the number of good loan registrants on the last 3 days.
And 4, step 4: and performing batch operation based on the deployed and configured early warning formula vectors, and generating an abnormal early warning record when any one-dimensional early warning formula is triggered. And configuring an alarm group, an alarm mode and alarm content, and automatically performing early warning by the system according to the pre-configured content. For the monitoring task 'credit product fraud risk monitoring', an alarm group is set as a fraud risk manager set, and short message alarm is configured. Setting alarm content: alarm time, alarm risk level, monitoring index cluster name, early warning formula set, time dimension, category dimension, monitoring index name, statistic value and abnormal rate. Such as a registrant indicator for a traffic condition monitoring cluster, for a threshold anomaly class formula,
for the wave-anomaly-like formula,
and 5: and the system automatically generates an exception report according to the early warning formula group and the exception early warning record triggered by the exception early warning module. For monitoring personnel, the abnormal points of the whole monitoring index system can be known only by reading the abnormal report, so that the efficiency is greatly saved. And different alarm groups generate different abnormal reports according to different configured alarm formula groups. The abnormal report is in PDF format, and the system automatically informs each alarm group member of the abnormal information in a mail mode. The exception report comprises two contents of a header and a body. And the header generates report name, report generation time and alarm group 3 part of content in a self-defined way. The report text comprises all the abnormal early warning details and the time trend graph of the abnormal index. And displaying the abnormity early warning details in a table form, wherein the abnormity early warning details comprise monitoring cluster names, early warning formula groups, time dimensions, category dimensions, monitoring index names, statistical values and abnormity rates, and sorting the monitoring cluster names, the early warning formula groups, the time dimensions, the category dimensions, the monitoring index names, the statistical values and the abnormity rates in a descending order according to the abnormity rates. The time trend graph of the abnormal index shows the trend of the statistical values corresponding to the latest 30 time dimensions of the index.
In the above, the data set collection module, the index statistical batching module, the early warning formula configuration module, the anomaly early warning module and the anomaly report generation module of the risk index automatic early warning system based on the expression engine form a unified closed loop, so that the automatic monitoring and early warning of tens of thousands of monitoring index systems are realized.
An expression engine based automatic risk indicator warning system for use in the method of any one of claims 1 to 6, comprising:
a dataset collection module: and automatically and regularly reading, integrating and summarizing bottom layer source data corresponding to the monitoring tasks from each business system through a plurality of modes such as a file mode, an API mode and the like according to a set batch rule according to the requirement of the monitoring tasks. The module completes the extraction of the source data set of the monitoring task.
Index statistics batch running module: and according to the monitoring index requirement set by the monitoring task, the system automatically processes the risk index based on the source data set. The invention abstracts a method for solidifying the template of the report index, based on which all the monitoring indexes can be processed in a classified batch mode, and the method is suitable for any monitoring scene. The module completes calculation of monitoring indexes of the monitoring task based on the source data set.
The early warning formula configuration module: and constructing an early warning formula set based on the monitoring indexes according to the service scenes corresponding to different monitoring tasks. The early warning formula refers to the abnormal condition of the monitoring index statistic value is defined in a configuration mode of an expression engine interface. The invention provides a method for setting 2 large-class early warning formulas, which is suitable for monitoring scenes. The module completes the setting and deployment of the early warning formula based on the monitoring index.
An abnormity early warning module: and according to batch running rules set by the monitoring tasks, deploying configured early warning formula vectors to the early warning formulas at regular time, carrying out batch operation, and generating an abnormal early warning record when any one-dimensional early warning formula is triggered. The module generates a series of exception records based on an early warning formula, each of which is an exception early warning message. }
An exception report generation module: and automatically generating an exception report according to a report template or a batch running rule set by the monitoring task and an exception early warning record triggered by an early warning formula group and an exception early warning module. The module realizes automatic generation of the abnormal early warning report, namely, the summarized early warning report, and automatically sends the report to related colleagues.
The system comprises a data set collection module, an index statistical batching module, an early warning formula configuration module, an abnormity early warning module and an abnormity report generation module which are 5 modules in total. The data set collection module integrates data tables from all the service systems, the index counting batch module carries out counting processing on risk indexes based on a sampled risk index monitoring system and the data sets, the early warning formula configuration module configures a risk index early warning formula through a system interface, and when the early warning formula is automatically batched, the abnormity early warning module carries out automatic early warning on the triggered early warning formula and generates a risk index abnormity expression report. The abnormity early warning module and the abnormity report generation module form a unified closed loop, automatic monitoring early warning of a monitoring index system in tens of thousands is realized, systematic automatic early warning prompt is realized when indexes are abnormal, and risks are automatically found in time.
It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential attributes thereof. The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference sign in a claim should not be construed as limiting the claim concerned.
The above-mentioned embodiments are only used for illustrating the technical solutions of the present invention, and not for limiting the same; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.
Claims (8)
1. A risk index automatic early warning method based on an expression engine is characterized by mainly comprising the following steps:
step 1: the batch running processor sets batch running time through a timer according to the monitoring index system and is used for carrying out batch running on the set batch running time of the source data table of each service system;
step 2: the monitoring index calculator forms a source data set based on a table structure of each source data according to monitoring index requirements set by a monitoring task, establishes a table structure corresponding to the original data set in a storage medium, and automatically processes risk indexes of the original data set according to the monitoring indexes;
and step 3: the formula memory constructs an early warning formula set based on monitoring indexes according to service scenes corresponding to different monitoring tasks, configures early warning formula vectors, and establishes a set data structure for storing the early warning formula set in a storage medium;
and 4, step 4: the formula calculator carries out batch operation based on the deployed and configured early warning formula vectors, configures warning information according to the abnormal early warning records, and the system automatically gives a warning according to the pre-configured content and generates abnormal early warning records;
and 5: and the system automatically generates an exception report according to the triggered exception early warning record.
2. The method of claim 1, wherein the setting batch time selects a T + n mode or an asynchronous processing mode for processing, wherein T time refers to a time when a service occurs, and T + n refers to an nth time interval unit after T time.
3. The method for automatic risk indicator early warning based on expression engine according to claim 1, wherein the step 2 specifically comprises:
step 2.1: abstracting an index statistical method, abstracting the index statistical method realized based on a database language into a plurality of dimensions, and forming a report index curing template based on the combination of the dimensions;
step 2.2: classifying the statistical index clusters, constructing a risk monitoring index system according to an industry mode and a business mode, and dividing the risk monitoring index system into different statistical index clusters according to different monitoring contents;
step 2.3: and counting the running batch of the index clusters, setting a timing task, calculating the monitoring index set of each cluster by the running batch, and storing the index sets of different clusters into different data tables.
4. The method for risk indicator automatic early warning based on expression engine as claimed in claim 1, wherein the early warning formula set in step 3 specifically includes a threshold anomaly early warning formula set and a fluctuation anomaly early warning formula set, and two corresponding data structures are respectively established in a storage medium.
5. The method for automatically warning the risk indicator based on the expression engine as claimed in claim 1, wherein when any one of the warning formulas in the step 3 is triggered, an abnormal warning record is correspondingly generated in the step 4.
6. The method for risk indicator automatic early warning based on expression engine as claimed in claim 1, wherein the alarm information includes alarm group, alarm mode and alarm content, the alarm group is a list composed of a series of alarm receivers; the alarm mode is a mode that when the early warning formula is triggered, the system informs the related personnel of the abnormal information; the alarm content is content information carried by the system informing the relevant personnel when the alarm is triggered.
7. An expression engine based automatic risk indicator early warning system for the method of any one of claims 1 to 6, comprising
A dataset collection module: extracting a source data set for completing a monitoring task;
index statistics batch running module: calculating monitoring indexes in the monitoring task based on the source data set extracted by the data set collection module;
the early warning formula configuration module: constructing an early warning formula set by monitoring indexes, and configuring an early warning formula vector;
an abnormity early warning module: performing batch operation based on the configured early warning formula vectors to generate abnormal early warning records;
an exception report generation module: and automatically generating an exception report according to the early warning formula group and the exception early warning record triggered by the exception early warning module.
8. The system for risk indicator automatic warning based on expression engine as claimed in claim 7, wherein the index statistical batching module includes 3 sub-modules of index statistical method abstraction, statistical index cluster classification and statistical index cluster batching.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111354217.9A CN114155085B (en) | 2021-11-12 | 2021-11-12 | Method and system for automatically early warning risk indexes based on expression engine |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111354217.9A CN114155085B (en) | 2021-11-12 | 2021-11-12 | Method and system for automatically early warning risk indexes based on expression engine |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114155085A true CN114155085A (en) | 2022-03-08 |
| CN114155085B CN114155085B (en) | 2024-08-06 |
Family
ID=80456460
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111354217.9A Active CN114155085B (en) | 2021-11-12 | 2021-11-12 | Method and system for automatically early warning risk indexes based on expression engine |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114155085B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114663893A (en) * | 2022-03-25 | 2022-06-24 | 李成卫 | Data identification method and system based on artificial intelligence and cloud platform |
| CN114970485A (en) * | 2022-06-21 | 2022-08-30 | 广发证券股份有限公司 | Industry data processing method and device, electronic equipment and storage medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112613789A (en) * | 2020-12-29 | 2021-04-06 | 太平金融科技服务（上海）有限公司 | Risk control data processing method and risk early warning rule prepositive data monitoring method |
| CN112861492A (en) * | 2021-01-27 | 2021-05-28 | 亿企赢网络科技有限公司 | Method and device for linkage calculation between internal tables of report table and electronic equipment |
| CN113326283A (en) * | 2021-06-21 | 2021-08-31 | 深圳前海微众银行股份有限公司 | Method and device for calculating service index |
| CN113361838A (en) * | 2020-03-04 | 2021-09-07 | 北京沃东天骏信息技术有限公司 | Business wind control method and device, electronic equipment and storage medium |
| CN113450067A (en) * | 2021-06-04 | 2021-09-28 | 杭州搜车数据科技有限公司 | Risk control method, device and system based on decision engine and electronic device |
-
2021
- 2021-11-12 CN CN202111354217.9A patent/CN114155085B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113361838A (en) * | 2020-03-04 | 2021-09-07 | 北京沃东天骏信息技术有限公司 | Business wind control method and device, electronic equipment and storage medium |
| CN112613789A (en) * | 2020-12-29 | 2021-04-06 | 太平金融科技服务（上海）有限公司 | Risk control data processing method and risk early warning rule prepositive data monitoring method |
| CN112861492A (en) * | 2021-01-27 | 2021-05-28 | 亿企赢网络科技有限公司 | Method and device for linkage calculation between internal tables of report table and electronic equipment |
| CN113450067A (en) * | 2021-06-04 | 2021-09-28 | 杭州搜车数据科技有限公司 | Risk control method, device and system based on decision engine and electronic device |
| CN113326283A (en) * | 2021-06-21 | 2021-08-31 | 深圳前海微众银行股份有限公司 | Method and device for calculating service index |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114663893A (en) * | 2022-03-25 | 2022-06-24 | 李成卫 | Data identification method and system based on artificial intelligence and cloud platform |
| CN114970485A (en) * | 2022-06-21 | 2022-08-30 | 广发证券股份有限公司 | Industry data processing method and device, electronic equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114155085B (en) | 2024-08-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110717828B (en) | Abnormal account detection method and system based on frequent transaction mode | |
| CN114155085B (en) | Method and system for automatically early warning risk indexes based on expression engine | |
| CN107810500A (en) | Data quality analysis | |
| CN112418738B (en) | Staff operation risk prediction method based on logistic regression | |
| CN118037469B (en) | Financial management system based on big data | |
| CN112950359B (en) | User identification method and device | |
| US20210125272A1 (en) | Using Inferred Attributes as an Insight into Banking Customer Behavior | |
| CN109858807A (en) | Enterprise operation monitoring method and system | |
| CN109614380A (en) | Log processing method, system, computer equipment and readable medium | |
| CN109583773A (en) | A kind of method, system and relevant apparatus that taxpaying credit integral is determining | |
| CN109522349B (en) | Cross-type data calculation and sharing method, system and equipment | |
| CN112258220A (en) | Information acquisition and analysis method, system, electronic device and computer readable medium | |
| CN116842110A (en) | Information pushing method and device, storage medium and computer equipment | |
| CN115423361A (en) | Data processing method and device for risk view, storage medium and equipment | |
| US8010942B1 (en) | Resilient application design and displaying design profile via graphical user interface | |
| CN115982158A (en) | Supervision data processing method, device, equipment and medium based on data mart | |
| CN115860465A (en) | Enterprise associated data processing early warning method, system and device | |
| CN113822715B (en) | Data acquisition, training and processing integrated platform analysis method | |
| CN112258095B (en) | Standard normal distribution based scoring method, device, equipment and storage medium | |
| CN114140241A (en) | Abnormity identification method and device for transaction monitoring index | |
| CN115271514A (en) | Communication enterprise monitoring method and device, electronic equipment and storage medium | |
| CN114897613A (en) | Abnormal transaction behavior detection method and system, electronic device and storage medium | |
| CN117522338B (en) | Sanitary inspection laboratory information management platform based on regional high-level supervision | |
| CN116645228B (en) | Preprocessing method and system for global civil aviation passenger ticket airport tax real-time calculation | |
| CN117974372A (en) | Method and system for carrying out people-mediated case early warning analysis based on mass data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |