CN115482099A

CN115482099A - Method for generating transaction event, related device, equipment and storage medium

Info

Publication number: CN115482099A
Application number: CN202110601839.0A
Authority: CN
Inventors: 陈瑜琨; 马延龙; 张健
Original assignee: Tenpay Payment Technology Co Ltd
Current assignee: Tenpay Payment Technology Co Ltd
Priority date: 2021-05-31
Filing date: 2021-05-31
Publication date: 2022-12-16

Abstract

The application discloses a method for generating transaction events, which comprises the following steps: responding to an event reporting request, and acquiring event information, wherein the event information comprises a target object name, a target clue description text and a target event type; determining thread truth and event importance according to the event information, wherein the thread truth represents the credibility of the event information, and the event importance represents the association degree of the transaction event and the sensitive content; determining a thread value grade according to the thread reality degree and the event importance degree; and if the clue value grade meets the event generation condition, generating a target transaction event. The application also discloses a device, equipment and a medium. In the application, the user can report the event information through a clue delivery channel, the background evaluates the event information, and the suspicious transaction event is directly generated after the evaluation is passed, so that the suspicious transaction event can be found more timely, and better early warning and prompting effects are achieved.

Description

Method for generating transaction event, related device, equipment and storage medium

Technical Field

The present application relates to the field of data processing technologies, and in particular, to a method, a related apparatus, a device, and a storage medium for generating a transaction event.

Background

In the digital economic era, along with the rapid development of cloud computing, artificial intelligence and block chain technologies, illegal transaction means are continuously renewed, and the concealment and the destructiveness of the illegal transaction means are continuously enhanced. Potential illegal transaction risks in the field of financial science and technology are worthy of attention, and how to effectively suppress illegal transactions and maintain financial security is a problem which is increasingly concerned by relevant departments and industries.

Currently, the generation of suspicious transaction events relies essentially on the identification of transaction monitoring models. Specifically, data modeling is carried out according to characteristics of different illegal transactions, various types of transaction monitoring models are established in the system, then suspicious transaction events hitting model rules are preliminarily screened out by the transaction monitoring models, and finally, manual auditing and reporting are carried out on the suspicious transaction events by an auditing side.

However, since the method of identifying transaction characteristics using a transaction monitoring model requires collection of a certain amount of data of transaction characteristics (e.g., transaction characteristics over several months), it is difficult to find suspicious transaction events in a timely manner, resulting in a large hysteresis in determining suspicious transaction events.

Disclosure of Invention

The embodiment of the application provides a transaction event generation method, a related device, equipment and a storage medium, a user can report event information through a clue delivery channel, and a background evaluates the event information, so that suspicious transaction events can be found more timely, and better early warning and prompting effects are achieved.

In view of the above, an aspect of the present application provides a method for generating a transaction event, including:

responding to an event reporting request, and acquiring event information, wherein the event information comprises a target object name, a target clue description text and a target event type;

determining thread truth and event importance according to the event information, wherein the thread truth represents the credibility of the event information, and the event importance represents the degree of association between the transaction event and the sensitive content;

determining the value grade of the clue according to the truth of the clue and the importance of the event;

and if the clue value grade meets the event generation condition, generating a target transaction event, wherein the target transaction event comprises a target object name, a target event type and the clue value grade.

Another aspect of the present application provides a transaction event generating apparatus, including:

the acquisition module is used for responding to the event reporting request and acquiring event information, wherein the event information comprises a target object name, a target clue description text and a target event type;

the determining module is used for determining thread truth and event importance according to the event information, wherein the thread truth represents the credibility of the event information, and the event importance represents the association degree of the transaction event and the sensitive content;

the determining module is also used for determining the thread value grade according to the thread truth and the event importance;

and the generating module is used for generating a target transaction event if the clue value level meets the event generating condition, wherein the target transaction event comprises a target object name, a target event type and a clue value level.

In one possible design, in another implementation manner of another aspect of the embodiment of the present application, the transaction event generating apparatus further includes a processing module and an execution module;

the processing module is used for performing word segmentation processing on the target clue description text to obtain M words, wherein M is an integer greater than or equal to 1;

the execution module is used for determining the thread truth and the event importance according to the event information if at least one word in the M words is successfully matched with the word in the word bank corresponding to the target event type;

the determining module is specifically used for determining the importance of the event according to the target clue description text and the type of the target event;

and determining the truth of the clue according to at least one item of the name of the target object, the type of the target event and the target transaction amount, wherein the target transaction amount is derived from the event information, or the target transaction amount is determined according to the historical transaction amount.

In one possible design, in another implementation of another aspect of an embodiment of the present application,

the determining module is specifically used for obtaining a sensitive word matching relationship corresponding to the target event type, wherein the sensitive word matching relationship comprises K sensitive words and a rating score corresponding to each sensitive word, and K is an integer greater than or equal to 1;

determining N sensitive words from the target clue description text according to K sensitive words included in the sensitive word matching relation, wherein N is an integer which is greater than or equal to 1 and less than or equal to M;

determining the coverage rate of the sensitive words according to the proportion of the N sensitive words in the M words;

determining the average rating score corresponding to the N sensitive words according to the rating score corresponding to each sensitive word included in the sensitive word matching relation;

and determining the importance of the event according to the coverage rate of the sensitive words and the average rating score.

the determining module is further used for acquiring a historical sample data set, wherein the historical sample data set comprises C groups of historical sample data, each group of historical sample data corresponds to one marking score, a coverage rate of a history sensitive word and a historical rating average score, and C is an integer greater than 1;

generating a first data matrix according to the mark score included by each group of historical sample data;

generating a second data matrix according to the coverage rate of the history sensitive words and the average score of the history ratings included by each group of history sample data;

determining a first coefficient and a second coefficient according to the first data matrix and the second data matrix;

the determining module is specifically configured to determine the event importance according to the sensitive word coverage, a first coefficient corresponding to the sensitive word coverage, the average rating score, and a second coefficient corresponding to the average rating score.

the device comprises a determining module, a processing module and a processing module, wherein the determining module is specifically used for acquiring a historical event information set in a preset period, the historical event information set comprises at least one piece of historical event information, and each piece of historical event information comprises an object name;

counting the target occurrence frequency of the target object name according to the historical event information set;

and determining a target frequency coefficient corresponding to the target occurrence frequency according to the mapping relation between the object name occurrence frequency and the frequency coefficient, and taking the target frequency coefficient as the clue truth degree.

and the determining module is specifically used for determining a target type coefficient corresponding to the target event type according to the mapping relation between the event type and the type coefficient, and taking the target type coefficient as the thread truth.

and the determining module is specifically used for determining a target amount coefficient corresponding to the target transaction amount according to the mapping relation between the transaction amount and the amount coefficient, and taking the target amount coefficient as the thread truth.

the determining module is specifically used for acquiring a historical event information set in a preset period, wherein the historical event information set comprises at least one piece of historical event information, and each piece of historical event information comprises an object name;

determining a target frequency coefficient corresponding to the target occurrence frequency according to the mapping relation between the object name occurrence frequency and the frequency coefficient;

determining a target type coefficient corresponding to the target event type according to the mapping relation between the event type and the type coefficient;

determining a target amount coefficient corresponding to the target transaction amount according to the mapping relation between the transaction amount and the amount coefficient;

and determining the truth of the clues according to the target frequency coefficient, the target type coefficient and the target amount coefficient.

the determining module is specifically used for determining the truth of the target clue according to the product of the truth of the clue and the first weight value;

determining the importance of the target event according to the product of the importance of the event and the second weight value;

and determining the thread value grade according to the target thread truth and the target event importance.

the obtaining module is specifically configured to receive an event reporting request sent by a first terminal device, and obtain event information, where the first terminal device is configured to provide a clue launching interface, and an object name input area, a clue description input area, and an event type input area are displayed on the clue launching interface.

In one possible design, in another implementation manner of another aspect of the embodiment of the present application, the transaction event generating apparatus further includes a sending module;

the sending module is used for sending the target transaction event to the second terminal device, wherein the second terminal device is used for providing an event generation interface, at least one transaction event is displayed on the event generation interface, and the at least one transaction event comprises the target transaction event.

In one possible design, in another implementation manner of another aspect of the embodiment of the present application, the transaction event generating apparatus further includes a receiving module;

the receiving module is used for receiving an event screening request sent by the second terminal device, wherein the event screening request carries at least one of the type of an object to be screened, the type of an event to be screened, the value grade of a clue to be screened and a time event to be screened;

and the sending module is further used for sending the event screening result to the second terminal equipment according to the event screening request so that the second terminal equipment displays the event screening result.

Another aspect of the present application provides a computer device, including: a memory, a processor, and a bus system;

wherein, the memory is used for storing programs;

a processor for executing the program in the memory, the processor for performing the above-described aspects of the method according to instructions in the program code;

the bus system is used for connecting the memory and the processor so as to enable the memory and the processor to communicate.

Another aspect of the present application provides a computer-readable storage medium having stored therein instructions, which when executed on a computer, cause the computer to perform the method of the above-described aspects.

In another aspect of the application, a computer program product or computer program is provided, the computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions to cause the computer device to perform the method provided by the above aspects.

According to the technical scheme, the embodiment of the application has the following advantages:

in the embodiment of the application, a transaction event generation method is provided, and the method comprises the steps of firstly responding to an event report request, obtaining event information, wherein the event information comprises a target object name, a target thread description text and a target event type, determining thread truth and event importance according to the event information, then determining thread value grade according to the thread truth and the event importance, and if the thread value grade is greater than or equal to a grade threshold value, generating a target transaction event, wherein the target transaction event is a suspicious transaction event. By the method, after the clue delivery channel is opened, the user can report the event information through the clue delivery channel, and the background evaluates the event information. If the evaluation is passed, the suspicious transaction event is directly generated, so that the suspicious transaction event can be found more timely, and better early warning and prompting effects are achieved.

Drawings

FIG. 1 is a schematic diagram of an environment of a transaction event generation system in an embodiment of the present application;

FIG. 2 is a schematic flow chart illustrating pushing suspicious transaction events according to an embodiment of the present application;

FIG. 3 is a schematic diagram of an embodiment of a transaction event generation method in the embodiment of the present application;

FIG. 4 is a flow diagram of natural language processing in an embodiment of the present application;

FIG. 5 is a schematic diagram of a thread delivery interface in an embodiment of the present application;

FIG. 6 is a schematic diagram of an event generation interface in an embodiment of the present application;

FIG. 7 is a schematic illustration of an event screening interface in an embodiment of the present application;

FIG. 8 is a schematic diagram of a transaction event generating device in an embodiment of the present application;

FIG. 9 is a schematic structural diagram of a server in the embodiment of the present application;

fig. 10 is a schematic structural diagram of a terminal device in the embodiment of the present application.

Detailed Description

The terms "first," "second," "third," "fourth," and the like in the description and in the claims of the present application and in the drawings described above, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the application described herein are, for example, capable of operation in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "corresponding" and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

The new business and new state of business are emerging, the means and types of illegal transactions tend to be complicated, and the work of anti-illegal transactions faces serious challenges due to multiple scenes, large range, scattered distribution and the like. Illegal transactions include acts of masking the source and nature of the illegal gains and the revenue they generate by various means, making them formally legitimate. Therefore, in order to more efficiently and more accurately discover suspicious transaction events, the method for generating transaction events provides a method for generating transaction events, which comprises the steps of constructing a search delivery platform, opening a clue reporting channel for individual users, internal employees of enterprises and the like, performing information aggregation and screening filtration on reported clues by using a data center, and generating suspicious transaction events by using high-value clues reported by the individual users and the internal employees of enterprises. Professional staff mainly excavates and analyzes the suspicious transaction events, judges the suspicious transaction events to be the suspicious transaction events with illegal transaction risks, and reports the suspicious transaction events according to the related illegal types, so that the purpose of 'reporting all people' is achieved.

Based on this, the present application provides a method for generating a transaction event, where the method is applied to a transaction event generating system shown in fig. 1, please refer to fig. 1, fig. 1 is an environment schematic diagram of the transaction event generating system in an embodiment of the present application, as shown in the figure, the transaction event generating system includes a server and a terminal device, and a client is disposed on the terminal device, where the client may run on the terminal device in a browser form, or may run on the terminal device in an Application (APP) form, and a specific presentation form of the client is not limited herein. The server related to the application can be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, and can also be a cloud server providing basic cloud computing services such as cloud service, a cloud database, cloud computing, a cloud function, cloud storage, network service, cloud communication, middleware service, domain name service, safety service, content Delivery Network (CDN), big data and an artificial intelligence platform. The terminal device may be a smart phone, a tablet computer, a notebook computer, a palm computer, a personal computer, a smart television, a smart watch, a vehicle-mounted device, a wearable device, and the like, but is not limited thereto. The terminal device and the server may be directly or indirectly connected through wired or wireless communication, and the application is not limited herein. The number of servers and terminal devices is not limited.

Illustratively, the terminal device includes a first terminal device and a second terminal device, wherein the first terminal device provides a clue reporting platform, the user inputs the event information through the clue reporting platform, and after the input is completed, the event information can be submitted to the server. The server analyzes the event information to obtain a cue value grade, and if the cue value grade is greater than or equal to a grade threshold value, a suspicious transaction event is generated. Then, the server pushes the suspicious transaction event to the second terminal device, the second terminal device provides a display platform of the suspicious transaction event, and professional staff check the suspicious transaction event on the display platform.

Based on the transaction event generating system shown in fig. 1, a flow for pushing a suspicious transaction event will be described below with reference to fig. 2, please refer to fig. 2, fig. 2 is a schematic flow diagram for pushing a suspicious transaction event in the embodiment of the present application, and as shown in the figure, specifically:

in step S1, the user triggers an event report request, and reports event information, that is, the suspicious illegal transaction content is attested.

In step S2, after the user reports the event information, the transaction event generating system performs a preliminary determination on the event information submitted by the user, that is, determines whether the event information reported by the user passes the preliminary screening, and if the content of the event information is complete, performs step S3. If the content of the event information is missing, step S1 is executed, that is, the incomplete event information is returned to the user, the user may choose to continue to complement and improve the event information, and after completion, the user may choose to release the event information again, or directly discard the release of the event information.

In step S3, for the case that the content of the event information is complete, a Natural Language Processing (NLP) technique in Artificial Intelligence (AI) is used to perform text preprocessing on the target thread description text in the event information, match the target thread description text with the target event type filled in by the user, and if the matching is successful, then step S4 is performed. Otherwise, if the matching fails, step S1 is executed, that is, the unmatched event information is returned to the user, the user may choose to verify the corrected event information, and after the completion, the user may choose to release the event information again, or directly discard the release of the event information.

In step S4, after noise in the target thread description text is filtered, the target thread description text is confirmed to be valuable information, and based on the valuable information, the thread value level of the event is determined according to the indexes such as the frequency of putting threads of the same object, the illegal degree and the transaction scale.

In step S5, if the thread value level is greater than or equal to the level threshold, a target transaction event is generated, and the target transaction event is a suspicious transaction event.

In step S6, the target transaction event is pushed to an anti-illegal transaction auditing place for auditing and reporting.

With reference to the above description, a method for generating a transaction event in the present application will be described below, and referring to fig. 3, an embodiment of the method for generating a transaction event in the present application includes:

101. responding to an event reporting request, and acquiring event information, wherein the event information comprises a target object name, a target clue description text and a target event type;

in one or more embodiments, the transaction event generating device responds to an event reporting request triggered by a user, so as to obtain event information reported by the user. The event information at least comprises a target object name, a target clue description text and a target event type. Wherein the target object name represents a subject name of a suspected illegal transaction, for example, "zhang san" belonging to a personal type, or "XXX limited" belonging to an institution type. The target clue description text represents the description of a suspected illegal transaction clue by a user, for example, "XXX company Limited opens a large amount of activity for exchanging virtual coins in XXX entertainment city". The target event type represents a related type suspected of illegal transactions, such as an "illegal operation" type or a "telecom fraud" type, etc.

It should be noted that the transaction event generating device may be disposed in a server, a terminal device, or a system formed by the server and the terminal device, and the present application is not limited thereto.

Illustratively, a user triggers an event reporting request through a first terminal device, so that the first terminal device feeds the event reporting request back to a server, and the server obtains event information corresponding to the request. Based on the method, after the server filters, screens and evaluates the event information, the server feeds back the suspicious transaction events to the second terminal device, and the second terminal device displays the suspicious transaction events. It is understood that the second terminal device and the first terminal device may be the same terminal device, or two different terminal devices. The first terminal device is used for providing a clue delivery interface, and the second terminal device is used for providing an event generation interface.

Illustratively, a user triggers an event reporting request through a first terminal device, so that the first terminal device directly acquires event information input by the user. Based on the method, after the first terminal device filters, screens and evaluates the event information, a suspicious transaction event is generated, and the suspicious transaction event is displayed by the first terminal device. It can be understood that the first terminal device is configured to provide a cue delivery interface, and trigger the event reporting request through the cue delivery interface. The first terminal device is also used for providing an event generation interface, and displaying the suspicious transaction events through the event generation interface.

It is emphasized that the user (i.e., the public) reports the event information through the clue delivery interface, and the professional staff checks the suspicious transaction event through the event generation interface, and the two types of interfaces have different oriented objects.

102. Determining thread truth and event importance according to the event information, wherein the thread truth represents the credibility of the event information, and the event importance represents the degree of association between the transaction event and the sensitive content;

in one or more embodiments, the transaction event generating device calculates the thread truth and the event importance respectively according to the event information reported by the user. Specifically, in the process of evaluating the value of an event, a means combining qualitative analysis and quantitative analysis can be adopted, wherein after the qualitative analysis, the clue truth is obtained, and after the quantitative analysis, the event importance is obtained, that is, the clue truth represents the credibility of the event information, and the event importance represents the degree of association between the transaction event and the sensitive content.

It is to be understood that sensitive content represents related content that may be related to illegal transactions, including but not limited to "points up," "banker," and "entertainment cities," among others.

103. Determining the value grade of the clue according to the truth of the clue and the importance of the event;

in one or more embodiments, the transaction event generating device calculates a cue value grade according to the cue truth degree and the event importance degree. Illustratively, the clues may be computed as follows:

Z＝A*I；

wherein Z represents the value of the clue, A represents the truth of the clue, and I represents the importance of the event. Therefore, the value of the thread is positively correlated with the truth of the thread, and the value of the thread is also positively correlated with the importance of the event. Further, a corresponding cue value level may be determined based on the cue value.

In one implementation, the larger the cue value, the higher the corresponding cue value level, i.e., the greater the value representing the event information reported by the user. For example, if the cue value level is level 5, it indicates that the event information reported by the user has a high mining value, and if the cue value level is level 1, it indicates that the event information reported by the user has no further mining value.

In another implementation, the larger the cue value, the lower the cue value level, i.e. the higher the value of the event information reported by the user. For example, if the cue value level is level 1, it indicates that the event information reported by the user has a high mining value, and if the cue value level is level 5, it indicates that the event information reported by the user does not have a further mining value.

104. And if the clue value grade meets the event generation condition, generating a target transaction event, wherein the target transaction event comprises a target object name, a target event type and the clue value grade.

In one or more embodiments, if the thread value level satisfies the suspicious event generation condition, the event information is considered to have a pushed value, and based on this, the transaction event generation device generates a target transaction event according to the event information, wherein the target transaction event is the suspicious transaction event.

In one implementation, assuming that the cue value levels are divided into 5 levels, where level 1 is the highest level and level 5 is the lowest level, based on which a higher cue value is considered to be had if the cue value level is less than or equal to a level threshold, which may be, for example, level 4.

In another implementation, assuming that the cue value levels are divided into 5 levels, where 5 is the highest level and 1 is the lowest level, based on which a higher cue value is considered to be had if the cue value level is greater than or equal to a level threshold, for example, the level threshold may be level 1.

Therefore, the suspicious event generation condition is related to the classification mode of the thread value grade. Specifically, after the target transaction event is generated, the target transaction event can be pushed to the professional staff, so at least the target object name, the target event type and the thread value level need to be included in the target transaction event. Therefore, the professional staff can further select whether the target transaction event needs to be pushed to the related auditing department according to the thread value grade, and the related auditing department performs review and processing on the target transaction event.

In the embodiment of the application, a method for generating a transaction event is provided, and through the method, after a clue delivery channel is opened, a user can report event information through the clue delivery channel, and a background evaluates the event information. If the evaluation is passed, the suspicious transaction event is directly generated, so that the suspicious transaction event can be found more timely, and better early warning and prompting effects are achieved.

Optionally, on the basis of one or more embodiments corresponding to fig. 3, another optional embodiment provided in the embodiments of the present application may further include:

performing word segmentation processing on the target clue description text to obtain M words, wherein M is an integer greater than or equal to 1;

if at least one word in the M words is successfully matched with the word in the word bank corresponding to the target event type, executing a step of determining the thread truth and the event importance according to the event information;

determining the thread truth and the event importance according to the event information, which may specifically include:

determining the importance of the event according to the target clue description text and the type of the target event;

In one or more embodiments, a manner is presented by which to determine the truth of cues and the importance of events in conjunction with event information. After the transaction event generating device acquires the event information, the event information needs to be filtered, that is, if the target clue description text included in the event information does not hit the thesaurus corresponding to the target event type, the event information reported by the user is considered to have no value for further detection, and therefore, the event information can be directly filtered.

The manner in which the target thread description text is preprocessed will be described below in conjunction with fig. 4. For ease of understanding, please refer to fig. 4, in which fig. 4 is a schematic flowchart of the natural language processing in the embodiment of the present application, and specifically:

in step A1, an original text is obtained, where the original text is a target cue description text.

In step A2, the target cue description text is participled, for example, in chinese participle, a word segmentation method based on string matching (e.g., forward maximum matching method, reverse maximum matching method, least segmentation method, or two-way maximum matching method) may be used, or a word segmentation method based on statistics (e.g., N-gram model, hidden markov model, maximum entropy model, or conditional random field model) may be used, or a word segmentation method based on understanding (e.g., jieba (jieba) word segmentation) may be used.

In step A3, the partitioned result is cleaned, i.e. useless information, special text, stop words, etc. are cleaned.

In step A4, after the M words are obtained after the cleaning, the M words are subjected to a normalization process, that is, a stem extraction, a part of speech reduction, and the like are performed.

In step A5, feature extraction is performed on each word, so as to obtain a word vector of each word.

In an implementation manner, in combination with the above process, a corresponding lexicon may be obtained according to the type of the target event, where the lexicon includes at least one sensitive word. Based on this, each word in the M words is directly compared with each sensitive word in the word stock, and the fact that the sensitive word is 'top-scoring' exists in the word stock is assumed, and one word in the M words is 'top-scoring', namely, the matching is successful is represented, so that the event information can be continuously analyzed.

In another implementation manner, in combination with the above process, a corresponding thesaurus may be obtained according to the type of the target event, where the thesaurus includes at least one sensitive word. Based on the similarity, similarity calculation is carried out on the word vector of each word in the M words and the word vector of each sensitive word in the word stock, if the similarity is larger than or equal to the similarity threshold value, matching is successful, and therefore the event information can be continuously analyzed.

After the transaction event generating device determines to continue analyzing the event information, the event importance degree needs to be determined according to the target clue description text and the target event type, and the clue truth degree needs to be determined according to at least one of the target object name, the target event type and the target transaction amount, so that the transaction event generating device calculates the clue value grade according to the event importance degree and the clue truth degree.

Secondly, in the embodiment of the application, a mode for determining the truth of a clue and the importance of the event by combining event information is provided, and through the mode, a target clue description text reported by a user needs to be initially tested, and event information irrelevant to suspicious transactions is filtered, so that the interference of noise point information on subsequent detection can be effectively reduced, and on the other hand, the noise point information does not need to be further detected, so that the detection efficiency is improved.

Optionally, on the basis of one or more embodiments corresponding to fig. 3, in another optional embodiment provided by the embodiment of the present application, the determining the importance of the event according to the target cue description text and the target event type may specifically include:

acquiring a sensitive word matching relation corresponding to a target event type, wherein the sensitive word matching relation comprises K sensitive words and a rating score corresponding to each sensitive word, and K is an integer greater than or equal to 1;

In one or more embodiments, a way to determine event importance based on target cue description text is presented. As can be seen from the foregoing embodiments, the event importance is a result of "quantitative analysis", and the greater the event importance, the deeper the association degree of the event information related to the sensitive content.

Specifically, first, the transaction event generating device may determine a corresponding sensitive word matching relationship according to a target event type included in the event information. Wherein, different event types often correspond to different sensitive word matching relations. Exemplarily, the target event type is a "telecom fraud" type as an example. For ease of understanding, please refer to table 1, where table 1 is an illustration of a matching relationship between a target event type and a sensitive word.

TABLE 1

As can be seen from table 1, the sensitive word matching relationship corresponding to the target event type includes 9 sensitive words (i.e., K is 9) and a rating score corresponding to each sensitive word. Based on the method, after the target clue description text is segmented, the obtained M words are respectively subjected to character string matching with the sensitive words included in the sensitive word matching relation. Assuming that N (N is less than or equal to M) words in the target clue description text hit the sensitive words in the sensitive word matching relationship corresponding to the target event type, calculating the sensitive word coverage rate by adopting the following method:

Q＝N/M；

q represents the coverage rate of the sensitive words, N represents the number of words successfully matched with the sensitive words in the target clue description text, and M represents the total number of words of the target clue description text after word segmentation.

Meanwhile, the rating score corresponding to each sensitive word can be determined according to the sensitive word matching relationship, and the rating scores are usually set based on empirical values. Based on this, the rating mean score may be calculated as follows:

W＝S/N；

wherein W represents the average rating score, S represents the sum of the rating scores corresponding to the N terms, and N represents the number of terms successfully matched with the sensitive terms in the target clue description text. Exemplarily, assuming that N terms successfully matched with the sensitive term in the target lead description text are "transfer", "download" and "collect", respectively, the sum of the rating scores corresponding to the N terms is 6 (i.e., 3+2+ 1).

According to the coverage rate of the sensitive words and the average rating score, the event importance can be calculated in the following way:

I＝Q+W；

wherein I represents the event importance, Q represents the sensitive word coverage, and W represents the average rating score.

In the embodiment of the application, a method for determining the importance of an event based on a target cue description text is provided, and through the method, a pre-constructed sensitive word matching relationship is combined, where the sensitive word matching relationship includes a sensitive word and a rating score corresponding to the sensitive word, so that according to the condition that the target cue description text hits the sensitive word, the coverage rate of the sensitive word and the rating average score are respectively determined, and the coverage rate of the sensitive word and the rating average score are used as criteria for evaluating the truth of the cue, on one hand, the number of sensitive contents possibly related in the target cue description text reported by a user can be considered, on the other hand, the depth related to the sensitive contents is measured by combining the preset rating score, that is, the degree of association between the target cue description text and the sensitive contents is evaluated from different dimensions, and thus the reliability of the importance of the event is improved.

Optionally, on the basis of one or more embodiments corresponding to fig. 3, in another optional embodiment provided in the embodiments of the present application, the method may further include:

acquiring a historical sample data set, wherein the historical sample data set comprises C groups of historical sample data, each group of historical sample data corresponds to a marking score, a coverage rate of a historical sensitive word and a historical rating average score, and C is an integer greater than 1;

generating a second data matrix according to the coverage rate of the history sensitive words and the average score of the history ratings included in each group of history sample data;

determining the event importance according to the sensitive word coverage rate and the rating average score, which specifically includes:

and determining the importance of the event according to the coverage rate of the sensitive words, a first coefficient corresponding to the coverage rate of the sensitive words, the average rating score and a second coefficient corresponding to the average rating score.

In one or more embodiments, a manner of calculating event importance is presented. As can be seen from the foregoing embodiments, the event importance is related to the coverage of the sensitive word and the average rating score, and in order to increase the confidence level, a corresponding weight value, i.e. a first coefficient, may be set for the coverage of the sensitive word, and a corresponding weight value, i.e. a second coefficient, may be set for the average rating score. The first coefficient and the second coefficient may be set according to empirical values, and may also be derived based on a historical sample data set, and how to derive the first coefficient and the second coefficient using the historical sample data set will be described below.

Specifically, the event importance is calculated as follows:

I＝Q*a1+W*a2；

wherein I represents the event importance, Q represents the sensitive word coverage, a1 represents a first coefficient, W represents the rating mean score, and a2 represents a second coefficient.

The sensitive word coverage is calculated as follows:

Q＝N/M；

the rating mean score is calculated as follows:

W＝S/N；

the calculation method for obtaining the event importance degree by combining the above formula is as follows:

the method comprises the steps of obtaining a target clue description text, obtaining a rating score corresponding to the target clue description text, and obtaining a rating score corresponding to the target clue description text, wherein I represents the event importance, N represents the number of words successfully matched with sensitive words in the target clue description text, M represents the total number of words after word segmentation processing of the target clue description text, a1 represents a first coefficient, S represents the sum of the rating scores corresponding to the N words, and a2 represents a second coefficient.

Based on the above, a historical sample data set is obtained, wherein the historical sample data set comprises C groups of historical sample data, each group of historical sample data corresponds to a marking score obtained through manual review scoring, and the value range of the marking score can be 1 to 100. Therefore, the first data matrix Y is generated according to the mark score included in each group of history sample data. The first data matrix Y may be represented as:

wherein, Y represents the first data matrix, C represents the total number of the history sample data in the history sample data set, and C is an integer greater than 1.

And generating a second data matrix X by combining the coverage rate of the history sensitive words and the average score of the history ratings included in each group of history sample data. The second data matrix X may be represented as:

wherein X represents a second data matrix,

representing the history sensitive word coverage in the set 1 history sample data,

representing the average score of the history ratings in the 1 st set of history sample data,

representing the history sensitive word coverage in the set 2 history sample data,

representing the average score of the historical ratings in the set 2 of historical sample data. By analogy, the second data matrix consists of C groups of history sensitive word coverage rates and history rating average scores.

Therefore, according to the first data matrix and the second data matrix, the following formula is obtained through conversion:

where a1 denotes a first coefficient and a2 denotes a first coefficient.

Representing the matrix to be solved. The matrix to be solved canExpressed as:

U＝(X ^T *X) ^-1 *X ^T *Y；

wherein, U represents a matrix to be solved, Y represents a first data matrix, and X represents a second data matrix. Based on this, the values of the first coefficient a1 and the second coefficient a2 are solved by a method of multiple linear regression. And substituting the first coefficient a1 and the second coefficient a2 into a calculation formula of the event importance to obtain the event importance.

Further, in the embodiment of the present application, a method for calculating event importance is provided, in which a reasonable first coefficient and a reasonable second coefficient are derived by using relevant data in a historical sample data set, and the event importance calculated by combining the first coefficient and the second coefficient has higher reliability.

Optionally, on the basis of one or more embodiments corresponding to fig. 3, in another optional embodiment provided by the embodiment of the present application, the determining the truth of the thread according to at least one of the name of the target object, the type of the target event, and the amount of the target transaction may specifically include:

acquiring a historical event information set in a preset period, wherein the historical event information set comprises at least one piece of historical event information, and each piece of historical event information comprises an object name;

and determining a target frequency coefficient corresponding to the target occurrence frequency according to the mapping relation between the object name occurrence frequency and the frequency coefficient, and taking the target frequency coefficient as the clue truth.

In one or more embodiments, a manner is described for determining the truth of a cue based on the frequency of occurrence of a target in the name of the target object. According to the foregoing embodiments, the truth of the clues is the result of the "qualitative analysis", and the greater the truth of the clues, the higher the confidence level of the event information is.

Specifically, the transaction event generating device first obtains a historical event information set within a preset period, where the preset period may be a period of time, for example, within 1 year or within half a year, and the like, and is not limited herein. The historical event information set comprises at least one piece of historical event information, the historical event information in the historical event information set is valid event information, and each piece of historical event information comprises an object name. Therefore, the frequency of the target object name in the historical event information set is counted, and the frequency of the target object name is obtained. For example, the target object name is "XXX limited", and the historical event information set includes 200 pieces of historical event information, where there are 4 pieces of historical event information whose object names are "XXX limited", that is, the target frequency of occurrence is 4.

Based on the method, the target frequency coefficient corresponding to the target occurrence frequency can be determined according to the mapping relation between the object name occurrence frequency and the frequency coefficient. For easy understanding, please refer to table 2, where table 2 is an illustration of a mapping relationship between occurrence frequency and frequency coefficient of an object name.

TABLE 2

It should be noted that the mapping relationship between the occurrence frequency and the frequency coefficient of the object name shown in table 2 is only an illustration, and should not be construed as a limitation of the present application. For example, assuming that the frequency of occurrence of the target is 4, based on the mapping shown in table 2, it may be determined that the corresponding target frequency coefficient should be 0.625, and thus, the target frequency coefficient may be taken as the clue trueness, i.e., the clue trueness is 0.625.

It can be understood that, each organization may adjust the mapping relationship between the frequency of occurrence and the frequency coefficient of the same object name according to its business condition, for example, if the object a is reported, the frequency coefficient corresponding to the frequency of occurrence of the object a may be increased in a next period of time.

Optionally, in the process of counting the target occurrence frequency of the target object name, historical event information consistent with the target event type may be further filtered from the historical event information set in combination with the target event type. Then, the frequency of occurrence of the target object name is determined in the part of historical event information, and the frequency of occurrence of the target is obtained.

In the embodiment of the application, a method for determining the truth of the clue based on the target occurrence frequency of the target object name is provided, and by the method, the target frequency coefficient corresponding to the target occurrence frequency can be determined by combining the mapping relation between the object name occurrence frequency and the frequency coefficient, and the target frequency coefficient is used as the truth of the clue based on the target frequency coefficient, so that the influence of the occurrence frequency of the object name on the credibility of the judgment event information can be better reflected, and the reliability of the truth of the clue is improved.

Optionally, on the basis of one or more embodiments corresponding to fig. 3, in another optional embodiment provided by the embodiment of the present application, determining the truth of the thread according to at least one of the name of the target object, the type of the target event, and the amount of the target transaction may specifically include:

and determining a target type coefficient corresponding to the target event type according to the mapping relation between the event type and the type coefficient, and taking the target type coefficient as the thread truth.

In one or more embodiments, a manner of determining the truth of a cue based on the type of target event is presented. According to the foregoing embodiments, the truth of the clues is the result of the "qualitative analysis", and the greater the truth of the clues, the higher the confidence level of the event information is.

Specifically, first, the transaction event generating device obtains a target event type from the event information, for example, the target event type is a "telco fraud" type. Based on the method, the target type coefficient corresponding to the target event type can be determined according to the mapping relation between the event type and the type coefficient. For ease of understanding, please refer to table 3, where table 3 is an illustration of a mapping relationship between event types and type coefficients.

TABLE 3

Event type	Coefficient of type
		Telecommunications fraud
	3
		Illegal management	2
Others	1

It should be noted that the mapping relationship between the event type and the type coefficient shown in table 3 is only an illustration, and should not be construed as a limitation of the present application. Exemplarily, assuming that the target event type is "telco fraud", based on the mapping relationship shown in table 3, it may be determined that the corresponding target type coefficient should be 3, and thus, the target type coefficient may be taken as the thread trueness, i.e., the thread trueness is 3.

It can be understood that the mapping relationship between the event type and the type coefficient is relatively fixed, the value range of the type coefficient shown in table 3 is 1, 2, or 3, and in practical application, other value ranges of the type coefficient may also be set, which is not limited herein.

In the embodiment of the application, a method for determining the thread truth based on the target event type is provided, and by the method, the target type coefficient corresponding to the target event type can be determined by combining the mapping relation between the event type and the type coefficient, and based on the target type coefficient, the target type coefficient is used as the thread truth, so that the influence of the event type on the credibility of the event information can be better embodied, and the reliability of the thread truth is improved.

and determining a target amount coefficient corresponding to the target transaction amount according to the mapping relation between the transaction amount and the amount coefficient, and taking the target amount coefficient as the thread truth.

In one or more embodiments, a manner of determining the truth of a lead based on a target transaction amount is presented. According to the foregoing embodiments, the truth of the clues is the result of the "qualitative analysis", and the greater the truth of the clues, the higher the confidence level of the event information is.

Specifically, first, the transaction event generating device acquires a target transaction amount, for example, the target transaction amount is "80 ten thousand dollars". In one case, the user can directly report the target transaction amount, namely the event information carries the target transaction amount input by the user, and in the other case, the corresponding historical transaction amount is obtained according to the name of the target object, then the average value of the historical transaction amounts is calculated, and the average value is used as the target transaction amount. Based on the mapping relation between the tradable amount and the amount coefficient, the target amount coefficient corresponding to the target transaction amount is determined. For ease of understanding, please refer to table 4, which is an illustration of a mapping between transaction amounts and amount coefficients.

TABLE 4

Amount of transaction	Coefficient of amount of money
		0 to 10 ten thousand yuan	1
10 ten thousand yuan to 50 ten thousand yuan	1.5
		50 ten thousand yuan to 100 ten thousand yuan	2
100 ten thousand yuan to 500 ten thousand yuan	2.5
		Over 500 ten thousand yuan	3

It should be noted that the mapping relationship between the transaction amount and the amount coefficient shown in table 4 is only an illustration, and should not be construed as a limitation of the present application. For example, assuming that the target transaction amount is "80 ten thousand yuan", based on the mapping shown in table 4, it may be determined that the corresponding target amount coefficient should be 2, and thus, the target amount coefficient may be taken as the thread trueness, i.e., the thread trueness is 2.

It can be understood that the mapping relationship between the transaction amount and the amount coefficient is relatively fixed, the value ranges of the amount coefficient shown in table 4 are 1, 1.5, 2, 2.5, and 3, and in practical applications, other types of value ranges of the coefficient may also be set, which is not limited herein.

In the embodiment of the application, a way for determining the truth of the clue based on the target transaction amount is provided, and by the way and in combination with the mapping relation between the transaction amount and the amount coefficient, the target amount coefficient corresponding to the target transaction amount can be determined, and based on the target amount coefficient, the target amount coefficient is used as the truth of the clue, so that the influence of the amount coefficient on the credibility of the judgment event information can be better reflected, and the reliability of the truth of the clue is improved.

according to the historical event information set, counting the target occurrence frequency of the target object name;

In one or more embodiments, a manner is described by which the truth of a thread is jointly determined based on the target frequency of occurrence of the target object name, the target event type, and the target transaction amount.

Specifically, it can be seen from the foregoing embodiment that the transaction event generating device obtains a historical event information set in a preset period, and then counts the occurrence frequency of the name of the target object in the historical event information set, so as to obtain the occurrence frequency of the target. And then combining the mapping relation between the object name occurrence frequency and the frequency coefficient shown in the table 2 to obtain the target frequency coefficient. The transaction event generating device acquires the target event type from the event information, and based on the target event type, the target type coefficient corresponding to the target event type can be determined according to the mapping relation between the event type and the type coefficient. The transaction event generating device also needs to acquire a target transaction amount, and based on the target transaction amount, a target amount coefficient corresponding to the target transaction amount is determined according to the mapping relation between the tradable amount and the amount coefficient.

And finally, calculating the thread truth degree by adopting the following modes according to the target frequency coefficient, the target type coefficient and the target amount coefficient:

A＝k*t*p；

wherein A represents the thread truth, k represents the target frequency coefficient, t represents the target type coefficient, and p represents the target amount coefficient. Taking the coefficients shown in table 2, table 3, and table 4 as examples, the value range of the thread truth is 0.5 to 9. It is understood that the range of the truth of the clue may also vary according to the variation of the coefficient, which is only an illustration here and should not be construed as a limitation of the present application. The thread reality degree is in positive correlation with the target frequency coefficient, the target type coefficient and the target amount coefficient.

Thirdly, in the embodiment of the application, a way for jointly determining the truth of the thread based on the target occurrence frequency of the target object name, the target event type and the target transaction amount is provided, through the way, the target frequency coefficient corresponding to the target occurrence frequency can be determined by combining the mapping relation between the object name occurrence frequency and the frequency coefficient, the target type coefficient corresponding to the target event type can be determined by combining the mapping relation between the event type and the type coefficient, and the target amount coefficient corresponding to the target transaction amount can be determined by combining the mapping relation between the transaction amount and the amount coefficient.

Optionally, on the basis of one or more embodiments corresponding to fig. 3, in another optional embodiment provided by the embodiment of the present application, determining the cue value level according to the cue truth and the event importance may specifically include:

determining the truth of the target clue according to the product of the truth of the clue and the first weight value;

determining the importance of the target event according to the product of the event importance and the second weight value;

In one or more embodiments, a manner is presented to determine a cue value rating based on the target cue truth and target event importance. As can be seen from the foregoing embodiments, after obtaining the thread truth and the event importance, the target thread truth and the target event importance can be further calculated according to the weight values assigned thereto.

Specifically, the transaction event generating device may calculate the cue value in the following manner:

Z＝α*A+β*I；

wherein Z represents a thread value, A represents a thread truth, I represents an event importance, alpha represents a first weight value, beta represents a second weight value, alpha A represents a target thread truth, and beta I represents a target event importance. Based on the relationship, the thread value grade is positively correlated with the truth of the target thread, and the thread value grade is also positively correlated with the importance of the target event. Illustratively, if α is greater than β (e.g., α =0.7, β = 0.3), then it represents the impact of more attentive cue truth. Illustratively, if β is greater than α (e.g., β =0.7, α = 0.3), it represents the influence of the importance of the event of greater concern.

Therefore, the transaction event generating device can further determine the corresponding clue value grade according to the clue value. If the value of the clue is less than b0 (b 0 is a constant), the event information is judged to be false event information, namely, the target clue description text is invalid. If the thread value is greater than or equal to b0, the event information is judged to be true event information, namely, the target thread description text is effective. Based on the method, the cue value grade can be determined according to the specific values of the cue values.

In one implementation, the larger the cue value, the higher the corresponding cue value level, i.e., the greater the value representing the event information reported by the user. For ease of understanding, please refer to table 5, wherein table 5 is an illustration of the mapping relationship between the cue value and the cue value level.

TABLE 5

It should be noted that the mapping relationship between the cue value and the cue value rank shown in table 5 is only an illustration, and should not be construed as limiting the application. If the cue value grade is greater than or equal to the grade threshold, a corresponding target transaction event (i.e. suspicious transaction event) is generated, it can be understood that the grade threshold can be set to be grade 1, or can be set according to the actual situation, which is not limited herein.

In another implementation, the larger the cue value, the lower the cue value level, i.e. the higher the value of the event information reported by the user. For ease of understanding, please refer to table 6, wherein table 6 is another illustration of the mapping relationship between cue value and cue value level.

TABLE 6

Relationship of clue value to b	Thread value rating
		Z∈(b0,b1]	5
Z∈(b1,b2]	4
		Z∈(b2,b3]	3
Z∈(b3,b4]	2
		Z∈(b4,b5]	1
Z∈(b5,+∞]	0

It should be noted that the mapping relationship between the cue value and the cue value level shown in table 6 is only an illustration, and should not be construed as a limitation of the present application. If the cue value level is less than or equal to the level threshold, the corresponding target transaction event (i.e. suspicious transaction event) is generated, it is understood that the level threshold may be set to 4 levels, or may be set according to the actual situation, which is not limited herein.

Secondly, in the embodiment of the application, a way of determining a thread value grade based on the target thread truth and the target event importance is provided, and through the way, a thread value grade is calculated by using the target thread truth and a first weighted value corresponding to the target thread truth and a second weighted value corresponding to the target event importance, so that the feasibility and operability of the scheme are improved. In addition, the rationality of the thread value grade can be increased by measuring the thread truth and the event importance together, for example, an event message with high thread truth but low related transaction amount or supervision attention degree, or an event message with high event importance but insufficient proof material cannot determine whether the thread is true, so that comprehensive assessment needs to be performed by combining the thread truth and the event importance.

Optionally, on the basis of one or more embodiments corresponding to fig. 3, in another optional embodiment provided in the embodiment of the present application, the acquiring event information in response to the event reporting request may specifically include:

the method comprises the steps of receiving an event reporting request sent by a first terminal device and obtaining event information, wherein the first terminal device is used for providing a clue releasing interface, and an object name input area, a clue description input area and an event type input area are displayed on the clue releasing interface.

In one or more embodiments, a way to input time information based on a cue delivery interface is presented. Taking the example that the transaction event generating device is deployed in the server, after the transaction event generating device receives the event reporting request sent by the first terminal device, the event information can be obtained based on the event reporting request, where the first terminal device is a terminal device used by the user, and therefore the first terminal device needs to develop a front-end interface, that is, a clue releasing interface is provided, and the event information released by the user is received through the clue releasing interface. Related information is called through a transaction event generating device (namely a data center) according to data filled in a clue putting interface, a risk event is formed in an aggregating mode, after system detection and evaluation, noise points in the risk event are filtered, a target transaction event is generated, and manual auditing and reporting are carried out on the target transaction event through an auditing side.

Specifically, for the convenience of understanding, please refer to fig. 5, fig. 5 is a schematic diagram of a cue delivery interface in an embodiment of the present application, and as shown in the figure, a plurality of input areas are provided on the cue delivery interface, where B1 is used to indicate an object name input area, B2 is used to indicate a cue description input area, B3 is used to indicate an event type input area, and B4 is used to indicate a "submit" control. The user needs to input a target object name of suspected illegal transaction, for example, "zhang san" or "a limited company" in the object name input area indicated by B1, and accordingly, the user needs to select an object type, for example, "zhang san" belongs to a "personal" type, and "a limited company" belongs to a "institution" type. The user needs to fill in the thread description input area indicated by B2 with the target thread description text of suspected illegal transaction, for example, "call transfer request by three times". The user needs to select or input the target event type of the suspected illegal transaction in the piece type input area indicated by B3.

In addition, the user may fill in other relevant information. For example, the user may input a certificate number of a suspected illegal transaction, for example, an identity number or an organization code of a personal object, etc., within the "certificate number" input region. For example, the user may input a cell phone number of a suspected illegal transaction in a "cell phone number" input area. Illustratively, the user may enter information about the suspected illegal transaction, such as an enterprise identification number, etc., within the "other information" entry area. For example, the user may input whether the user has traded with an object suspected of illegal trading within the "do not trade" input area. For example, the user may enter the time when the user trades with an object suspected of being traded illegally in a "trading time" input field, e.g., "16/10/2020. For example, the user may input an amount of the user's transaction with an object suspected of being an illegal transaction, for example, "50 ten thousand" in the "transaction amount" input area. Illustratively, the user may upload promotional material, such as pictures, videos, audio, files, and the like, within the "promotional material" input area.

And finally, the user can upload the proof materials according to the actual mastering condition, and after the proof materials are filled, the user clicks a 'submitting' control indicated by the B4, namely, an event reporting request is triggered.

It should be noted that the thread delivery interface shown in fig. 5 is only one schematic, and in practical applications, each payment mechanism may adjust the thread delivery interface according to its own payment service scenario, product characteristics, user preferences, and the like, newly add some sub-items for collecting threads, and combine the actual conditions of each payment mechanism to achieve comprehensiveness, effectiveness, and matching of thread collection. For example, payment service scenes of payment mechanisms are added, transaction scenes include but are not limited to red envelope, account transfer, two-dimensional code scanning payment and the like, namely the service scenes of the payment mechanisms can be listed and can be selected by users. For another example, product characteristics including, but not limited to, account nicknames, avatars, signatures, etc. may be added, i.e., the product characteristics of the mechanism may be listed and given the user the option. As another example, a specific process of mastering illegal transaction leads is added. For example, there are increasing regions, including but not limited to nationwide, provincial, municipal, and regional areas, that is, regions affected by illegal transactions.

Secondly, in the embodiment of the application, a way of inputting time information based on a clue putting interface is provided, through the way, a user can actively report event information which is considered to be suspicious, and the reported event information comprises a target object name, a target clue description text and a target event type, so that the obtained illegal transaction clues are richer and more reliable, the accuracy of the generated suspicious transaction event is higher, and the method is beneficial to covering wider transaction types.

and sending the target transaction event to a second terminal device, wherein the second terminal device is used for providing an event generation interface, at least one transaction event is displayed on the event generation interface, and the at least one transaction event comprises the target transaction event.

In one or more embodiments, a manner of displaying a targeted transaction event based on an event generation interface is presented. Taking the example that the transaction event generating device is deployed in the server, after the transaction event generating device receives an event reporting request sent by the first terminal device, the transaction event generating device may obtain event information based on the event reporting request, where the first terminal device is a terminal device used by a user, and the first terminal device provides a clue delivery interface. Therefore, the event information reporting the delivery by the user is received through the clue delivery interface. And calling related information for detection and evaluation by a transaction event generating device (namely a data center station) according to the data filled in the clue putting interface, and filtering noise points in the risk event to generate a target transaction event. Based on the method, the second terminal device can request to display the target transaction events, wherein the second terminal device is a terminal device used by a professional staff, and therefore the target transaction events can be displayed through the event generation interface after the second terminal device receives the target transaction events.

It is to be appreciated that other suspicious transaction events can be presented on the event generation interface, not limited to the target transaction event, and that at least one suspicious transaction event provided by the event generation interface will be described below with reference to fig. 6, wherein the at least one suspicious transaction event can include the target transaction event.

Specifically, for convenience of understanding, please refer to fig. 6, where fig. 6 is a schematic diagram of an event generation interface in an embodiment of the present application, and as shown in the drawing, a plurality of suspicious transaction events are provided on the event generation interface, where C1 is used to indicate a "push-to-push" control, and after a user clicks the "push-to-push" control, all suspicious transaction events displayed on the event generation interface can be pushed to relevant departments for auditing. And C2 is used for indicating an event selection control, and a user can screen out part of suspicious transaction events for viewing after clicking the event selection control. And C9 is used for indicating the previous page control, and the user can jump to the previous page for displaying after clicking the previous page control. C10 is used to indicate the current page, e.g., page 2. And C11 is used for indicating a next page control, and the user can jump to the previous page for displaying after clicking the next page control.

Further, C3 is used to indicate an automatically generated event number, where each suspicious transaction event has a separate event number, e.g., "20210205XXX01". C4 is used to indicate a subject name, e.g., "Zhang XX" or "Nanjing XX Co., ltd". C5 is used to indicate the type of subject, e.g., "personal" or "institutional". C6 is used to indicate the type of event, e.g., "unlawful promotion", "unlawful operation", or "telecom fraud", etc. C7 is used to indicate cue value levels. C8 is used to indicate status, for example, "pushed" or "to be pushed", where "pushed" indicates that it has been pushed to the relevant department for further auditing, and "to be pushed" indicates that it has not been pushed to the relevant department.

The event generation interface shown in fig. 6 is only an illustration, and should not be construed as a limitation to the present application.

Secondly, in the embodiment of the application, a mode for displaying the target transaction event based on the event generation interface is provided, and the target transaction event (namely the suspicious transaction event) can be pushed to a second terminal device used by a professional worker after being generated through the mode, so that the professional worker can conveniently check the target transaction event (namely the suspicious transaction event), and the flexibility and the convenience of the scheme are improved.

receiving an event screening request sent by a second terminal device, wherein the event screening request carries at least one of an object type to be screened, an event type to be screened, a clue value grade to be screened and a time event to be screened;

and sending an event screening result to the second terminal equipment according to the event screening request so as to enable the second terminal equipment to display the event screening result.

In one or more embodiments, a manner of finding relevant events based on an event screening interface is presented. Taking the example that the transaction event generating device is deployed in the server, after the transaction event generating device receives the event screening request sent by the second terminal device, the event screening result can be fed back to the second terminal device based on the event screening request, wherein the second terminal device is a terminal device used by a professional worker, and therefore the second terminal device will display the event screening result after receiving the event screening result.

Specifically, for ease of understanding, please refer to fig. 7, where fig. 7 is a schematic diagram of an event filtering interface in an embodiment of the present application, and as shown in the figure, a plurality of selection controls are provided on the event filtering interface, where D1 is used to indicate a "submit" control. The user may select the object type, assuming that the "personal" type is selected, i.e. the object type to be filtered is "personal". The user may also select the event type, assuming that the "telco" type is selected, i.e. the event type to be screened is "telco". The user may also select a cue value rating, assuming "level 3" is selected, i.e., the value rating of the cue to be screened is "3". The user may also select the event time, assuming that "1/2021" is selected, i.e., the event time to be screened is "1/2021".

Finally, after the professional staff select the relevant screening conditions and click the 'submit' control indicated by the D1, the event screening request is triggered. Based on the event filtering condition, pushing the relevant event filtering result (i.e. one or more suspicious transaction events) to the second terminal device according to the filtering condition, so that the second terminal device displays the event filtering result (i.e. one or more suspicious transaction events).

It should be noted that the event screening interface shown in fig. 7 is only an illustration, and should not be construed as a limitation of the present application.

Secondly, in the embodiment of the application, a mode for searching for related events based on an event screening interface is provided, through the mode, professional staff can further screen related suspicious transaction events, on one hand, the suspicious transaction events meeting related screening conditions can be summarized, and therefore using convenience is improved, on the other hand, the professional staff can select to push the suspicious transaction events to related departments for review based on displayed suspicious transaction events, and therefore feasibility and operability of the scheme are improved.

Referring to fig. 8, fig. 8 is a schematic view of an embodiment of a transaction event generating device 20 in the present application, which includes:

an obtaining module 201, configured to obtain event information in response to an event reporting request, where the event information includes a target object name, a target thread description text, and a target event type;

the determining module 202 is configured to determine a thread truth degree and an event importance degree according to the event information, where the thread truth degree represents a credibility degree of the event information, and the event importance degree represents an association degree of the transaction event and the sensitive content;

the determining module 202 is further configured to determine a cue value level according to the cue truth and the event importance;

the generating module 203 is configured to generate a target transaction event if the cue value level meets the event generating condition, where the target transaction event includes a target object name, a target event type, and a cue value level.

In the embodiment of the application, the transaction event generation device is provided, and by adopting the device, after a clue delivery channel is opened, a user can report event information through the clue delivery channel, and a background evaluates the event information. If the evaluation is passed, the suspicious transaction event is directly generated, so that the suspicious transaction event can be found more timely, and better early warning and prompting effects are achieved.

Optionally, on the basis of the embodiment corresponding to fig. 8, in another embodiment of the transaction event generating device 20 provided in the embodiment of the present application, the transaction event generating device 20 further includes a processing module 204 and an executing module 205;

the processing module 204 is configured to perform word segmentation processing on the target cue description text to obtain M words, where M is an integer greater than or equal to 1;

an execution module 205, configured to execute the step of determining the thread truth and the event importance according to the event information if at least one of the M words is successfully matched with a word in a word bank corresponding to the target event type;

the determining module 202 is specifically configured to determine the importance of the event according to the target cue description text and the target event type;

In the embodiment of the application, a transaction event generation device is provided, and by adopting the device, the target clue description text reported by the user needs to be initially tested, and the event information irrelevant to suspicious transactions is filtered, so that on one hand, the interference of noise point information on subsequent detection can be effectively reduced, on the other hand, the noise point information does not need to be further detected, and the detection efficiency is improved.

Alternatively, on the basis of the embodiment corresponding to fig. 8, in another embodiment of the transaction event generating device 20 provided in the embodiment of the present application,

the determining module 202 is specifically configured to obtain a sensitive word matching relationship corresponding to a target event type, where the sensitive word matching relationship includes K sensitive words and a rating score corresponding to each sensitive word, and K is an integer greater than or equal to 1;

In the embodiment of the application, a transaction event generation device is provided, and by using the device, a pre-constructed sensitive word matching relationship is combined, wherein the sensitive word matching relationship comprises sensitive words and rating scores corresponding to the sensitive words, so that the sensitive word coverage rate and the rating average score are respectively determined according to the condition that a target cue description text hits the sensitive words, and are used as standards for evaluating the truth of the cue.

the determining module 202 is further configured to obtain a history sample data set, where the history sample data set includes C groups of history sample data, each group of history sample data corresponds to one annotation score, a history sensitive word coverage rate, and a history rating average score, and C is an integer greater than 1;

the determining module 202 is specifically configured to determine the event importance according to the sensitive word coverage, a first coefficient corresponding to the sensitive word coverage, the average rating score, and a second coefficient corresponding to the average rating score.

In the embodiment of the application, a transaction event generating device is provided, and by adopting the device, a reasonable first coefficient and a reasonable second coefficient are deduced by using relevant data in a historical sample data set, and the event importance degree obtained by combining the first coefficient and the second coefficient has higher reliability.

the determining module 202 is specifically configured to acquire a historical event information set in a preset period, where the historical event information set includes at least one piece of historical event information, and each piece of historical event information includes an object name;

In the embodiment of the application, the transaction event generation device is provided, and by adopting the device, the target frequency coefficient corresponding to the target occurrence frequency can be determined by combining the mapping relation between the object name occurrence frequency and the frequency coefficient, and the target frequency coefficient is used as the clue trueness based on the target frequency coefficient, so that the influence of the object name occurrence frequency on the credibility of the event information can be better reflected, and the reliability of the clue trueness is improved.

the determining module 202 is specifically configured to determine a target type coefficient corresponding to the target event type according to a mapping relationship between the event type and the type coefficient, and use the target type coefficient as a thread truth.

In the embodiment of the application, a transaction event generation device is provided, and by adopting the device, a target type coefficient corresponding to a target event type can be determined by combining a mapping relation between the event type and the type coefficient, and based on the target type coefficient, the target type coefficient is used as a clue trueness, so that the influence of the event type on the credibility of the event information can be better reflected, and the reliability of the clue trueness is improved.

the determining module 202 is specifically configured to determine a target amount coefficient corresponding to the target transaction amount according to the mapping relationship between the transaction amount and the amount coefficient, and use the target amount coefficient as the thread truth.

In the embodiment of the application, the transaction event generation device is provided, and by adopting the device, a target amount coefficient corresponding to the target transaction amount can be determined by combining the mapping relation between the transaction amount and the amount coefficient, and based on the target amount coefficient, the target amount coefficient is used as the credibility of a thread, so that the influence of the amount coefficient on the credibility of the event information can be better reflected, and the reliability of the credibility of the thread is improved.

and determining the truth degree of the clue according to the target frequency coefficient, the target type coefficient and the target amount coefficient.

In the embodiment of the application, a transaction event generating device is provided, and by adopting the device, a target frequency coefficient corresponding to the target occurrence frequency can be determined by combining the mapping relation between the object name occurrence frequency and the frequency coefficient, a target type coefficient corresponding to the target event type can be determined by combining the mapping relation between the event type and the type coefficient, and a target amount coefficient corresponding to the target transaction amount can be determined by combining the mapping relation between the transaction amount and the amount coefficient.

a determining module 202, configured to determine the target thread truth according to a product of the thread truth and the first weight value;

In the embodiment of the application, a transaction event generating device is provided, and by using the device, a thread value grade is calculated by using the target thread truth and the corresponding first weight value thereof, and the target event importance and the corresponding second weight value thereof, so that the feasibility and the operability of a scheme are improved. In addition, the rationality of the thread value grade can be increased by measuring the thread truth and the event importance together, for example, an event message with high thread truth but low related transaction amount or supervision attention degree, or an event message with high event importance but insufficient proof material cannot determine whether the thread is true, so that comprehensive assessment needs to be performed by combining the thread truth and the event importance.

Optionally, on the basis of the embodiment corresponding to fig. 8, in another embodiment of the transaction event generating device 20 provided in this embodiment of the present application,

the obtaining module 201 is specifically configured to receive an event reporting request sent by a first terminal device, and obtain event information, where the first terminal device is configured to provide a clue drop interface, and an object name input area, a clue description input area, and an event type input area are displayed on the clue drop interface.

In the embodiment of the application, a transaction event generating device is provided, and by adopting the device, a user can actively report event information which is considered to be suspicious, and the reported event information comprises a target object name, a target clue description text and a target event type, so that the obtained illegal transaction clues are richer and more reliable, the accuracy of the generated suspicious transaction event is higher, and the method is beneficial to covering wider transaction types.

Optionally, on the basis of the embodiment corresponding to fig. 8, in another embodiment of the transaction event generating device 20 provided in the embodiment of the present application, the transaction event generating device 20 further includes a sending module 206;

the sending module 206 is configured to send the target transaction event to a second terminal device, where the second terminal device is configured to provide an event generation interface, and at least one transaction event is displayed on the event generation interface, where the at least one transaction event includes the target transaction event.

In the embodiment of the application, a transaction event generating device is provided, and by adopting the device, after a target transaction event (namely a suspicious transaction event) is generated, the target transaction event can be pushed to a second terminal device used by a professional worker, so that the professional worker can conveniently check the target transaction event (namely the suspicious transaction event), and the flexibility and the convenience of a scheme are improved.

Optionally, on the basis of the embodiment corresponding to fig. 8, in another embodiment of the transaction event generating device 20 provided in the embodiment of the present application, the transaction event generating device 20 further includes a receiving module 207;

a receiving module 207, configured to receive an event screening request sent by a second terminal device, where the event screening request carries at least one of a type of an object to be screened, a type of an event to be screened, a value level of a cue to be screened, and a time event to be screened;

the sending module 206 is further configured to send the event screening result to the second terminal device according to the event screening request, so that the second terminal device displays the event screening result.

In the embodiment of the application, a transaction event generating device is provided, and by adopting the device, professional staff can further screen related suspicious transaction events, on one hand, the suspicious transaction events meeting related screening conditions can be gathered, so that the use convenience is improved, and on the other hand, the professional staff can select to push the suspicious transaction events to related departments for reexamination based on the displayed suspicious transaction events, so that the feasibility and operability of the scheme are improved.

Fig. 9 is a schematic diagram of a server 300 according to an embodiment of the present application, where the server 300 may have a relatively large difference due to different configurations or performances, and may include one or more Central Processing Units (CPUs) 322 (e.g., one or more processors) and a memory 332, and one or more storage media 330 (e.g., one or more mass storage devices) for storing applications 342 or data 344. Memory 332 and storage media 330 may be, among other things, transient storage or persistent storage. The program stored on the storage medium 330 may include one or more modules (not shown), each of which may include a series of instruction operations for the server. Still further, the central processor 322 may be configured to communicate with the storage medium 330 to execute a series of instruction operations in the storage medium 330 on the server 300.

The Server 300 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input-output interfaces 358, and/or one or more operating systems 341, such as a Windows Server ^TM ，Mac OS X ^TM ，Unix ^TM ,Linux ^TM ，FreeBSD ^TM And so on.

In this embodiment, the CPU 322 in the server is configured to execute the following steps:

determining a thread value grade according to the thread reality degree and the event importance degree;

Optionally, the CPU 322 in the server is specifically configured to execute the following steps:

Optionally, the CPU 322 in the server is further configured to perform the following steps:

The steps performed by the server in the above embodiments may be based on the server structure shown in fig. 9.

As shown in fig. 10, for convenience of description, only the portions related to the embodiments of the present application are shown, and details of the specific techniques are not disclosed, please refer to the method portion of the embodiments of the present application. The terminal device may be any terminal device including a mobile phone, a tablet computer, a Personal Digital Assistant (PDA), a Point of Sales (POS), a vehicle-mounted computer, and the like, taking the terminal device as the mobile phone:

fig. 10 is a block diagram illustrating a partial structure of a mobile phone related to a terminal device provided in an embodiment of the present application. Referring to fig. 10, the cellular phone includes: radio Frequency (RF) circuit 410, memory 420, input unit 430, display unit 440, sensor 450, audio circuit 460, wireless fidelity (WiFi) module 470, processor 480, and power supply 490. Those skilled in the art will appreciate that the handset configuration shown in fig. 10 is not intended to be limiting and may include more or fewer components than those shown, or some components may be combined, or a different arrangement of components.

The following describes each component of the mobile phone in detail with reference to fig. 10:

the RF circuit 410 may be used for receiving and transmitting signals during information transmission and reception or during a call, and in particular, receives downlink information of a base station and then processes the received downlink information to the processor 480; in addition, data for designing uplink is transmitted to the base station. In general, the RF circuit 410 includes, but is not limited to, an antenna, at least one Amplifier, a transceiver, a coupler, a Low Noise Amplifier (LNA), a duplexer, and the like. In addition, the RF circuitry 410 may also communicate with networks and other devices via wireless communications. The wireless communication may use any communication standard or protocol, including but not limited to Global System for Mobile communication (GSM), general Packet Radio Service (GPRS), code Division Multiple Access (CDMA), wideband Code Division Multiple Access (WCDMA), long Term Evolution (LTE), email, short Messaging Service (SMS), and the like.

The memory 420 may be used to store software programs and modules, and the processor 480 executes various functional applications and data processing of the mobile phone by operating the software programs and modules stored in the memory 420. The memory 420 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required by at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may store data (such as audio data, a phonebook, etc.) created according to the use of the cellular phone, etc. Further, the memory 420 may include high speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.

The input unit 430 may be used to receive input numeric or character information and generate key signal inputs related to user settings and function control of the cellular phone. Specifically, the input unit 430 may include a touch panel 431 and other input devices 432. The touch panel 431, also called a touch screen, may collect touch operations of a user on or near the touch panel 431 (e.g., operations of the user on or near the touch panel 431 using any suitable object or accessory such as a finger or a stylus) and drive the corresponding connection device according to a preset program. Alternatively, the touch panel 431 may include two parts of a touch detection device and a touch controller. The touch detection device detects the touch direction of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch sensing device, converts the touch information into touch point coordinates, sends the touch point coordinates to the processor 480, and receives and executes commands sent from the processor 480. In addition, the touch panel 431 may be implemented by various types such as resistive, capacitive, infrared, and surface acoustic wave. The input unit 430 may include other input devices 432 in addition to the touch panel 431. In particular, other input devices 432 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like.

The display unit 440 may be used to display information input by the user or information provided to the user and various menus of the cellular phone. The Display unit 440 may include a Display panel 441, and optionally, the Display panel 441 may be configured in the form of a Liquid Crystal Display (LCD), an Organic Light-Emitting Diode (OLED), or the like. Further, the touch panel 431 can cover the display panel 441, and when the touch panel 431 detects a touch operation on or near the touch panel 431, the touch operation is transmitted to the processor 480 to determine the type of the touch event, and then the processor 480 provides a corresponding visual output on the display panel 441 according to the type of the touch event. Although the touch panel 431 and the display panel 441 are shown in fig. 10 as two separate components to implement the input and output functions of the mobile phone, in some embodiments, the touch panel 431 and the display panel 441 may be integrated to implement the input and output functions of the mobile phone.

The handset may also include at least one sensor 450, such as a light sensor, motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor that adjusts the brightness of the display panel 441 according to the brightness of ambient light, and a proximity sensor that turns off the display panel 441 and/or the backlight when the mobile phone is moved to the ear. As one of the motion sensors, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), detect the magnitude and direction of gravity when stationary, and can be used for applications of recognizing gestures of a mobile phone (such as horizontal and vertical screen switching, related games, magnetometer gesture calibration), vibration recognition related functions (such as pedometers and taps), and the like; as for other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, and an infrared sensor, which can be configured on the mobile phone, further description is omitted here.

Audio circuit 460, speaker 461, microphone 462 may provide an audio interface between the user and the handset. The audio circuit 460 may transmit the electrical signal converted from the received audio data to the speaker 461, and convert the electrical signal into a sound signal for output by the speaker 461; on the other hand, the microphone 462 converts the collected sound signal into an electrical signal, which is received by the audio circuit 460 and converted into audio data, which is then processed by the output processor 480 and then sent to, for example, another mobile phone via the RF circuit 410 or output to the memory 420 for further processing.

WiFi belongs to a short-distance wireless transmission technology, and the mobile phone can help a user to receive and send emails, browse webpages, access streaming media and the like through the WiFi module 470, and provides wireless broadband internet access for the user. Although fig. 10 shows the WiFi module 470, it is understood that it does not belong to the essential constitution of the handset, and can be omitted entirely as needed within the scope not changing the essence of the invention.

The processor 480 is a control center of the mobile phone, connects various parts of the entire mobile phone by using various interfaces and lines, and performs various functions of the mobile phone and processes data by operating or executing software programs and/or modules stored in the memory 420 and calling data stored in the memory 420, thereby integrally monitoring the mobile phone. Optionally, processor 480 may include one or more processing units; optionally, the processor 480 may integrate an application processor and a modem processor, wherein the application processor mainly handles operating systems, user interfaces, application programs, and the like, and the modem processor mainly handles wireless communications. It will be appreciated that the modem processor described above may not be integrated into processor 480.

The mobile phone further includes a power supply 490 (e.g., a battery) for supplying power to the components, and optionally, the power supply may be logically connected to the processor 480 through a power management system, so as to implement functions of managing charging, discharging, and power consumption through the power management system.

Although not shown, the mobile phone may further include a camera, a bluetooth module, etc., which are not described herein.

In this embodiment of the present application, the processor 480 in the terminal device is configured to execute the following steps:

The steps performed by the terminal device in the above-described embodiment may be based on the terminal device structure shown in fig. 10.

Embodiments of the present application also provide a computer-readable storage medium, in which a computer program is stored, and when the computer program runs on a computer, the computer is caused to execute the method described in the foregoing embodiments.

Embodiments of the present application also provide a computer program product including a program, which, when run on a computer, causes the computer to perform the methods described in the foregoing embodiments.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be substantially implemented or contributed to by the prior art, or all or part of the technical solution may be embodied in a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a portable hard disk, a read-only memory (ROM), a Random Access Memory (RAM), a magnetic disk, an optical disk, or other various media capable of storing program codes.

The above embodiments are only used for illustrating the technical solutions of the present application, and not for limiting the same; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions in the embodiments of the present application.

Claims

1. A method for generating a transaction event, comprising:

determining thread truth and event importance according to the event information, wherein the thread truth represents the credibility of the event information, and the event importance represents the association degree of the transaction event and sensitive content;

and if the clue value grade meets the event generation condition, generating a target transaction event, wherein the target transaction event comprises the target object name, the target event type and the clue value grade.

2. The method of generating as claimed in claim 1, further comprising:

if at least one word in the M words is successfully matched with the word in the word bank corresponding to the target event type, executing the step of determining the thread truth and the event importance according to the event information;

determining the thread truth and the event importance according to the event information comprises the following steps:

determining the event importance according to the target clue description text and the target event type;

3. The method according to claim 2, wherein the determining the event importance according to the target cue description text and the target event type comprises:

acquiring a sensitive word matching relation corresponding to the target event type, wherein the sensitive word matching relation comprises K sensitive words and a rating score corresponding to each sensitive word, and K is an integer greater than or equal to 1;

determining N sensitive words from the target clue description text according to the K sensitive words included in the sensitive word matching relation, wherein N is an integer which is greater than or equal to 1 and less than or equal to M;

and determining the event importance according to the sensitive word coverage rate and the average grading score.

4. The method of generating as claimed in claim 3, further comprising:

acquiring a historical sample data set, wherein the historical sample data set comprises C groups of historical sample data, each group of historical sample data corresponds to a labeling score, a historical sensitive word coverage rate and a historical rating average score, and C is an integer greater than 1;

generating a first data matrix according to the mark score included in each group of historical sample data;

determining the first coefficient and the second coefficient according to the first data matrix and the second data matrix;

determining the event importance according to the sensitive word coverage rate and the average rating score, wherein the determining comprises the following steps:

and determining the event importance according to the sensitive word coverage rate, the first coefficient corresponding to the sensitive word coverage rate, the average rating score and the second coefficient corresponding to the average rating score.

5. The method of claim 2, wherein determining the degree of truth of the thread based on at least one of the target object name, the target event type, and a target transaction amount comprises:

6. The method of claim 2, wherein determining the degree of truth of the thread based on at least one of the target object name, the target event type, and a target transaction amount comprises:

7. The method of claim 2, wherein determining the degree of truth of the thread based on at least one of the target object name, the target event type, and a target transaction amount comprises:

and determining a target amount coefficient corresponding to the target transaction amount according to the mapping relation between the transaction amount and the amount coefficient, and taking the target amount coefficient as the truth of the clue.

8. The method of claim 2, wherein determining the degree of truth of the thread based on at least one of the target object name, the target event type, and a target transaction amount comprises:

9. The method of claim 1, wherein determining a cue value level based on the cue truth and the event importance comprises:

determining the truth of a target thread according to the product of the truth of the thread and the first weight value;

determining the importance of the target event according to the product of the event importance and a second weighted value;

10. The generation method according to any one of claims 1 to 8, wherein the obtaining event information in response to the event report request includes:

and receiving the event reporting request sent by a first terminal device, and acquiring the event information, wherein the first terminal device is used for providing a clue launching interface, and an object name input area, a clue description input area and an event type input area are displayed on the clue launching interface.

11. The generation method according to any one of claims 1 to 8, characterized in that the method further comprises:

12. The generation method according to any one of claims 1 to 8, characterized in that the method further comprises:

receiving an event screening request sent by the second terminal device, wherein the event screening request carries at least one of an object type to be screened, an event type to be screened, a clue value grade to be screened and a time event to be screened;

13. A transaction event generating device, comprising:

the system comprises an acquisition module, a reporting module and a reporting module, wherein the acquisition module is used for responding to an event reporting request and acquiring event information, and the event information comprises a target object name, a target clue description text and a target event type;

the determining module is further used for determining a thread value grade according to the thread reality degree and the event importance degree;

and the generating module is used for generating a target transaction event if the clue value grade meets an event generating condition, wherein the target transaction event comprises the target object name, the target event type and the clue value grade.

14. A computer device, comprising: a memory, a processor, and a bus system;

wherein the memory is used for storing programs;

the processor is configured to execute a program in the memory, the processor is configured to perform the generation method of any one of claims 1 to 12 according to instructions in program code;

15. A computer-readable storage medium comprising instructions which, when run on a computer, cause the computer to perform the generation method of any one of claims 1 to 12.