CN115689570A

CN115689570A - Business information risk identification method, device, equipment and medium

Info

Publication number: CN115689570A
Application number: CN202211186306.1A
Authority: CN
Inventors: 王颖
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2022-09-27
Filing date: 2022-09-27
Publication date: 2023-02-03

Abstract

The present disclosure provides a method, an apparatus, a device and a medium for business information risk identification, which can be applied to the technical field of information security and the technical field of finance. The business information risk identification method comprises the following steps: inquiring target rule item data in the service message information according to a preset rule according to the message category of the service message information, wherein the target rule item data comprise target identification data and target content data associated with the target identification data; extracting target key data in the target content data according to the data type and the target identification data of the target rule item data; matching the target key data with the risk information in the risk information list according to the matching rule to obtain a matching result; and determining a risk identification result of the service message information according to the matching result.

Description

Business information risk identification method, device, equipment and medium

Technical Field

The present disclosure relates to the field of information security technologies and financial technologies, and more particularly, to a method, an apparatus, a device, a medium, and a program product for business information risk identification.

Background

The fund transaction across the trading areas is a transaction for transferring funds to a designated account of a user in the trading area or other trading areas through transfer of fund positions among agency lines by payers in different trading areas. With the development of computer technology, the types of payment instructions included in the cross-trading-area fund service are increased, and the service message information data for completing the cross-trading-area fund service is more complex.

In the course of implementing the disclosed concept, the inventors found that there are at least the following problems in the related art: the risk identification rule for the business message information included in the fund business crossing the trade area changes frequently, so that the identification accuracy is low and the identification time is long under the condition that the risk information is identified manually, and the difficulty and the efficiency of the risk identification of the business information are high.

Disclosure of Invention

In view of the above, the present disclosure provides a business information risk identification method, apparatus, device, medium, and program product.

According to a first aspect of the present disclosure, a business information risk identification method is provided, including:

and inquiring target rule item data in the service message information according to a preset rule according to the message category of the service message information, wherein the target rule item data comprises target identification data and target content data associated with the target identification data.

And extracting target key data in the target content data according to the data type of the target rule item data and the target identification data.

And matching the target key data with the risk information in the risk information list according to a matching rule to obtain a matching result. And

and determining a risk identification result of the service message information according to the matching result.

According to the embodiment of the disclosure, the data type of the target rule item data includes a service participant attribute type.

Wherein, according to the data type of the target rule item data and the target identification data, extracting the target key data in the target content data comprises:

and under the condition that the data type of the target rule item data is a business participant attribute type, inquiring a target key data extraction rule and a target key character position corresponding to the target identification data from a risk evaluation form according to the target identification data. And

and extracting the target key data from the target content data corresponding to the target identification data according to the target key data extraction rule and the target key character position.

According to the embodiment of the present disclosure, querying, according to the target identification data, a target key character position corresponding to the target identification data from a risk evaluation form includes:

according to the target identification data, inquiring a target key character segment corresponding to the target identification from the risk evaluation form, wherein the target key character segment comprises at least one character;

and determining the target key character position corresponding to the target identification data according to the target key character segment and the matching result of the target content data corresponding to the target identification data.

According to an embodiment of the present disclosure, the risk information includes risk attribute information.

According to the matching rule, matching the target key data with the risk information in the risk information list comprises the following steps:

according to target identification data corresponding to the target key data, inquiring a target risk information node associated with the target identification data from the risk information list, wherein the target risk information node comprises target risk attribute information;

and performing character matching on the target key data and the target risk attribute information to obtain the matching result.

According to an embodiment of the present disclosure, the data type of the target rule item data further includes a monetary attribute type.

Wherein, according to the data type of the target rule item data and the target identification data, extracting the target key data in the target content data further comprises:

determining all character data of target content data associated with the target identification data as the target key data when the data type of the target rule item data is a money attribute type; and

and extracting the target key data.

According to an embodiment of the present disclosure, the risk information includes risk amount information.

and inquiring a target risk information node associated with the target identification data from the risk information list according to the target identification data corresponding to the target key data, wherein the target risk information node comprises target risk amount information.

And inquiring a target money amount matching rule corresponding to the target identification data according to the target identification data corresponding to the target key data.

And processing a comparison result of the target key data and the target risk amount information according to the target amount matching rule to obtain the matching result.

And when the comparison result meets the target money matching rule, the matching result representations are matched.

According to the embodiment of the present disclosure, the matching result includes N, where N is a positive integer greater than 1.

Wherein, according to the matching result, determining the risk identification result of the service message information comprises:

and under the condition that at least one of the N matching results represents a match, determining a risk identification result of the service message information as a target risk identification result, wherein the target risk identification result represents that the service message information has a risk.

According to an embodiment of the present disclosure, the service packet information includes at least one of the following:

remittance request message information, remittance accounting message information, remittance message information, and compliance processing message information.

According to an embodiment of the present disclosure, the method further includes:

and intercepting the service message information under the condition that the risk identification result represents that the service message information has risk.

A second aspect of the present disclosure provides a business information risk identification apparatus, including:

and the query module is used for querying target rule item data in the service message information according to a preset rule according to the message category of the service message information, wherein the target rule item data comprise target identification data and target content data associated with the target identification data.

And the extraction module is used for extracting the target key data in the target content data according to the data type of the target rule item data and the target identification data.

And the matching module is used for matching the target key data with the risk information in the risk information list according to the matching rule to obtain a matching result. And

and the determining module is used for determining the risk identification result of the service message information according to the matching result.

A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the business information risk identification method.

The fourth aspect of the present disclosure also provides a computer-readable storage medium, on which executable instructions are stored, and when executed by a processor, the instructions cause the processor to execute the business information risk identification method.

A fifth aspect of the present disclosure also provides a computer program product comprising a computer program that, when executed by a processor, implements the business information risk identification method described above.

According to the embodiment of the disclosure, the target key data with higher risk correlation degree is obtained by extracting different target rule item data in the service messages of different message types, and then the target key data is matched with the risk information in the risk information list to obtain a matching result so as to determine the risk identification result. Based on the technical means, the risk identification accuracy rate aiming at the service message information can be improved, and meanwhile, under the condition that the risk information list is updated timely, the target key data with high risk in the service message information can be identified timely, so that the timeliness of service message information identification is improved at least partially.

Drawings

The foregoing and other objects, features and advantages of the disclosure will be apparent from the following description of embodiments of the disclosure, taken in conjunction with the accompanying drawings of which:

fig. 1 schematically shows a system architecture of a business information risk identification method according to an embodiment of the present disclosure;

FIG. 2 schematically illustrates a flow chart of a business information risk identification method according to an embodiment of the disclosure;

FIG. 3 schematically illustrates a flow chart for extracting target key data in target content data according to a data type of target rule item data and target identification data according to an embodiment of the present disclosure;

FIG. 4 schematically illustrates a flow chart for matching target key data with risk information in a risk information list according to a matching rule according to an embodiment of the present disclosure;

fig. 5 schematically shows a block diagram of a business information risk identification apparatus according to an embodiment of the present disclosure; and

fig. 6 schematically shows a block diagram of an electronic device adapted to implement a business information risk identification method according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is illustrative only and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It is noted that the terms used herein should be interpreted as having a meaning that is consistent with the context of this specification and should not be interpreted in an idealized or overly formal sense.

Where a convention analogous to "at least one of A, B, and C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B, and C" would include but not be limited to systems that have A alone, B alone, C alone, A and B together, A and C together, B and C together, and/or A, B, and C together, etc.).

In the technical scheme of the disclosure, the acquisition, storage, application and the like of the personal information of the related user all accord with the regulations of related laws and regulations, necessary security measures are taken, and the customs of the public order is not violated.

In the technical scheme of the disclosure, before the personal information of the user is acquired or collected, the authorization or the consent of the user is acquired.

In the process of manually identifying risk information in the cross-trade area fund service, because the rule for identifying the risk of the service message information included in the cross-trade area fund service changes frequently, the risk information may be identified by mistake from the normal service message information or the risk information is not detected, so that the accuracy of risk identification is low. And the risk identification timeliness of the service message information is poor due to the fact that the manual identification period is long.

In summary, in the process of implementing the disclosed concept, the inventors found that at least the following problems exist in the related art: the difficulty of identifying the risk information is high, the efficiency is low, and the timeliness is poor.

In order to at least partially solve the technical problems in the related art, an embodiment of the present disclosure provides a business information risk identification method, including:

according to the message category of the service message information, inquiring target rule item data in the service message information according to a preset rule, wherein the target rule item data comprises target identification data and target content data associated with the target identification data; extracting target key data in the target content data according to the data type of the target rule item data and the target identification data; matching the target key data with the risk information in the risk information list according to the matching rule to obtain a matching result; and determining a risk identification result of the service message information according to the matching result.

Fig. 1 schematically shows a system architecture of a business information risk identification method according to an embodiment of the present disclosure.

Fig. 1 is only an example of a system architecture of a business information risk method to which the embodiments of the present disclosure may be applied, so as to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure may not be applied to other devices, systems, environments or scenarios.

As shown in fig. 1, a system architecture 100 according to this embodiment may include

terminal devices

101, 102, 103, a network 104, and a server 105. Network 104 is the medium used to provide communication links between

terminal devices

101, 102, 103 and server 105. Network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, to name a few.

The user may use the

terminal devices

101, 102, 103 to interact with the server 105 via the network 104 to receive or send messages or the like. The

terminal devices

101, 102, 103 may have client applications installed thereon, such as a web browser application, a search-class application, a business transaction tool, a mailbox client, etc. (by way of example only).

The

terminal devices

101, 102, 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop portable computers, desktop computers, and the like.

The server 105 may be a server providing various services, such as a background management server (for example only) providing support for websites browsed by users using the

terminal devices

101, 102, 103. The background management server may analyze and perform other processing on the received data such as the user request, and feed back a processing result (e.g., a webpage, information, or data obtained or generated according to the user service request) to the terminal device.

It should be noted that the service information risk identification method provided by the embodiment of the present disclosure may be generally executed by the server 105. Accordingly, the business information risk identification device provided by the embodiment of the present disclosure may be generally disposed in the server 105. The service information risk identification method provided by the embodiment of the present disclosure may also be executed by a server or a server cluster that is different from the server 105 and is capable of communicating with the

terminal devices

101, 102, 103 and/or the server 105. Correspondingly, the service information risk identification device provided by the embodiment of the present disclosure may also be disposed in a server or a server cluster that is different from the server 105 and can communicate with the

terminal devices

101, 102, 103 and/or the server 105.

It should be understood that the number of terminal devices, networks, and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

The business information risk identification method of the disclosed embodiment will be described in detail below with reference to fig. 2 to 4 based on the scenario described in fig. 1.

Fig. 2 schematically shows a flowchart of a business information risk identification method according to an embodiment of the present disclosure.

As shown in fig. 2, the business information risk identification method of this embodiment includes operations S210 to S240.

In operation S210, according to the packet type of the service packet information, the target rule item data in the service packet information is queried according to the preset rule.

The target rule item data comprises target identification data and target content data associated with the target identification data.

In operation S220, target key data in the target content data is extracted according to the data type of the target rule item data and the target identification data.

In operation S230, the target key data is matched with the risk information in the risk information list according to the matching rule, so as to obtain a matching result.

In operation S240, a risk identification result of the service packet information is determined according to the matching result.

Before obtaining the service message information, the user's consent or authorization may be obtained. For example, before operation S210, a request for obtaining service message information may be sent to the user. In case that the user agrees or authorizes to obtain the service packet information, the operation S210 is performed.

According to an embodiment of the present disclosure, the service message information may be a type of data information used for transmitting and storing transaction information. The service message information may represent attribute information such as transaction party information, transaction amount, transaction time, etc. in the fund service.

According to the embodiment of the present disclosure, the service message information may include various instruction messages related in the service transaction process, for example, the instruction messages may include fund service clearing instruction messages across trade areas, and the instruction types of the instruction message instructions may be characterized by the following type identifiers:

AB103, AB202JDE, AB202, LEHK.111, LEHK.112, JKHK.111, JKHK.112, JKHK.113, LAB102, LAB202, LAB100, LAB200, LAB101, LAB103, and LAB204.

The above type designations are used for exemplary purposes only, and are not intended to limit the scope of the present disclosure.

According to the embodiment of the disclosure, the service message information includes various rule item data, and the rule item data represents a relevant main body participating in the service transaction, namely a service transaction relevant party. Rule item data includes, but is not limited to, the following data types:

a sender, a receiver, a service number, a currency, a clearing amount, a remittance amount, a start date, remittance user information, a remittance account number, an initiating institution, original remittance bank information, an original remittance user account number, a sender proxy line information, a sender proxy line account number, a receiver proxy line information, a receiver proxy line account number, a third party remittance line information, a third party remittance line account number, a middle line account number, an account information line, an account line account number, a receiver user information, a receiver user account number, etc.

According to embodiments of the present disclosure, the rule item data may include target rule item data corresponding to the business participant attribute type, and target rule item data classified as corresponding to the monetary attribute type.

According to the embodiment of the disclosure, the service message information can be classified into the service participant attribute type based on the category of the service message information. And inquiring the target rule item data according to a preset rule to obtain target key data in the target content data. The preset rule can be that keyword extraction is performed on the number of target rule items corresponding to the attribute type of the service participant, so as to obtain target key data corresponding to the attribute type of the service participant.

According to the embodiment of the disclosure, the service message information can be classified into the money attribute type based on the category of the service message information. And inquiring the target rule item data according to a preset rule to obtain target key data in the target content data. The preset rule can be that target rule item data corresponding to the amount attribute type is traversed to obtain target key data corresponding to the amount attribute type.

According to the embodiment of the disclosure, after the target key data corresponding to the attribute type of the service participant or the amount attribute type is obtained, the target key data corresponding to the attribute type of the service participant or the amount attribute type is matched with the risk information in the risk information list through the matching rule, and the matching result is obtained.

According to an embodiment of the present disclosure, the risk information sources in the risk information list may include, but are not limited to, obtaining from:

negative institution account numbers, negative institution identities in a negative list, etc. The risk information may be stored in the risk information list in the form of a character field.

It should be noted that the risk information may include a character segment, or may also include a natural language, such as a data value, and the specific format of the risk information is not limited by the embodiments of the present disclosure.

According to the embodiment of the disclosure, the target rule data in the service message information is inquired according to the message category, and the target key data for identifying the message risk is extracted according to the target identification data and the data type of the target rule item data, so that the target key data with higher risk correlation degree can be flexibly extracted for the service message information of different message categories and diversified rule item data in the service message information, and further the target key data is matched with the risk information in the risk information list, the risk identification can be performed for the target pendant data with higher risk correlation degree in the service message information, and then the risk identification result is determined according to the matching result, so that the risk identification accuracy rate for the service message information can be improved, and meanwhile, the target key data with higher risk in the service message information can be timely identified under the condition that the risk information list is more timely, so that the timeliness of service message information identification is at least partially improved.

Fig. 3 schematically shows a flowchart of extracting target key data in target content data according to the data type and target identification data of the target rule item data according to an embodiment of the present disclosure.

As shown in fig. 3, the extracting of the target key data in the target content data according to the data type of the target rule item data and the target identification data in operation S220 may further include operations S310a to S320a.

In operation S310a, in a case that the data type of the target rule item data is a service participant attribute type, a target key data extraction rule and a target key character position corresponding to the target identification data are queried from the risk evaluation form according to the target identification data.

In operation S320a, target key data is extracted from target content data corresponding to the target identification data according to the target key data extraction rule and the target key character position.

According to an embodiment of the present disclosure, the target rule item data corresponding to the attribute type of the business participant may include data corresponding to characterizing a relevant subject participating in the business transaction, such as an institution name, an institution code, and the like corresponding to an executing party executing the fund business across the trading area, and the target rule item data corresponding to the attribute type of the business participant includes, but is not limited to, the following data types:

a submitting bank, a receiving bank, a service number, remittance user information, a remittance account number, an initiating institution, original remittance bank information, an original remittance user account number, a submitting bank agent information, a submitting bank agent account number, a receiving bank agent information, a receiving bank agent account number, a third party reimbursement bank information, a third party reimbursement bank account number, an intermediate bank account number, an account information bank, an account bank account number, a receiving user information, a receiving user account number, and the like.

According to the embodiment of the disclosure, under the condition that the target key character position corresponding to the target identification data and the target key data extraction rule are inquired, the target key data used for representing the attribute of the business participant can be accurately extracted from the target content data, so that the calculation time for subsequent matching is reduced, meanwhile, the matching error caused by repeated character segments is at least partially avoided, and the subsequent risk identification accuracy is improved.

According to an embodiment of the present disclosure, the operation S310a, according to the target identification data, querying the target key data extraction rule and the target key character position corresponding to the target identification data from the risk evaluation form may further include the following operations:

inquiring a target key position character segment corresponding to the target identifier from the risk evaluation form according to the target identifier data, wherein the target key position character segment comprises at least one character; and determining the target key character position corresponding to the target identification data according to the matching result of the target key character segment and the target content data corresponding to the target identification data.

According to the embodiment of the disclosure, the target key character position in the target content data is determined through the target key character segment so as to improve the identification accuracy rate aiming at the complex target content data, so that the method can flexibly adapt to the key data extraction of various different target content data so as to improve the extraction accuracy rate of the target key data.

Fig. 4 schematically shows a flowchart for matching target key data with risk information in a risk information list according to a matching rule according to an embodiment of the present disclosure.

As shown in fig. 4, the matching of the target key data with the risk information in the risk information list according to the matching rule in operation S230 may include operations S410 to S420a.

In operation S410, a target risk information node associated with the target identification data is queried from the risk information list according to the target identification data corresponding to the target key data. And the target risk information node comprises target risk attribute information.

In operation S420a, the target key data is character-matched with the target risk attribute information to obtain a matching result.

According to the embodiment of the disclosure, the preset rule is set to include a rule item value mode, target rule item data is inquired according to the rule item value mode, target key data in target content data corresponding to the target rule item data are extracted, and then the target key data and risk information in the risk information list are matched in a rule item judgment mode to obtain a matching result. And storing the matching result through the set content format of the rule item so as to determine the risk identification result. The above-mentioned rule item value-taking mode, rule item judgment mode and rule item content format type are shown in table 1.

According to the embodiment of the disclosure, under the condition that the data type of the target rule item data is the attribute type of the service participant, the data type can be queried by using any one or more combined rule item value-taking modes in the corresponding serial numbers 2 to 8 in the table 1 to obtain the target key character position, and the target key data can be extracted from the target content data corresponding to the target identification data according to the rule item value-taking mode and the obtained target key character position. Under the condition that the data type of the target rule item data is the money attribute type, the data type can be inquired by using the serial number 1 rule item value mode corresponding to the table 1 to obtain the target key character position, and the target key data is extracted from the target content data corresponding to the target identification data according to the rule item value mode and the obtained target key character position.

According to the embodiment of the present disclosure, in the case where the rule item value mode is set to be any one of the corresponding serial numbers 1, 2, and 3 in table 1, the rule item determination mode may select at least one of the corresponding serial numbers 1, 2, 7, and 8 in table 1. In the case where the rule item value mode is set to be the corresponding serial number 4 in table 1, the rule item determination mode may select at least one of the corresponding serial numbers 1 to 6 in table 1.

It should be understood that after the target key data is obtained, the target key data may be stored so as to perform character matching between the target key data and the target risk attribute information to obtain a matching result.

According to the embodiment of the present disclosure, when the rule item value mode is the corresponding serial number 1 in table 1 and the rule item determination mode is at least one of the corresponding serial numbers 1 and 2 in table 1, it is determined that the content format is set to the serial number 3. Otherwise, the setting judgment content format may select only the serial number 1 or the serial number 2.

According to the embodiment of the disclosure, if the rule item value mode is set to be the corresponding serial number 3 in table 1, and if the selected rule item judgment mode is the corresponding serial number 1 and serial number 2 in table 1, the length of the number of characters stored in the content format of the corresponding rule item is set to be equal to (Y-X + 1).

According to the embodiment of the disclosure, if the rule item value mode is set to be the corresponding serial number 3 in table 1, and if the selected rule item judgment mode is the corresponding serial number 7 and serial number 8 in table 1, the length of the number of characters stored in the content format of the corresponding rule item is set to be less than or equal to (Y-X + 1).

According to the embodiment of the present disclosure, when the rule item value mode is set to be the corresponding serial number 4 in table 1, the content stored in the content format of the corresponding rule item is set to be a service customized parameter composed of numbers or digits.

According to the embodiment of the present disclosure, in the case where the content format of the corresponding rule item is set to the corresponding serial number 3 in table 1, the rule item determination manner is set to the non-input state, that is, such target key data is not determined.

According to the embodiments of the present disclosure, without being limited to the above-described embodiments, no special control is provided for the rule item determination manner.

TABLE 1

According to the embodiment of the present disclosure, in the case that the data type of the target rule item data is the attribute type of the service participant, specifically, the specific message of the MT103 may be taken as an example for explanation.

According to the embodiment of the disclosure, the specific type of the target rule item data is determined under the condition that the target rule item data is judged to be the attribute type of the service participant. Specifically, the correspondence "51A" may determine that the target identification data of the target rule item data corresponds to a "send line". The format of the line information is composed of characters and numbers.

According to the embodiment of the disclosure, according to the corresponding target key data extraction rule, the rule item value mode of the corresponding serial number 4 in the table 1 is selected to perform the operation of querying and sending the target rule item data in the corresponding message. For example, if the target content data "a/C123456" associated with the target identification data in the target rule item data in the report line correspondence information is queried, the obtained target key data is "123456".

According to the embodiment of the disclosure, after the target key data "123456" is obtained, based on that the target key data "123456" is the target key data representing the reporting line account, matching with the risk information in the risk information list may be performed according to the matching rules that the corresponding sequence number 1 "is equal to" and the corresponding sequence number 2 "is not equal to" in table 1, so as to obtain the matching result, and further determine the risk identification result of the service message information.

According to the embodiment of the disclosure, the specific type of the target rule item data is determined under the condition that the target rule item data is judged to be the attribute type of the service participant. Specifically, the correspondence "53a" may determine that the target identification data of the target rule item data corresponds to a "sending agent line". The corresponding information formats of the sending line agent line can be divided into two types of fixed formats and free input formats, wherein the fixed formats are usually 8-11 bits of characters + numbers, and the characters at the designated positions are clearly defined.

According to the embodiment of the disclosure, according to the corresponding target key data extraction rule, the rule item value mode of the corresponding serial number 3 in the table 1 is selected to perform the operation of inquiring and sending the target rule item data in the corresponding information of the agent row. For example, if the target content data associated with the target identification data in the target rule item data in the corresponding information of the agent line of the sender is "chasabxxxx" and the data of the 5 th bit to the 6 th bit extracted from the target content data is set, the target key data "AB" is obtained.

According to the embodiment of the disclosure, after the target key data "AB" is obtained, the target key data representing the area to which the agent line of the sending line belongs may be matched with the risk information in the risk information list according to the matching rules that the corresponding sequence number 7 "includes" and the corresponding sequence number 8 "does not include" in table 1, so as to obtain the matching result and further determine the risk identification result of the service message information.

According to the embodiment of the disclosure, the specific type of the target rule item data is determined under the condition that the target rule item data is judged to be the attribute type of the service participant. Specifically, the correspondence "59a" may determine that the target identification data of the target rule item data corresponds to the "benefit client". The beneficial client formats may include both fixed formats and free entry formats, where the free entry formats enter different fields by information category and are spaced apart by a specified character for differentiation.

According to the embodiment of the disclosure, according to the corresponding target key data extraction rule, the rule item value mode of the corresponding serial number 5 in table 1 can be selected to perform the operation of querying and sending the target rule item data in the corresponding information of the agent line, so as to obtain the target key data related to the benefited customer.

According to the embodiment of the disclosure, after the target key data is obtained, based on the client information represented by the target key data, the matching with the risk information in the risk information list can be performed according to the matching rules that the corresponding serial number 7 "includes" and the serial number 8 "does not include" in table 1, so as to obtain the matching result and further determine the risk identification result of the service message information.

According to an embodiment of the present disclosure, the data type of the target rule item data further includes a money attribute type.

In operation S220, extracting the target key data from the target content data according to the data type of the target rule item data and the target identification data may include the following operations:

under the condition that the data type of the target rule item data is a money attribute type, determining all character data of target content data associated with the target identification data as target key data; and extracting the target key data.

According to an embodiment of the present disclosure, the target rule item data corresponding to the amount attribute type may include rule item data corresponding to non-executive party information characterizing the cross-trading zone fund service and business fund information characterizing the cross-trading zone fund service, and the amount attribute type includes, but is not limited to, currency, clearing amount, remittance amount, origination date, and the like.

According to the embodiment of the disclosure, by extracting all character data in the target rule item data with the amount attribute type, the risk information related to the business amount can be accurately identified, so that the accuracy of the subsequent risk identification result is further improved.

Operation S230, matching the target key data with the risk information in the risk information list according to the matching rule, and obtaining a matching result may include the following operations:

and inquiring a target risk information node associated with the target identification data from the risk information list according to the target identification data corresponding to the target key data. The target risk information node comprises target risk amount information; inquiring a target money matching rule corresponding to the target identification data according to the target identification data corresponding to the target key data; and processing a comparison result of the target key data and the target risk amount information according to the target amount matching rule to obtain a matching result.

And when the comparison result meets the target money amount matching rule, the matching result representations are matched.

According to the embodiment of the disclosure, the matching result includes N, where N is a positive integer greater than 1.

Determining the risk identification result of the service message information according to the matching result may include the following operations:

and under the condition that at least one matching result in the N matching results is characterized to be matched, determining the risk identification result of the service message information as a target risk identification result, wherein the target risk identification result represents that the service message information has risks.

According to the embodiment of the disclosure, after the N matching results are obtained based on the service information risk identification method, the risk identification result of the service message information is determined to be the target risk identification result under the condition that at least one of the N matching results is characterized to be matched.

According to the embodiment of the disclosure, after 1 matching result is obtained based on the business information risk identification method, the risk identification result of the business message information is determined as the target risk identification result based on the matching result. In this case, the risk identification speed of the service message information is higher than that of the service message information after all matching results are identified, and a target risk identification result is determined based on at least one matching result.

According to an embodiment of the present disclosure, the business information risk identification method may further include the following operations:

According to the embodiment of the disclosure, under the condition that the data type of the target rule item data is the money attribute type, the value taking mode of the corresponding serial number 1 rule item in the table 1 can be used for inquiring to obtain the position of the target key character, and the target key data is extracted from the target content data corresponding to the target identification data according to the value taking mode of the rule item and the obtained position of the target key character.

According to the embodiment of the present disclosure, in the case that the data type of the target rule item data is the amount attribute type, specifically, the explanation may be given by taking the MT103 specific message as an example.

According to the embodiment of the disclosure, the specific type of the target rule item data is determined under the condition that the target rule item data is judged to be the attribute type of the service participant. Specifically, it may be determined that the target identification data of the target rule item data corresponds to at least one of "daily/currency type/clearing amount" corresponding to "32A". Wherein, the information format of the daily/currency/clearing amount comprises characters and numbers.

According to the embodiment of the disclosure, according to the corresponding target key data extraction rule, the rule item value mode of the corresponding sequence number 1 in the table 1 is selected to perform the operation of querying and sending the target rule item data in the corresponding message. For example, the target key data obtained by inquiring all the target content data associated with the target identification data in the target rule item data of at least one item of 'daily/currency type/clearing amount'.

According to the embodiment of the disclosure, after the target key data is obtained, the matching rule is selected based on the actual situation, and is matched with the risk information in the risk information list, so that the matching result is obtained, and the risk identification result of the service message information is further determined.

According to the embodiment of the disclosure, for example, when the target key data is a type representing a currency type, the target key data is matched with the risk information in the risk information list according to the matching rules that the corresponding serial number 7 "includes" and the serial number 8 "does not include" in table 1, and the matching result is obtained, so as to determine the risk identification result of the service message information. For example, when the target key data conforms to the matching rule that the corresponding sequence number 7 "includes" in table 1, it indicates that the risk identification result of the service packet information is determined as the target risk identification result, and the service packet information may be intercepted.

According to the embodiment of the disclosure, for example, when the target key data is a type representing the clearing amount, the target key data may be matched with the risk information in the risk information list according to the matching rules that the corresponding sequence number 1 is equal to and the sequence number 2 is not equal to in table 1, so as to obtain a matching result and further determine the risk identification result of the service message information; or matching with the risk information in the risk information list according to the matching rules of "include" and "do not include" of the serial number 7 and "do not include" of the serial number 8 in table 1, so as to obtain a matching result and further determine a risk identification result of the service message information.

According to the embodiment of the disclosure, when the specific value represented by the target key data does not conform to the specific value represented by the matching rule, for example, when the specific value represented by the target key data is not equal to the specific value of the clearing amount that the service message information should include, it indicates that the risk identification result of the service message information is determined as the target risk identification result, and then the service message information may be intercepted. Or when the specific value represented by the target key data is equal to the specific value of the clearing amount included in the known risky service message, it indicates that the risk identification result of the service message information is determined as the target risk identification result, and the service message information can be intercepted. It should be understood that these descriptions are only exemplary and are not intended to limit the correspondence of the matching rules to the risk identification results of the embodiments of the present disclosure.

According to an embodiment of the present disclosure, the service packet information may include at least one of the following:

remittance request message information, remittance accounting message information, remittance message information, compliance processing message information.

According to the embodiment of the disclosure, the service information risk identification method includes, but is not limited to, identifying for the MT103 message, and may also identify for the MT 202. MT202 includes, but is not limited to, the following rule item data: issuing bank, receiving bank, business number, remittance currency, remittance amount, remittance origination date, remittance user account number, remittance user information, initiating organization, original remittance user account number, original remittance bank, issuing bank agent account number, receiving bank agent account number, third party reimbursement bank, intermediary bank account number, organization account number, account bank account number, and account bank postscript. MT202 may be identified by similar operations, resulting in a risk identification result.

According to the embodiment of the disclosure, the target rule item data in the service message corresponding to the attribute type of the service participant is extracted, the target key data with high risk correlation degree is obtained according to the key field query mode, and then the target key data is matched with the risk information in the risk information list to obtain the matching result, so that the risk identification result is determined. And extracting target rule item data in the service message corresponding to the amount attribute type, obtaining target key data with higher risk correlation degree by traversing the target rule item data query mode, and determining a risk identification result by similar operation. The business information risk identification method can flexibly extract the target key data with higher risk correlation degree aiming at the business messages of different message categories and different target rule item data in the business messages, and further match the target key data with the risk information in the risk information list, so that the automatic matching of the business messages and the risk information is realized. Meanwhile, under the condition that the risk information list is updated timely, the method can still ensure that target key data with higher risk in the service message information can be identified timely, so that the timeliness of service message information identification is improved at least partially. And, avoiding repeated inquiry of the identified service message saves resources.

Based on the business information risk identification method, the disclosure also provides a business information risk identification device. The apparatus will be described in detail below with reference to fig. 5.

Fig. 5 schematically shows a block diagram of a business information risk identification apparatus according to an embodiment of the present disclosure.

As shown in fig. 5, the business information risk identifying apparatus 500 of this embodiment includes: a query module 510, an extraction module 520, a matching module 530, and a determination module 540.

The query module 510 is configured to query, according to a packet type of service packet information, target rule item data in the service packet information according to a preset rule, where the target rule item data includes target identification data and target content data associated with the target identification data.

The extracting module 520 is configured to extract the target key data in the target content data according to the data type of the target rule item data and the target identification data.

The matching module 530 is configured to match the target key data with the risk information in the risk information list according to a matching rule, so as to obtain a matching result.

The determining module 540 is configured to determine a risk identification result of the service packet information according to the matching result.

According to an embodiment of the present disclosure, the data type of the target rule item data includes a business participant attribute type.

The extraction module further comprises a first query submodule and a first extraction submodule.

And the first query submodule is used for querying a target key data extraction rule and a target key character position corresponding to the target identification data from the risk evaluation form according to the target identification data under the condition that the data type of the target rule item data is the attribute type of the business participant.

The first extraction submodule is used for extracting target key data from target content data corresponding to the target identification data according to the target key data extraction rule and the target key character position.

According to an embodiment of the present disclosure, the first query submodule includes a first query unit and a first determination unit.

The first query unit is used for querying a target key bit character segment corresponding to the target identifier from the risk evaluation form according to the target identifier data, wherein the target key bit character segment comprises at least one character.

The first determining unit is for determining a target key character position corresponding to the target identification data based on a matching result of the target key character segment and the target content data corresponding to the target identification data.

According to an embodiment of the present disclosure, the matching module includes a second query submodule and a first matching submodule.

And the second query submodule is used for querying a target risk information node associated with the target identification data from the risk information list according to the target identification data corresponding to the target key data, wherein the target risk information node comprises target risk attribute information.

And the first matching submodule is used for carrying out character matching on the target key data and the target risk attribute information to obtain a matching result.

The extraction module further comprises: a second determination submodule and a second extraction submodule.

And the second determining submodule is used for determining all character data of the target content data associated with the target identification data as target key data under the condition that the data type of the target rule item data is a money attribute type.

And the second extraction submodule is used for extracting the target key data.

The matching module comprises: a third query submodule, a fourth query submodule, and a second match submodule.

And the third query submodule is used for querying a target risk information node associated with the target identification data from the risk information list according to the target identification data corresponding to the target key data, wherein the target risk information node comprises target risk amount information.

And the fourth query submodule is used for querying the target money matching rule corresponding to the target identification data according to the target identification data corresponding to the target key data.

And the second matching submodule is used for processing a comparison result of the target key data and the target risk amount information according to the target amount matching rule to obtain a matching result.

The determination module comprises a risk identification result determination submodule.

And the risk identification result determining submodule is used for determining the risk identification result of the service message information as a target risk identification result under the condition that at least one of the N matching results is characterized and matched, wherein the target risk identification result is characterized that the service message information has risks.

According to the embodiment of the disclosure, the business information risk identification device further comprises an interception module.

The interception module is used for intercepting the service message information under the condition that the risk identification result represents that the service message information has risks.

According to an embodiment of the present disclosure, any plurality of the query module 510, the extraction module 520, the matching module 530, and the determination module 540 may be combined and implemented in one module, or any one of them may be split into a plurality of modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of the other modules and implemented in one module. According to an embodiment of the present disclosure, the business information risk identifying apparatus 500 includes: at least one of the querying module 510, the extracting module 520, the matching module 530 and the determining module 540 may be implemented at least partially as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented in hardware or firmware in any other reasonable manner of integrating or packaging a circuit, or in any one of three implementations of software, hardware and firmware, or in any suitable combination of any of them. Alternatively, the business information risk identifying apparatus 500 includes: at least one of the query module 510, the extraction module 520, the matching module 530 and the determination module 540 may be at least partially implemented as a computer program module, which when executed may perform corresponding functions.

As shown in fig. 6, an electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 602 or a program loaded from a storage section 608 into a Random Access Memory (RAM) 603. Processor 601 may include, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or associated chipset, and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), among others. The processor 601 may also include onboard memory for caching purposes. Processor 601 may include a single processing unit or multiple processing units for performing different actions of a method flow according to embodiments of the disclosure.

In the RAM 603, various programs and data necessary for the operation of the electronic apparatus 600 are stored. The processor 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. The processor 601 performs various operations of the method flows according to the embodiments of the present disclosure by executing programs in the ROM 602 and/or RAM 603. Note that the programs may also be stored in one or more memories other than the ROM 602 and RAM 603. The processor 601 may also perform various operations of the method flows according to embodiments of the present disclosure by executing programs stored in the one or more memories.

Electronic device 600 may also include input/output (I/O) interface 605, input/output (I/O) interface 605 also connected to bus 604, according to an embodiment of the disclosure. The electronic device 600 may also include one or more of the following components connected to the I/O interface 605: an input portion 606 including a keyboard, a mouse, and the like; an output portion 607 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage section 608 including a hard disk and the like; and a communication section 609 including a network interface card such as a LAN card, a modem, or the like. The communication section 609 performs communication processing via a network such as the internet. A driver 610 is also connected to the I/O interface 605 as needed. A removable medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 610 as necessary, so that the computer program read out therefrom is mounted in the storage section 608 as necessary.

The present disclosure also provides a computer-readable storage medium, which may be embodied in the device/apparatus/system described in the above embodiments; or may exist separately and not be assembled into the device/apparatus/system. The computer-readable storage medium carries one or more programs which, when executed, implement the method according to an embodiment of the disclosure.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example but is not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, a computer-readable storage medium may include the ROM 602 and/or RAM 603 described above and/or one or more memories other than the ROM 602 and RAM 603.

Embodiments of the present disclosure also include a computer program product comprising a computer program containing program code for performing the method illustrated in the flow chart. When the computer program product runs in a computer system, the program code is used for causing the computer system to realize the method provided by the embodiment of the disclosure.

The computer program performs the above-described functions defined in the system/apparatus of the embodiments of the present disclosure when executed by the processor 601. The systems, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

In one embodiment, the computer program may be hosted on a tangible storage medium such as an optical storage device, a magnetic storage device, or the like. In another embodiment, the computer program may also be transmitted, distributed in the form of signals over a network medium, downloaded and installed via the communication section 609, and/or installed from a removable medium 611. The computer program containing program code may be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 609, and/or installed from the removable medium 611. The computer program, when executed by the processor 601, performs the above-described functions defined in the system of the embodiments of the present disclosure. The systems, devices, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

In accordance with embodiments of the present disclosure, program code for executing computer programs provided by embodiments of the present disclosure may be written in any combination of one or more programming languages, and in particular, these computer programs may be implemented using high level procedural and/or object oriented programming languages, and/or assembly/machine languages. The programming language includes, but is not limited to, programming languages such as Java, C + +, python, the "C" language, or the like. The program code may execute entirely on the user computing device, partly on the user device, partly on a remote computing device, or entirely on the remote computing device or server. In situations involving remote computing devices, the remote computing devices may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to external computing devices (e.g., through the internet using an internet service provider).

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Those skilled in the art will appreciate that various combinations and/or combinations of features recited in the various embodiments and/or claims of the present disclosure can be made, even if such combinations or combinations are not expressly recited in the present disclosure. In particular, various combinations and/or combinations of the features recited in the various embodiments and/or claims of the present disclosure may be made without departing from the spirit or teaching of the present disclosure. All such combinations and/or associations are within the scope of the present disclosure.

The embodiments of the present disclosure have been described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described separately above, this does not mean that the measures in the embodiments cannot be used in advantageous combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be devised by those skilled in the art without departing from the scope of the present disclosure, and such alternatives and modifications are intended to be within the scope of the present disclosure.

Claims

1. A business information risk identification method comprises the following steps:

according to the message category of the service message information, inquiring target rule item data in the service message information according to a preset rule, wherein the target rule item data comprises target identification data and target content data associated with the target identification data;

extracting target key data in the target content data according to the data type of the target rule item data and the target identification data;

matching the target key data with risk information in a risk information list according to a matching rule to obtain a matching result; and

2. The method of claim 1, wherein the data type of the target rule item data comprises a business participant attribute type;

under the condition that the data type of the target rule item data is a business participant attribute type, inquiring a target key data extraction rule and a target key character position corresponding to the target identification data from a risk evaluation form according to the target identification data; and

3. The method of claim 2, wherein querying, from a risk assessment form, a target key character location corresponding to the target identification data according to the target identification data comprises:

inquiring a target key position character segment corresponding to the target identifier from the risk evaluation form according to the target identifier data, wherein the target key position character segment comprises at least one character;

and determining the position of the target key character corresponding to the target identification data according to the target key character segment and the matching result of the target content data corresponding to the target identification data.

4. The method of claim 2, wherein the risk information includes risk attribute information;

according to a matching rule, matching the target key data with risk information in a risk information list comprises the following steps:

inquiring a target risk information node associated with the target identification data from the risk information list according to target identification data corresponding to the target key data, wherein the target risk information node comprises target risk attribute information;

5. The method of claim 1, wherein the data types of the target rule item data further include a monetary attribute type;

determining all character data of target content data associated with the target identification data as the target key data under the condition that the data type of the target rule item data is a money attribute type; and

and extracting the target key data.

6. The method of claim 5, wherein the risk information includes risk amount information;

according to the matching rule, the step of matching the target key data with the risk information in the risk information list comprises the following steps:

inquiring a target risk information node associated with the target identification data from the risk information list according to target identification data corresponding to the target key data, wherein the target risk information node comprises target risk amount information;

inquiring a target money matching rule corresponding to the target identification data according to the target identification data corresponding to the target key data;

processing a comparison result of the target key data and the target risk amount information according to the target amount matching rule to obtain a matching result;

7. The method of claim 1, wherein the matching result includes N, N being a positive integer greater than 1;

8. The method of claim 1, wherein the service packet information comprises at least one of:

9. The method of any of claims 1 to 8, further comprising:

10. A business information risk identification apparatus, comprising:

the query module is used for querying target rule item data in the service message information according to a preset rule according to the message category of the service message information, wherein the target rule item data comprise target identification data and target content data associated with the target identification data;

the extraction module is used for extracting target key data in the target content data according to the data type of the target rule item data and the target identification data;

the matching module is used for matching the target key data with the risk information in the risk information list according to a matching rule to obtain a matching result; and

11. An electronic device, comprising:

one or more processors;

a storage device to store one or more programs,

wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method of any of claims 1-9.

12. A computer readable storage medium having stored thereon executable instructions which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 9.

13. A computer program product comprising a computer program which, when executed by a processor, carries out the method according to any one of claims 1 to 9.