CN115760384A - Abnormal behavior recognition method, abnormal behavior recognition device, electronic device, and storage medium - Google Patents
Abnormal behavior recognition method, abnormal behavior recognition device, electronic device, and storage medium Download PDFInfo
- Publication number
- CN115760384A CN115760384A CN202211267803.4A CN202211267803A CN115760384A CN 115760384 A CN115760384 A CN 115760384A CN 202211267803 A CN202211267803 A CN 202211267803A CN 115760384 A CN115760384 A CN 115760384A
- Authority
- CN
- China
- Prior art keywords
- abnormal behavior
- information
- result
- behavior recognition
- message
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 206010000117 Abnormal behaviour Diseases 0.000 title claims abstract description 183
- 238000000034 method Methods 0.000 title claims abstract description 62
- 238000003860 storage Methods 0.000 title claims abstract description 18
- 238000012545 processing Methods 0.000 claims abstract description 16
- 238000013528 artificial neural network Methods 0.000 claims description 41
- 230000007547 defect Effects 0.000 claims description 22
- 238000012360 testing method Methods 0.000 claims description 19
- 238000004458 analytical method Methods 0.000 claims description 12
- 238000004590 computer program Methods 0.000 claims description 12
- 230000008439 repair process Effects 0.000 claims description 3
- 230000008569 process Effects 0.000 abstract description 12
- 238000004900 laundering Methods 0.000 description 32
- 238000012549 training Methods 0.000 description 29
- 239000013598 vector Substances 0.000 description 12
- 230000006870 function Effects 0.000 description 10
- 238000010586 diagram Methods 0.000 description 5
- 238000004891 communication Methods 0.000 description 4
- 238000013507 mapping Methods 0.000 description 4
- 238000004088 simulation Methods 0.000 description 3
- 230000006399 behavior Effects 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000009466 transformation Effects 0.000 description 2
- 238000012795 verification Methods 0.000 description 2
- 230000008859 change Effects 0.000 description 1
- 238000013527 convolutional neural network Methods 0.000 description 1
- 125000004122 cyclic group Chemical group 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 239000003814 drug Substances 0.000 description 1
- 229940079593 drug Drugs 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 238000000802 evaporation-induced self-assembly Methods 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000003032 molecular docking Methods 0.000 description 1
- 238000003062 neural network model Methods 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 230000002265 prevention Effects 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
Images
Landscapes
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The application discloses an abnormal behavior identification method, an abnormal behavior identification device, electronic equipment and a storage medium. The abnormal behavior identification method comprises the following steps: acquiring historical service information of a target client from a database of a financial service platform; acquiring a plurality of characteristic information of the target client according to the historical service information; and inputting all the characteristic information into a pre-debugged abnormal behavior recognition system for processing to obtain a recognition result. According to the abnormal behavior identification method, automatic identification of abnormal behaviors is achieved, errors are not prone to occurring in the identification process, the accuracy of identification results is high, the identification work efficiency is improved, the manual workload is reduced, the labor cost is reduced, and the current abnormal behavior identification requirement can be well met.
Description
Technical Field
The present application relates to the field of computer technologies, and in particular, to an abnormal behavior recognition method, an abnormal behavior recognition apparatus, an electronic device, and a storage medium.
Background
With the development of socio-economy, there are more and more illegal acts, such as money laundering, performed by the business of financial institutions. For this case, the financial institution needs to perform abnormal behavior recognition. In the current technology, financial institutions control the risk of abnormal behavior within the system by means of procedures, rules, and the like. Generally, after auditing through a preset rule, manual identification is performed by collecting and investigating relevant information and according to whether the relevant information meets the preset rule, so as to judge whether a customer behavior is an abnormal behavior. The defects of the manual identification of the abnormal behaviors include high error rate in the identification process, low accuracy of identification results, low working efficiency and high labor cost caused by large workload. Based on this, a more effective abnormal behavior recognition solution is needed.
Disclosure of Invention
The application aims to provide an abnormal behavior identification method, an abnormal behavior identification device, electronic equipment and a storage medium, and the technical problems that in the related art, when abnormal behaviors are identified manually, the error rate of an identification process is high, the accuracy of an identification result is low, the working efficiency is low, and the labor cost is high due to large workload can be solved.
The following presents a simplified summary in order to provide a basic understanding of some aspects of the disclosed embodiments. This summary is not an extensive overview and is intended to neither identify key/critical elements nor delineate the scope of such embodiments. Its sole purpose is to present some concepts in a simplified form as a prelude to the more detailed description that is presented later.
According to an aspect of an embodiment of the present application, there is provided an abnormal behavior identification method, including:
acquiring historical service information of a target client from a database of a financial service platform;
acquiring a plurality of characteristic information of the target client according to the historical service information;
and inputting all the characteristic information into a pre-debugging abnormal behavior recognition system for processing to obtain a recognition result.
According to another aspect of the embodiments of the present application, there is provided an abnormal behavior recognition apparatus including:
the historical service information acquisition module is used for acquiring the historical service information of the target client from a database of the financial service platform;
the characteristic information acquisition module is used for acquiring a plurality of characteristic information of the target client according to the historical service information;
and the identification processing module is used for inputting all the characteristic information into a pre-debugged abnormal behavior identification system for processing to obtain an identification result.
According to another aspect of the embodiments of the present application, there is provided an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-mentioned abnormal behavior identification method.
According to another aspect of embodiments of the present application, there is provided a computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the above-mentioned abnormal behavior recognition method.
The technical scheme provided by one aspect of the embodiment of the application can have the following beneficial effects:
according to the abnormal behavior identification method provided by the embodiment of the application, the historical service information of the target client is acquired from the database of the financial service platform, the characteristic information of the target client is acquired according to the historical service information, all the characteristic information is input into the pre-debugging abnormal behavior identification system to be processed, the identification result is obtained, the automatic identification of the abnormal behavior is realized, the error is not easy to occur in the identification process, the accuracy of the identification result is high, the identification work efficiency is improved, the manual workload is reduced, the labor cost is reduced, and the current abnormal behavior identification requirement can be well met.
Additional features and advantages of the application will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the embodiments of the application, or may be learned by the practice of the embodiments.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the present application, and other drawings can be obtained by those skilled in the art without creative efforts.
Fig. 1 is a schematic application environment diagram illustrating an abnormal behavior recognition method according to an embodiment of the present application.
Fig. 2 shows a flowchart of an abnormal behavior recognition method according to an embodiment of the present application.
Fig. 3 shows a flowchart of step S20 in fig. 2.
Fig. 4 shows a flowchart of a debugging method of the abnormal behavior recognition system in a specific example.
Fig. 5 shows a flowchart of step S30 in fig. 2.
FIG. 6 illustrates a radial direction in one embodiment and (3) a schematic structure diagram of the basis function neural network.
Fig. 7 shows a block diagram of an abnormal behavior recognition apparatus according to an embodiment of the present application.
Fig. 8 shows a block diagram of an electronic device according to an embodiment of the present application.
FIG. 9 illustrates a computer-readable storage medium of an embodiment of the present application.
The implementation, functional features and advantages of the objects of the present application will be further explained with reference to the accompanying drawings in conjunction with the embodiments.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is further described with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
It will be understood by those within the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the prior art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.
It will be understood that the terms "first," "second," "third," and the like are used merely to distinguish one description from another, and are not intended to indicate or imply relative importance. It should also be understood that, although the terms "first," "second," "third," etc. may be used herein in some of the present application embodiments to describe various objects, these objects should not be limited by these terms. These terms are used only to distinguish various objects.
The abnormal behavior identification method provided by the application can be applied to the application environment shown in fig. 1, wherein the user terminal communicates with the server terminal through the internet. The server executes the steps of the abnormal behavior recognition method, acquires historical service information of a target client from a database of a financial service platform, acquires a plurality of characteristic information of the target client according to the historical service information, inputs all the characteristic information into a pre-trained abnormal behavior recognition model for processing to obtain a recognition result, and can send the obtained recognition result to a user terminal. The server terminal can also receive an instruction for starting abnormal behavior recognition operation sent by the user terminal. The user terminal may be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices. The server side can be implemented by an independent server or a server cluster formed by a plurality of servers. The present application is described in detail below with specific examples.
Referring to fig. 2, an embodiment of the present application provides an abnormal behavior identification method, including steps S10 to S30:
and S10, acquiring historical service information of the target client from a database of the financial service platform.
The financial service platform can be, for example, an internet platform provided by a financial institution such as electronic banking, payment platform, insurance company payment application program, and the like. The financial service platform is suitable for mobile intelligent terminals such as smart phones and the like, and provides great convenience for people to use. The user can operate on mobile intelligent terminals such as a smart phone and the like to handle various financial services. The abnormal behavior related to the embodiment may include money laundering behavior and the like.
And S20, acquiring a plurality of characteristic information of the target client according to the historical service information.
In some embodiments, the characteristic information of the customer may include data generated when the customer conducts a transaction, such as the identity of the customer, a transaction amount, a transaction time, and the like.
In some embodiments, the plurality of feature information includes identity information, financial transaction information, and network information.
Referring to fig. 3, step S20 may include S201 to S203:
s201, extracting the identity information and the financial service information of the target client from the historical service data.
Specifically, the identity information includes information such as name, age, sex, identification number, native place, etc., information such as a mobile phone number, whether married, nationality, date of birth, etc., and personal biometric information such as fingerprint information, etc.
The financial transaction information may include, for example, financial transaction tags, transaction amounts, payment records, overdraft records, transaction logs, transaction credentials, and the like.
On the basis of determining the historical business data of the target customer pulled from the financial business platform, transaction amount in the historical business data is divided into an integer and a decimal, and the integer and the decimal are respectively classified, so that the storage space occupied by the extracted financial business information is reduced under the condition of ensuring accuracy as much as possible.
When the transaction amount is an integer: if the transaction amount is less than the first amount (for example, 5 ten thousand, 1 ten thousand, etc.), directly using the transaction amount as financial business information; if the transaction amount is larger than or equal to the first amount, the transaction amount is sorted into data in ten thousand units, and the sorted data can be regarded as extracted financial service information.
When the transaction amount is a non-integer: if the transaction amount is less than the second amount (e.g., 1, 5, 10, etc.), the transaction amount is fully reserved, ensuring data accuracy. When the transaction amount is smaller than the second amount, the transaction amount is directly used as financial business information. If the transaction amount is larger than the second amount and smaller than the first amount, rounding off the transaction amount and only reserving an integer part of the transaction amount; if the transaction amount is larger than the first amount, two decimal places are reserved by rounding in ten thousand units, so that the storage space occupied by the financial service information can be reduced.
Different anti-money laundering types correspond to different financial service tags, one anti-money laundering type corresponds to at least one type of financial service tag (the at least one type of financial service tag can be called as a first number of financial service tags); different financial service tags correspond to different conditions, and one type of financial service tag corresponds to at least one condition (at least one condition may be referred to as a second number of conditions). The financial transaction tag may also be referred to as a financial transaction feature.
In particular, the anti-money laundering types may include an anti-money laundering type related to drug crimes, a black social nature organization crime anti-money laundering type, a terrorist activity crime anti-money laundering type, a smuggly crime anti-money laundering type, a financial fraud crime anti-money laundering type, and the like.
In one specific example, extracting financial transaction information of the target customer from the historical transaction data may include: and extracting characteristic information of each type of financial service label in at least one type of financial service label matched with the target anti-money laundering type from the historical service information.
Specifically, extracting feature information of each type of financial service tag in at least one type of financial service tag matched with the target anti-money laundering type from the historical service information may include:
respectively extracting characteristic information of each type of financial service label in at least one type of financial service label from the financial service information to obtain a financial service label of a target customer;
and after the target anti-money laundering type is determined, if the target anti-money laundering type is not empty, inquiring the mapping relation between the anti-money laundering type and the financial service label to obtain at least one type of financial service label corresponding to the target anti-money laundering type.
Specifically, at least one type of financial service tag corresponding to the second option is preset, and after the target anti-money laundering type is determined, if the target anti-money laundering type is empty, the preset at least one type of financial service tag corresponding to the second option may be determined as the at least one type of financial service tag corresponding to the target anti-money laundering type.
It should be noted that, when the selected target option in the first information item is the second option, it is determined that the target anti-money laundering type is null; on the contrary, when the selected target option in the first information item is the first option, the target anti-money laundering type is not empty, and the target anti-money laundering type is an anti-money laundering type selected by an anti-money laundering auditor in at least one anti-money laundering type.
Specifically, the characteristic information of each type of financial service label in at least one type of financial service label is respectively extracted from the financial service information of a target customer; and splicing the characteristic information of all the financial service labels in at least one type of financial service labels according to a preset splicing mode to obtain the financial service label of the target customer.
Specifically, taking a financial service tag as an example, the manner of extracting the feature information of the financial service tag from the financial service information of the target customer may be: inquiring a mapping relation between a preset financial service label and a condition, and acquiring at least one condition corresponding to the financial service label; selecting the condition with the highest priority which is not selected in history from at least one condition according to the priority of the at least one condition; determining whether financial service information meeting the currently selected condition exists in the financial service information; and if the financial service information meeting the currently selected condition exists in the financial service information, determining the financial service information meeting the currently selected condition in the financial service information as the characteristic information of the financial service label.
And if the financial service information meeting the condition does not exist in the financial service information of the target client aiming at each condition in the condition sequence, the characteristic information of the financial service label does not exist in the financial service information of the target client.
S202, acquiring network information of a target client from the Internet based on the identity information.
The network information of the target client in the internet can be automatically inquired according to the identity information of the target client. For example, whether a target user has a crime record or not is queried from a related department website according to a name, an identification number or the like, or related content is searched on the internet according to the name to obtain reputation evaluation of the target user, and the like, so that corresponding network information is obtained.
Exemplarily, after the original external network information of the target client is determined according to the identity information of the target client, a word hit by the original external network information in the sensitive feature word bank can be determined, and the word hit by the original external network information in the sensitive feature word bank is determined as the external network information of the target client.
Specifically, each word in the sensitive feature word bank can be regarded as a sensitive word, and all sensitive words hit by the original external network information in the sensitive feature word bank are determined as the external network information of the target client.
For example, the sensitive feature word bank may be an existing word bank matched with the sensitive feature and already arranged by the abnormal behavior recognition system; the existing word bank comprises sensitive words A, B and C, if the external network information of the target client comprises the sensitive words B and C, the words in the sensitive feature word bank hit by the external network information of the target client can be considered to comprise the sensitive words B and C, and correspondingly, the external network information of the target client is determined to be composed of the sensitive words B and C.
And S203, forming a plurality of characteristic information by using the identity information, the financial service information and the network information.
Specifically, the content included in the identity information, the financial service information, and the network information may be preset according to actual needs. For example, the identity information may be set to include information such as name, age, sex, identification number, native place, etc., may also include information such as a mobile phone number, whether married, nationality, date of birth, etc., and may also include personal biometric information such as fingerprint information, etc.
And S30, inputting all the characteristic information into the abnormal behavior recognition system which is debugged in advance to be processed, and obtaining a recognition result.
In some embodiments, before step S30, the method of this embodiment further includes a debugging process of the pre-debugging completed abnormal behavior recognition system, where the debugging process includes:
step 2, distributing service unique identifiers to different services through the abnormal behavior recognition system, and providing a message theme, a message label and a message body;
step 3, extracting data fields from corresponding service information according to the unique service identification, and assembling the data fields into an entry parameter to be set in the message body;
step 4, splicing the message theme, the message label and the message body to obtain a message queue message;
step 5, analyzing the message queue message through an abnormal behavior recognition system to obtain an analysis result;
step 6, determining whether the debugging requirement is met or not according to the analysis result, and if so, determining that the debugging is finished;
and 7, if the defect is not found and repaired, turning to the cycle execution of allocating the unique service identifier to different services according to the abnormal behavior recognition system rule until the debugging is determined to be finished.
Illustratively, the determining whether the debugging requirement is met according to the parsing result includes:
comparing an expected result with the analysis result according to the service unique identifier, and determining whether the comparison contents of the expected result and the analysis result are completely consistent; if the data are completely consistent, determining that the debugging requirement is met; otherwise, determining that the debugging requirement is not met.
Specifically, the comparison content for comparing the expected result with the analysis result includes whether hit occurs, a matching type, and customer identity information.
Illustratively, the finding and repairing the defect includes:
if the abnormal behavior recognition system can consume the message queue message and the consumption result accords with the expected consumption result, determining that the test code has a defect, and searching and repairing the defect in the test code; and if the abnormal behavior recognition system cannot consume the message queue message or the consumption result is not in accordance with the expected consumption result, determining that the abnormal behavior recognition system has defects, positioning the defects of the system and completing system repair according to the positioning result.
In a specific example shown in fig. 4, a debugging method of a pre-debugging completed abnormal behavior recognition system includes:
1) According to the rules of the money LAUNDERING prevention system, distributing service unique identification BizAppName to different services, and providing MQ-Topic & Tag, topic = ANTI _ LAUNDERING, and Tag = DATA _ GATHER. The MQ is a message queue.
2) And fishing DB data according to the service unique identification, public and private relations, hit, miss and other dimensions distributed by the anti-money laundering system and storing the DB data in a cache.
3) And a multithreading concurrency mode is adopted, data information is read one by one, and data fields are analyzed one by one and assembled into a specific access participant to the message Body MQ-Body.
4) And splicing the message theme MQ-Topic, the message Tag and the message Body and sending the message, receiving and consuming the MQ message by the anti-money laundering system, requesting a bank system interface and falling a processing result to the MYSQL database.
5) The expected cache result and the analysis result of the anti-money laundering system are compared through the unique identifier, the comparison content is a hit result (hit/miss), a matching type (public/private), important information (name, identification number, birth date, nationality, legal representative, stockholder and the like), and whether the information accords with the expectation is judged.
6) If the hit results, the matching types and the important information of the two sides are consistent, the scene MQ message is considered to be simulated to be sent through.
7) If the hit results, the matching types and the important information on the two sides are inconsistent, the reason is analyzed and judged to be system defect or test code defect, if the MQ message sent by the upper layer service party can be consumed normally and accords with the expected result, the MQ message is produced for the test code defect, namely the simulation service party has a problem, if the MQ message sent by the upper layer service party is consumed normally and requests a bank system, and the returned result does not accord with the expected result (the hit results, the matching types and the important information), the system defect is determined, which party system defect is required to be developed and co-located by multiple parties, and the system repair is completed according to the locating result.
8) And when the system defects are repaired, starting the automatic test codes by one key again, and carrying out test verification on the test codes again according to the steps 2) -7), and circulating the steps until the test is passed, so that the abnormal behavior recognition system which is debugged in advance is obtained, the new access test and the system upgrading regression test of each business party are completed, and the system is put into production and operates stably.
In the example, the MQ messages are generated in a simulation mode, test data of all service parties and all scenes can be constructed quickly and flexibly, the MQ messages can be generated in a full-automatic mode through one-key execution to cover all the service scenes, and a large amount of time can be saved. In the project process of the example, no matter the first docking test or the continuous update of the subsequent iteration, the system test of each iteration is completed without depending on the fact that professional testers of each business party walk a long business scene to trigger the sending of MQ messages. MQ message test verification is generated based on simulation, so that complicated test processes and human resource investment are reduced, the test efficiency is improved, the test coverage is high, and system defects can be found more quickly and earlier.
In some embodiments, the pre-commissioning complete abnormal behavior recognition system may recognize a model for the pre-trained abnormal behavior. As shown in fig. 5, step S30 may include:
s301, inputting all feature information into a pre-trained abnormal behavior recognition model to obtain feature vectors corresponding to all feature information of a target client;
s302, performing weighted operation on the feature vectors corresponding to the feature information of the target client by using the preset weight corresponding to the feature information to obtain a weighted operation result;
and S303, obtaining an abnormal behavior recognition result of the target client according to the weighting operation result.
Illustratively, identity information, financial service information and network information of a target client are extracted, the three pieces of feature information are input into a preset neural network to obtain a feature vector corresponding to each piece of feature information of the target client, wherein preset weights corresponding to the identity information, the financial service information and the network information of the target client are 0.25, 0.5 and 0.25 in sequence, weighting operation is performed on the feature vector corresponding to each piece of feature information of the target client to obtain a weighting operation result, and an abnormal behavior recognition result of the target client is obtained according to the weighting operation result.
In some embodiments, a method of training a pre-trained abnormal behavior recognition model, comprising:
step 01, obtaining a training set, wherein the training set comprises characteristic information of a plurality of sample clients and an abnormal behavior recognition result of each sample client, and each sample client has a plurality of characteristic information;
and step 02, performing iterative training on a preset neural network by using the feature information of the plurality of sample clients, the preset weight corresponding to each feature information and the recognition result of each sample client to obtain a trained abnormal behavior recognition model.
In some embodiments, the step of performing iterative training on a preset neural network by using the feature information of a plurality of sample clients, the preset weight corresponding to each feature information, and the recognition result of each sample client to obtain a trained abnormal behavior recognition model includes:
extracting each feature information of a first client, inputting each feature information of the first client into a preset neural network to obtain a feature vector corresponding to each feature information of the first client, wherein the first client is any one of a plurality of sample clients;
performing weighted operation on the feature vectors corresponding to the feature information of the first client by using the preset weight corresponding to the feature information to obtain a weighted operation result;
obtaining an abnormal behavior prediction result of the first client according to the weighting operation result;
comparing the abnormal behavior prediction result with the abnormal behavior prediction result of the first client, adjusting parameters of a preset neural network and weights corresponding to all feature information according to the comparison result, turning to execute extraction of all feature information of the first client, inputting all feature information of the first client into the preset neural network, and obtaining feature vectors corresponding to all feature information of the first client;
and when the preset training stopping condition is reached, stopping iterative training to obtain the trained abnormal behavior recognition model.
Illustratively, obtaining the abnormal behavior prediction result of the first client according to the weighting operation result may include: and inputting the weighted operation result into an output layer in a preset neural network to obtain an abnormal behavior prediction result of the first client, wherein the abnormal behavior prediction result comprises whether the first client has abnormal behaviors and the probability of the abnormal behaviors.
In some embodiments of the present application, the weighted operation result is input to an output layer in the preset neural network, so as to obtain an abnormal behavior prediction result of the first client. The output layer of the neural network may be, for example, a full link layer, a softmax layer, or the like, and may be specifically set according to actual conditions. By obtaining whether the first client has the abnormal behavior and the probability of the abnormal behavior, the prediction result is more accurate, and the identification accuracy of the abnormal behavior is improved.
In some embodiments, the step of comparing the abnormal behavior prediction result with the abnormal behavior prediction result of the first client, and adjusting the parameters of the preset neural network and the weight corresponding to each feature information according to the comparison result includes:
comparing the abnormal behavior prediction result with the abnormal behavior prediction result of the first client to obtain a difference value between the abnormal behavior prediction result and the abnormal behavior prediction result of the first client;
and if the difference value is larger than the preset threshold value, adjusting the parameters of the preset neural network and the weight corresponding to each characteristic information.
When a preset training stopping condition is reached, stopping iterative training to obtain a trained abnormal behavior recognition model, wherein the method comprises the following steps of:
and if the difference value is smaller than or equal to the preset threshold value, stopping iterative training to obtain a trained abnormal behavior recognition model.
In some embodiments, the abnormal behavior prediction result is compared with the recognition result of the first sample to obtain a difference value between the abnormal behavior prediction result and the abnormal behavior prediction result of the first client, if the difference value is greater than a preset threshold, parameters of a preset neural network and weights corresponding to each feature information are adjusted, and if the difference value is less than or equal to the preset threshold, iterative training is stopped to obtain a trained abnormal behavior recognition model, so that the abnormal behavior recognition model is more flexible, and accuracy of abnormal behavior recognition is improved, wherein the preset threshold is specifically set according to actual conditions.
In some embodiments, after comparing the abnormal behavior prediction result with the abnormal behavior prediction result of the first client, adjusting the parameters of the preset neural network and the weights corresponding to the feature information according to the comparison result, and returning to execute the steps of extracting the feature information of the first client, inputting the feature information of the first client into the preset neural network, and obtaining the feature vector corresponding to the feature information of the first client, the method further includes:
accumulating the iterative training times; and if the iterative training times reach the preset times, stopping the iterative training to obtain the trained abnormal behavior recognition model.
In some embodiments, the step of obtaining the prediction result of the abnormal behavior of the first customer according to the result of the weighting operation includes:
and inputting the weighted operation result into an output layer in a preset neural network to obtain an abnormal behavior prediction result of the first client, wherein the abnormal behavior prediction result comprises whether the first client has abnormal behaviors and the probability of the abnormal behaviors.
In some embodiments, the abnormal behavior prediction result is compared with the abnormal behavior prediction result of the first client, the parameters of the preset neural network and the weights corresponding to the characteristic information are adjusted according to the comparison result, the iterative training times can be accumulated, if the iterative training times reach the preset times, the iterative training is stopped, and the trained abnormal behavior recognition model is obtained, so that the abnormal behavior recognition model is more flexible, and the accuracy of recognizing the abnormal behavior is improved, wherein the preset times are specifically set according to actual conditions.
In the process of training the money laundering identification model, a plurality of pieces of characteristic information of customers are comprehensively considered, weights are preset correspondingly according to different pieces of characteristic information, and during training, iterative training is carried out by using the characteristic information of a plurality of sample customers, the preset weights corresponding to the characteristic information and the identification results of the sample customers, so that the abnormal behavior identification model obtained by training is more accurate, and the identification accuracy of abnormal behaviors is improved.
In some embodiments, the predetermined neural network comprises a radial basis function neural network.
The preset neural network is an initial neural network capable of realizing anti-money laundering recognition, for example, a radial basis function neural network can be adopted, and the radial basis function neural network can overcome the defects that other types of artificial neural networks in the related art are long in training time and the number of hidden nodes is difficult to determine to a great extent.
The radial basis function neural network includes an input layer, a hidden layer, and an output layer. The transformation from the input space to the hidden layer space is non-linear, whereas the transformation from the hidden layer space to the output layer space is linear. Fig. 6 is a schematic structural diagram of the radial basis function neural network according to this embodiment.
The description formula of the radial basis function neural network employed in the present embodiment is as follows
Input layer implementation
Non-linear mapping of (2), output layer implementation
Linear mapping of (1), w j The weight between the hidden layer and the output layer,/, is the Euclidean norm,
usually taking a gaussian function.
wherein, c i Is the ith hidden node center, σ i Is a width parameter for controlling the attenuation speed of the Gaussian function, and m is the number of nodes of the hidden layer.
In addition, the preset neural network can also adopt neural network models such as a convolutional neural network, an RNN cyclic neural network or an LSTM long-short term memory network, and the like, and can be specifically selected according to actual needs.
In some embodiments, the abnormal behavior recognition result includes whether the target customer has abnormal behavior and a probability of the abnormal behavior.
In some embodiments, the abnormal behavior recognition result not only includes whether the target customer has an abnormal behavior, but also includes a probability that the customer has the abnormal behavior, so that the abnormal behavior result is more accurate, and a relevant department can process the abnormal behavior conveniently. By using the abnormal behavior recognition model to recognize the abnormal behaviors of the client, the accuracy of recognizing the abnormal behaviors is improved.
In some embodiments, the method may further comprise: and sending a recognition result prompting message, wherein the recognition result prompting message can comprise the probability that the target client has abnormal behaviors. For example, the recognition result prompting message can be sent to terminal equipment of a smartphone, a notebook computer or a desktop computer of the worker, so as to remind the worker to take corresponding measures in time.
In some embodiments, after obtaining the abnormal behavior recognition result of the target customer, a recognition result prompting message may be output for prompting the relevant department to take further measures, and in order to more clearly represent the recognition result of the abnormal behavior of the customer, the recognition result prompting message may include the probability that the target customer has the abnormal behavior.
According to the abnormal behavior identification method provided by the embodiment of the application, the historical service information of the target client is obtained from the database of the financial service platform, a plurality of characteristic information of the target client is obtained according to the historical service information, all the characteristic information is input into the pre-trained abnormal behavior identification model to be processed, the identification result is obtained, the automatic identification of the abnormal behavior is realized, the error is not easy to occur in the identification process, the accuracy of the identification result is high, the identification work efficiency is improved, the manual workload is reduced, the labor cost is reduced, and the current abnormal behavior identification requirement can be well met.
As shown in fig. 7, another embodiment of the present application provides an abnormal behavior recognition apparatus, including:
the historical service information acquisition module is used for acquiring the historical service information of the target client from a database of the financial service platform;
the characteristic information acquisition module is used for acquiring a plurality of characteristic information of the target client according to the historical service information;
and the identification processing module is used for inputting all the characteristic information into the pre-debugging abnormal behavior identification system for processing to obtain an identification result.
In some embodiments, the debugging method of the pre-debugging completed abnormal behavior recognition system comprises the following steps:
calling an initial abnormal behavior recognition system; distributing service unique identifiers to different services through the abnormal behavior recognition system, and providing a message theme, a message label and a message body; extracting data fields from corresponding service information according to the unique service identification, and assembling the data fields into a parameter set in the message body; splicing the message theme, the message label and the message body to obtain a message queue message; analyzing the message queue message through an abnormal behavior identification system to obtain an analysis result; determining whether the debugging requirement is met or not according to the analysis result, and if so, determining that the debugging is finished; if not, finding and repairing the defects, and turning to the cycle execution of allocating the unique service identifier to different services according to the abnormal behavior recognition system rule until the debugging is determined to be completed.
In some embodiments, the plurality of feature information includes identity information, financial service information, and network information; the characteristic information acquisition module is executed to acquire a plurality of characteristic information of the target client according to the historical service information, and the characteristic information acquisition module comprises: extracting the identity information and financial service information of a target client from historical service data; acquiring network information of a target client from the Internet based on the identity information; and forming a plurality of characteristic information by using the identity information, the financial service information and the network information.
In some embodiments, the inputting of all feature information into the pre-trained abnormal behavior recognition model by the recognition processing module to obtain the recognition result includes: inputting all the characteristic information into a pre-trained abnormal behavior recognition model to obtain characteristic vectors corresponding to all the characteristic information of the target client; performing weighted operation on the feature vectors corresponding to the feature information of the target client by using the preset weight corresponding to the feature information to obtain a weighted operation result; and obtaining the abnormal behavior recognition result of the target client according to the weighting operation result.
In some embodiments, a method of training a pre-trained abnormal behavior recognition model, comprising:
acquiring a training set, wherein the training set comprises characteristic information of a plurality of sample clients and an abnormal behavior recognition result of each sample client; and performing iterative training on the preset neural network by using the characteristic information of the plurality of sample clients, the preset weight corresponding to each characteristic information and the recognition result of each sample client to obtain a trained abnormal behavior recognition model.
In some embodiments, the step of performing iterative training on a preset neural network by using the feature information of a plurality of sample clients, the preset weight corresponding to each feature information, and the recognition result of each sample client to obtain a trained abnormal behavior recognition model includes:
extracting each feature information of a first client, inputting each feature information of the first client into a preset neural network to obtain a feature vector corresponding to each feature information of the first client, wherein the first client is any one of a plurality of sample clients; performing weighted operation on the feature vectors corresponding to the feature information of the first client by using the preset weight corresponding to the feature information to obtain a weighted operation result; obtaining an abnormal behavior prediction result of the first client according to the weighting operation result; and comparing the abnormal behavior prediction result with the abnormal behavior prediction result of the first client, adjusting the parameters of the preset neural network and the weight corresponding to each characteristic information according to the comparison result, and turning to extract each characteristic information of the first client for cyclic execution until a preset training stop condition is reached, and stopping iterative training to obtain a trained abnormal behavior recognition model.
In some embodiments, the step of comparing the abnormal behavior prediction result with the abnormal behavior prediction result of the first client, and adjusting the preset parameters of the neural network and the weight corresponding to each feature information according to the comparison result includes:
comparing the abnormal behavior prediction result with the abnormal behavior prediction result of the first client to obtain a difference value between the abnormal behavior prediction result and the abnormal behavior prediction result of the first client; and if the difference value is larger than the preset threshold value, adjusting the parameters of the preset neural network and the weight corresponding to each characteristic information.
In some embodiments, the step of obtaining the prediction result of the abnormal behavior of the first customer according to the result of the weighting operation includes:
and inputting the weighted operation result into an output layer in a preset neural network to obtain an abnormal behavior prediction result of the first client, wherein the abnormal behavior prediction result comprises whether the first client has abnormal behaviors and the probability of the abnormal behaviors.
In some embodiments, the predetermined neural network comprises a radial basis function neural network.
The abnormal behavior recognition device provided by the embodiment of the application can acquire historical business information of a target client from a database of a financial business platform, acquire a plurality of characteristic information of the target client according to the historical business information, input all the characteristic information into a pre-trained abnormal behavior recognition model for processing, and obtain a recognition result, so that the automatic recognition of abnormal behaviors is realized, the recognition process is not easy to make mistakes, the accuracy of the recognition result is high, the recognition work efficiency is improved, the manual workload is reduced, the labor cost is reduced, and the current abnormal behavior recognition requirement can be well met.
Another embodiment of the present application provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the computer program to implement the abnormal behavior identification method according to any one of the above embodiments.
As shown in fig. 8, the electronic device 10 may include: the system comprises a processor 100, a memory 101, a bus 102 and a communication interface 103, wherein the processor 100, the communication interface 103 and the memory 101 are connected through the bus 102; the memory 101 stores a computer program that can be executed on the processor 100, and the processor 100 executes the computer program to perform the method provided by any of the foregoing embodiments of the present application.
The Memory 101 may include a high-speed Random Access Memory (RAM), and may also include a non-volatile Memory (non-volatile Memory), such as at least one disk Memory. The communication connection between the network element of the system and at least one other network element is realized through at least one communication interface 103 (which may be wired or wireless), and the internet, a wide area network, a local network, a metropolitan area network, and the like can be used.
The bus 102 may be an ISA bus, PCI bus, EISA bus, or the like. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 101 is used for storing a program, and the processor 100 executes the program after receiving an execution instruction, and the method disclosed in any of the foregoing embodiments of the present application may be applied to the processor 100, or implemented by the processor 100.
The electronic device provided by the embodiment of the application and the method provided by the embodiment of the application have the same inventive concept and have the same beneficial effects as the method adopted, operated or realized by the electronic device.
Another embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored, where the program is executed by a processor to implement the abnormal behavior identification method of any one of the above embodiments.
Referring to fig. 9, a computer readable storage medium is shown as an optical disc 20, on which a computer program (i.e. a program product) is stored, which when executed by a processor, performs the method provided by any of the foregoing embodiments.
It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory, or other optical and magnetic storage media, which are not described in detail herein.
The computer-readable storage medium provided by the above-mentioned embodiments of the present application and the method provided by the embodiments of the present application have the same advantages as the method adopted, executed or implemented by the application program stored in the computer-readable storage medium.
It should be noted that:
the term "module" is not intended to be limited to a particular physical form. Depending on the particular application, a module may be implemented as hardware, firmware, software, and/or combinations thereof. Furthermore, different modules may share common components or even be implemented by the same component. There may or may not be clear boundaries between the various modules.
The algorithms and displays presented herein are not inherently related to any particular computer, virtual machine, or other apparatus. Various general purpose devices may also be used with the examples based on this disclosure. The required structure for constructing such a device will be apparent from the description above. In addition, this application is not directed to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of the present application as described herein, and any descriptions of specific languages are provided above to disclose the best modes of the present application.
It should be understood that, although the steps in the flowcharts of the figures are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and may be performed in other orders unless explicitly stated herein. Moreover, at least a portion of the steps in the flow chart of the figure may include multiple sub-steps or multiple stages, which are not necessarily performed at the same time, but may be performed at different times, which are not necessarily performed in sequence, but may be performed alternately or alternately with other steps or at least a portion of the sub-steps or stages of other steps.
The above examples only express embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the present application. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present application shall be subject to the appended claims.
Claims (10)
1. An abnormal behavior recognition method, comprising:
acquiring historical service information of a target client from a database of a financial service platform;
acquiring a plurality of characteristic information of the target client according to the historical service information;
and inputting all the characteristic information into a pre-debugged abnormal behavior recognition system for processing to obtain a recognition result.
2. The method of claim 1, wherein before the inputting all of the feature information into the pre-debug completed abnormal behavior recognition system for processing, the method further comprises:
calling an initial abnormal behavior recognition system;
distributing service unique identifiers to different services through the abnormal behavior recognition system, and providing a message theme, a message label and a message body;
extracting data fields from corresponding service information according to the unique service identification, and assembling the data fields into an entry parameter set in the message body;
splicing the message themes the message tag and the message body obtain a message queue message;
analyzing the message queue message through an abnormal behavior identification system to obtain an analysis result;
determining whether the debugging requirement is met or not according to the analysis result, and if so, determining that the debugging is finished;
if not, searching and repairing the defects, and turning to the cycle execution of allocating the unique service identifier to different services according to the abnormal behavior recognition system rule until the debugging is determined to be completed.
3. The method of claim 2, wherein the determining whether the debugging requirement is met according to the parsing result comprises:
comparing an expected result with the analysis result according to the service unique identifier, and determining whether the comparison contents of the expected result and the analysis result are completely consistent;
if the data are completely consistent, determining that the debugging requirement is met; otherwise, determining that the debugging requirement is not met.
4. The method of claim 2, wherein the locating and repairing defects comprises:
if the abnormal behavior recognition system can consume the message queue message and the consumption result accords with the expected consumption result, determining that the test code has a defect, and searching and repairing the defect in the test code;
and if the abnormal behavior recognition system cannot consume the message queue message or the consumption result is not in accordance with the expected consumption result, determining that the abnormal behavior recognition system has defects, positioning the defects of the system and completing system repair according to the positioning result.
5. The method of claim 1, wherein the plurality of feature information includes identity information, financial transaction information, and network information;
the obtaining of the plurality of feature information of the target client according to the historical service information includes:
extracting the identity information and financial service information of the target customer from the historical service data;
acquiring network information of the target client from the Internet based on the identity information;
and forming the plurality of characteristic information by using the identity information, the financial service information and the network information.
6. The method according to claim 4, wherein the step of comparing the abnormal behavior prediction result with the abnormal behavior prediction result of the first client, and adjusting the parameters of the preset neural network and the weights corresponding to the feature information according to the comparison result comprises:
comparing the abnormal behavior prediction result with the abnormal behavior prediction result of the first customer to obtain a difference value between the abnormal behavior prediction result and the abnormal behavior prediction result of the first customer;
and if the difference value is larger than a preset threshold value, adjusting the parameters of the preset neural network and the weight corresponding to each characteristic information.
7. The method of claim 5, wherein the step of obtaining the abnormal behavior prediction result of the first client according to the weighted operation result comprises:
and inputting the weighted operation result into an output layer in the preset neural network to obtain an abnormal behavior prediction result of the first client, wherein the abnormal behavior prediction result comprises whether the first client has abnormal behaviors and the probability of the abnormal behaviors.
8. An abnormal behavior recognition apparatus, comprising:
the historical service information acquisition module is used for acquiring the historical service information of the target client from a database of the financial service platform;
the characteristic information acquisition module is used for acquiring a plurality of characteristic information of the target client according to the historical service information;
and the identification processing module is used for inputting all the characteristic information into a pre-debugged abnormal behavior identification system for processing to obtain an identification result.
9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor executing the program to implement the abnormal behavior recognition method according to any one of claims 1 to 7.
10. A computer-readable storage medium, on which a computer program is stored, the program being executed by a processor to implement the abnormal behavior recognition method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211267803.4A CN115760384A (en) | 2022-10-17 | 2022-10-17 | Abnormal behavior recognition method, abnormal behavior recognition device, electronic device, and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211267803.4A CN115760384A (en) | 2022-10-17 | 2022-10-17 | Abnormal behavior recognition method, abnormal behavior recognition device, electronic device, and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115760384A true CN115760384A (en) | 2023-03-07 |
Family
ID=85351644
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211267803.4A Pending CN115760384A (en) | 2022-10-17 | 2022-10-17 | Abnormal behavior recognition method, abnormal behavior recognition device, electronic device, and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115760384A (en) |
-
2022
- 2022-10-17 CN CN202211267803.4A patent/CN115760384A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108876133B (en) | Risk assessment processing method, device, server and medium based on business information | |
| US20230099864A1 (en) | User profiling based on transaction data associated with a user | |
| CN112837069B (en) | Block chain and big data based secure payment method and cloud platform system | |
| CN111192144A (en) | Financial data prediction method, device, equipment and storage medium | |
| CN110766275A (en) | Data verification method and device, computer equipment and storage medium | |
| CN112712429A (en) | Remittance service auditing method, remittance service auditing device, computer equipment and storage medium | |
| CN113095408A (en) | Risk determination method and device and server | |
| CN110688536A (en) | Label prediction method, device, equipment and storage medium | |
| CN109583731B (en) | Risk identification method, device and equipment | |
| CN111639690A (en) | Fraud analysis method, system, medium, and apparatus based on relational graph learning | |
| CN114186760A (en) | Analysis method and system for stable operation of enterprise and readable storage medium | |
| CN112950347A (en) | Resource data processing optimization method and device, storage medium and terminal | |
| CN115545886A (en) | Overdue risk identification method, overdue risk identification device, overdue risk identification equipment and storage medium | |
| CN112990989B (en) | Value prediction model input data generation method, device, equipment and medium | |
| CN113435900A (en) | Transaction risk determination method and device and server | |
| CN116757476A (en) | Method and device for constructing risk prediction model and method and device for risk prevention and control | |
| CN115345727B (en) | Method and device for identifying fraudulent loan application | |
| CN115795345A (en) | Information processing method, device, equipment and storage medium | |
| CN115760384A (en) | Abnormal behavior recognition method, abnormal behavior recognition device, electronic device, and storage medium | |
| CN114418743A (en) | Account information detection method, device, equipment, storage medium and program product | |
| CN113094595A (en) | Object recognition method, device, computer system and readable storage medium | |
| CN113052604A (en) | Object detection method, device, equipment and storage medium | |
| CN110570301A (en) | Risk identification method, device, equipment and medium | |
| CN112396513B (en) | Data processing method and device | |
| US20220261666A1 (en) | Leveraging big data, statistical computation and artificial intelligence to determine a likelihood of object renunciation prior to a resource event |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |