本申請案的實施例提供了一種商家風險防控方法及裝置，旨在藉由對商家風險防控相關的指標進行異常檢測，並每當檢測到指標資料存在異常的指標時，根據指標異常情況即時進行商家風險防控，實現商家風險確認前的風險提前識別，提高商家風險防控的時效性。
本申請案的實施例採用下述技術方案：
第一方面，本申請案的實施例提供一種商家風險防控方法，包括：
在檢測到商家的目標指標資料異常的情況下，確定所述目標指標資料對應的目標異常參數；
根據指標、類別和維度之間的對應關係，獲取所述目標指標資料對應的目標指標所屬的目標類別，及所述目標類別所屬的目標維度；
根據所述目標維度和所述目標類別，確定至少一個連動類別，所述至少一個連動類別下包括引起所述目標指標資料異常的指標；
根據所述目標異常參數和所述至少一個連動類別，進行商家風險防控。
可選的，本申請案的第一方面提供的商家風險防控方法，根據所述目標維度和所述目標類別，確定至少一個連動類別，包括：
獲取與所述目標維度關聯的至少一個連動維度；
在所述至少一個連動維度下，獲取與所述目標類別關聯的所述至少一個連動類別。
可選的，本申請案的第一方面提供的商家風險防控方法，根據所述目標異常參數和所述至少一個連動類別，進行商家風險防控，包括：
在所述至少一個連動類別下，獲取存在異常的指標資料對應的第一指標集合；
根據所述目標異常參數、所述至少一個連動類別和所述第一指標集合，進行商家風險防控。
可選的，本申請案的第一方面提供的商家風險防控方法，根據所述目標異常參數、所述至少一個連動類別和所述第一指標集合，進行商家風險防控，包括：
根據所述至少一個連動類別，確定造成所述目標指標資料出現異常的異常原因；
確定所述第一指標集合對應的第一參數集合，所述第一參數集合中各異常參數與所述第一指標集合中各指標的指標資料一一對應；
根據所述目標異常參數、所述第一指標集合和所述第一參數集合，確定第二指標集合和第二參數集合，所述第二參數集合中各異常參數與所述第二指標集合中各指標的指標資料一一對應；
根據所述異常原因、所述第二指標集合和所述第二參數集合，進行商家風險防控。
可選的，本申請案的第一方面提供的商家風險防控方法，根據所述至少一個連動類別，確定造成所述目標指標資料出現異常的異常原因，包括：
接收類別選擇指令；
在所述至少一個連動類別中，確定所述類別選擇指令對應的目標連動類別；
根據所述目標連動類別，確定所述異常原因。
可選的，本申請案的第一方面提供的商家風險防控方法，根據所述目標異常參數、所述第一指標集合和所述第一參數集合，確定第二指標集合和第二參數集合，包括：
確定所述目標異常參數與所述第一參數集合中的各異常參數間的差值；
在所述差值處於預設閾值範圍內的情況下，根據所述差值對應的異常參數構建所述第二參數集合；
根據所述第二參數集合中各異常參數對應的指標構建所述第二指標集合。
可選的，本申請案的第一方面提供的商家風險防控方法，根據所述異常原因、所述第二指標集合和所述第二參數集合，進行商家風險防控，包括：
在所述第二指標集合中，獲取風險防控指標，所述風險防控指標與所述異常原因相匹配；
在所述第二參數集合中，獲取風險防控參數，所述風險防控參數與所述風險防控指標一一對應；
根據所述風險防控指標和所述風險防控參數，進行商家風險防控。
可選的，本申請案的第一方面提供的商家風險防控方法，根據所述風險防控指標和所述風險防控參數，進行商家風險防控，包括：
在所述風險防控參數大於異常參數閾值的情況下，獲取與所述風險防控指標對應的風險防控策略；
根據所述風險防控策略進行商家風險防控。
可選的，本申請案的第一方面提供的商家風險防控方法，在進行商家風險防控前，所述方法還包括：
獲取歷史風險指標及對應的歷史異常參數。
可選的，本申請案的第一方面提供的商家風險防控方法，根據所述風險防控指標和所述風險防控參數，進行商家風險防控，包括：
在所述風險防控指標與所述歷史風險指標相比存在遺漏指標的情況下，根據第一訓練樣本，對初始模型進行訓練，得到第一商家風險識別模型；
部署所述第一商家風險識別模型以用於商家風險識別，並輸出風險識別結果；
獲取與所述風險識別結果對應的風險防控策略，以根據所述風險防控策略進行風險防控；
其中，所述遺漏指標包含在所述歷史風險指標中，所述第一訓練樣本包括所述風險防控指標、所述風險防控參數、所述遺漏指標及所述遺漏指標對應的遺漏異常參數。
可選的，本申請案的第一方面提供的商家風險防控方法，根據第一訓練樣本，對初始模型進行訓練，得到第一商家風險識別模型，包括：
根據所述風險防控參數和所述遺漏異常參數，確定風險識別閾值；
根據所述風險防控指標和所述遺漏指標，生成所述初始模型的輸入向量；
將所述輸入向量輸入所述初始模型，得到所述初始模型的輸出；
根據所述初始模型的輸出與所述風險識別閾值之間的差距，調整所述初始模型的參數；
重複以上步驟，直至所述差距滿足預設條件，得到所述第一商家風險識別模型。
可選的，本申請案的第一方面提供的商家風險防控方法，根據所述風險防控指標和所述風險防控參數，對所述商家進行風險防控，包括：
在所述風險防控指標與所述歷史風險指標相比不存在遺漏指標的情況下，根據所述第二訓練樣本，對初始模型進行訓練，得到第二商家風險識別模型；
部署所述第二商家風險識別模型以用於商家風險識別，並輸出風險識別結果；
獲取與所述風險識別結果對應的風險防控策略，以根據所述風險防控策略進行風險防控；
其中，所述遺漏指標包含在所述歷史風險指標中，所述第二訓練樣本包括所述第二風險防控指標和所述第二風險防控參數。
可選的，本申請案的第一方面提供的商家風險防控方法，根據所述第二訓練樣本，對初始模型進行訓練，得到第二商家風險識別模型，包括：
根據所述風險防控參數，確定風險識別閾值；
根據所述風險防控指標，生成所述初始模型的輸入向量；
將所述輸入向量輸入所述初始模型，得到所述初始模型的輸出；
根據所述初始模型的輸出與所述風險識別閾值之間的差距，調整所述初始模型的參數；
重複以上步驟，直至所述差距滿足預設條件，得到所述第二商家風險識別模型。
可選的，本申請案的第一方面提供的商家風險防控方法，所述方法還包括：
根據時序異常檢測模型，檢測所述商家的目標指標資料是否存在異常；
在檢測結果指示所述目標指標資料異常的情況下，確定所述目標指標資料存在異常。
可選的，本申請案的第一方面提供的商家風險防控方法，根據時序異常檢測模型，檢測所述商家的目標指標資料是否存在異常，包括：
確定所述目標指標資料在當前時段內對應的多個時序實測值；
根據時序預測值與所述多個時序實測值，計算得到與所述多個時序實測值對應的多個時序異常值；
在所述多個時序異常值的平均值大於或等於預設值的情況下，確定所述檢測結果指示所述目標指標資料異常；
在所述多個時序異常值的平均值小於所述預設值的情況下，確定所述檢測結果指示所述目標指標資料正常。
可選的，本申請案的第一方面提供的商家風險防控方法，確定所述時序異常值的步驟，包括：
確定所述時序實測值與所述時序預測值間的時序差值；
計算所述時序差值與所述時序預測值間的比值，得到所述時序異常值。
可選的，本申請案的第一方面提供的商家風險防控方法，所述方法包括以下至少一項：
所述維度包括地域維度、商家類型維度、支付介面維度中的至少一個；
所述類別包括商家註冊類別和商家運營類別中的至少一個。
可選的，本申請案的第一方面提供的商家風險防控方法，所述方法包括以下至少一項：
所述商家註冊類別中包括以下至少一項指標：商家性質、維護記錄、經營內容、所屬行業；
所述商家運營類別包括以下至少一項指標：交易金額、投訴次數、商品品質、服務品質和支付介面使用情況。
第二方面，本申請案的實施例還提供一種商家風險防控裝置，包括：
第一確定模組，用於在檢測到商家的目標指標資料異常的情況下，確定所述目標指標資料對應的目標異常參數；
獲取模組，用於根據指標、類別和維度之間的對應關係，獲取所述目標指標資料對應的目標指標所屬的目標類別，及所述目標類別所屬的目標維度；
第二確定模組，用於根據所述目標維度和所述目標類別，確定至少一個連動類別，所述至少一個連動類別下包括引起所述目標指標資料異常的指標；
處理模組，用於根據所述目標異常參數和所述至少一個連動類別，進行商家風險防控。
第三方面，本申請案的實施例還提供一種電子設備，包括：
處理器；以及
被安排成儲存電腦可執行指令的記憶體，所述可執行指令在被執行時使所述處理器執行以下操作：
在檢測到商家的目標指標資料異常的情況下，確定所述目標指標資料對應的目標異常參數；
根據指標、類別和維度之間的對應關係，獲取所述目標指標資料對應的目標指標所屬的目標類別，及所述目標類別所屬的目標維度；
根據所述目標維度和所述目標類別，確定至少一個連動類別，所述至少一個連動類別下包括引起所述目標指標資料異常的指標；
根據所述目標異常參數和所述至少一個連動類別，進行商家風險防控。
第四方面，本申請案的實施例還提供一種電腦可讀儲存媒介，其中，所述電腦可讀儲存媒介儲存一個或多個程式，所述一個或多個程式當被包括多個應用程式的電子設備執行時，使得所述電子設備執行以下操作：
在檢測到商家的目標指標資料異常的情況下，確定所述目標指標資料對應的目標異常參數；
根據指標、類別和維度之間的對應關係，獲取所述目標指標資料對應的目標指標所屬的目標類別，及所述目標類別所屬的目標維度；
根據所述目標維度和所述目標類別，確定至少一個連動類別，所述至少一個連動類別下包括引起所述目標指標資料異常的指標；
根據所述目標異常參數和所述至少一個連動類別，進行商家風險防控。
本申請案的實施例採用的上述至少一個技術方案能夠達到以下有益效果：
本申請案的實施例中，從不同的維度全面設置用於商家風險防控的指標，並將指標進行分類得到相應的類別，建立指標、類別和維度之間的對應關係，用以在檢測到指標資料存在異常的目標指標時，根據該對應關係，獲取引起目標指標資料異常的指標所屬的所有連動類別，進而根據獲取到的連動類別和表徵目標指標資料異常程度的目標異常參數進行商家風險防控。因此，藉由對商家風險防控相關的指標進行異常檢測，並每當檢測到指標資料存在異常的指標時，根據指標異常情況即時進行商家風險防控，實現商家風險確認前的風險提前識別，提高商家風險防控的時效性。The embodiment of this application provides a method and device for preventing and controlling merchant risk, which aims to detect abnormality of indicators related to merchant risk prevention and control, and whenever an abnormal indicator is detected in indicator data, according to the abnormality of the indicator Immediately carry out merchant risk prevention and control, realize the risk identification before the merchant risk confirmation, and improve the timeliness of merchant risk prevention and control.
The embodiments of this application adopt the following technical solutions:
In the first aspect, the embodiments of this application provide a method for preventing and controlling merchant risks, including:
In the case that the target index data of the merchant is detected to be abnormal, determine the target abnormal parameter corresponding to the target index data;
Obtaining the target category to which the target indicator corresponding to the target indicator data belongs and the target dimension to which the target category belongs according to the correspondence between indicators, categories and dimensions;
Determine at least one linkage category based on the target dimension and the target category, and the at least one linkage category includes an indicator that causes the target indicator data to be abnormal;
According to the target abnormal parameter and the at least one linkage category, perform merchant risk prevention and control.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application, determining at least one linkage category according to the target dimension and the target category, includes:
Acquiring at least one linkage dimension associated with the target dimension;
Under the at least one linkage dimension, obtain the at least one linkage category associated with the target category.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application, based on the target abnormal parameter and the at least one linkage category, performs merchant risk prevention and control, including:
Under the at least one linkage category, obtain a first index set corresponding to abnormal index data;
Perform merchant risk prevention and control according to the target abnormal parameter, the at least one linkage category, and the first indicator set.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application, based on the target abnormal parameter, the at least one linkage category, and the first indicator set, performs merchant risk prevention and control, including:
According to the at least one linkage category, determine the reason for the abnormality of the target indicator data;
Determining a first parameter set corresponding to the first indicator set, and each abnormal parameter in the first parameter set corresponds to the indicator data of each indicator in the first indicator set;
According to the target abnormal parameter, the first indicator set, and the first parameter set, a second indicator set and a second parameter set are determined, and each abnormal parameter in the second parameter set is compared with the second indicator set The index data of each index corresponds to each other;
According to the abnormal reason, the second index set and the second parameter set, risk prevention and control of the merchant is performed.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application, according to the at least one linkage category, determines the abnormal reason that causes the target indicator data to be abnormal, including:
Receive category selection instructions;
In the at least one linkage category, determine the target linkage category corresponding to the category selection instruction;
Determine the cause of the abnormality according to the target linkage category.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application determines a second index set and a second parameter set based on the target abnormal parameter, the first index set, and the first parameter set ,include:
Determine the difference between the target abnormal parameter and each abnormal parameter in the first parameter set;
When the difference is within a preset threshold range, construct the second parameter set according to the abnormal parameter corresponding to the difference;
The second index set is constructed according to the index corresponding to each abnormal parameter in the second parameter set.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application, based on the abnormal reason, the second indicator set, and the second parameter set, to perform merchant risk prevention and control includes:
Acquiring a risk prevention and control indicator in the second indicator set, and the risk prevention and control indicator matches the abnormal cause;
In the second parameter set, acquiring risk prevention and control parameters, where the risk prevention and control parameters correspond to the risk prevention and control indicators one to one;
According to the risk prevention and control index and the risk prevention and control parameter, perform merchant risk prevention and control.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application, based on the risk prevention and control index and the risk prevention and control parameter, performs merchant risk prevention and control, including:
In the case that the risk prevention and control parameter is greater than the abnormal parameter threshold, acquiring a risk prevention and control strategy corresponding to the risk prevention and control index;
Perform merchant risk prevention and control according to the risk prevention and control strategy.
Optionally, in the merchant risk prevention and control method provided in the first aspect of this application, before performing merchant risk prevention and control, the method further includes:
Obtain historical risk indicators and corresponding historical abnormal parameters.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application, based on the risk prevention and control index and the risk prevention and control parameter, performs merchant risk prevention and control, including:
In the case where there are missing indicators between the risk prevention and control indicators and the historical risk indicators, training the initial model according to the first training sample to obtain the first merchant risk identification model;
Deploying the first merchant risk identification model for merchant risk identification, and outputting the risk identification result;
Acquiring a risk prevention and control strategy corresponding to the risk identification result, so as to perform risk prevention and control according to the risk prevention and control strategy;
Wherein, the missing indicator is included in the historical risk indicator, and the first training sample includes the risk prevention and control indicator, the risk prevention and control parameter, the missing indicator, and the missing abnormal parameter corresponding to the missing indicator .
Optionally, the merchant risk prevention and control method provided in the first aspect of this application is to train the initial model according to the first training sample to obtain the first merchant risk identification model, including:
Determine a risk identification threshold according to the risk prevention and control parameter and the missing abnormal parameter;
Generating the input vector of the initial model according to the risk prevention and control index and the omission index;
Input the input vector into the initial model to obtain the output of the initial model;
Adjusting the parameters of the initial model according to the gap between the output of the initial model and the risk identification threshold;
The above steps are repeated until the gap meets the preset condition, and the first merchant risk identification model is obtained.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application, according to the risk prevention and control index and the risk prevention and control parameter, to perform risk prevention and control on the merchant includes:
In the case that there is no missing indicator in the risk prevention and control indicator compared with the historical risk indicator, training an initial model according to the second training sample to obtain a second merchant risk identification model;
Deploying the second merchant risk identification model for merchant risk identification, and outputting the risk identification result;
Acquiring a risk prevention and control strategy corresponding to the risk identification result, so as to perform risk prevention and control according to the risk prevention and control strategy;
Wherein, the missing indicator is included in the historical risk indicator, and the second training sample includes the second risk prevention and control indicator and the second risk prevention and control parameter.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application, according to the second training sample, trains the initial model to obtain the second merchant risk identification model, including:
Determine the risk identification threshold according to the risk prevention and control parameters;
Generating the input vector of the initial model according to the risk prevention and control index;
Input the input vector into the initial model to obtain the output of the initial model;
Adjusting the parameters of the initial model according to the gap between the output of the initial model and the risk identification threshold;
Repeat the above steps until the gap meets the preset condition, and the second merchant risk identification model is obtained.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application further includes:
According to the time sequence abnormality detection model, detect whether the target index data of the merchant is abnormal;
If the detection result indicates that the target index data is abnormal, it is determined that the target index data is abnormal.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application, according to a time sequence abnormality detection model, detects whether the merchant's target index data is abnormal, including:
Determine multiple time series actual measured values corresponding to the target indicator data in the current time period;
According to the time-series predicted value and the multiple time-series actual measured values, multiple time-series abnormal values corresponding to the multiple time-series measured values are calculated;
In a case where the average value of the multiple time series abnormal values is greater than or equal to a preset value, determining that the detection result indicates that the target index data is abnormal;
In a case where the average value of the multiple time series abnormal values is less than the preset value, it is determined that the detection result indicates that the target index data is normal.
Optionally, in the merchant risk prevention and control method provided in the first aspect of this application, the step of determining the sequence abnormal value includes:
Determining the time series difference between the time series actual value and the time series predicted value;
The ratio between the time series difference and the time series predicted value is calculated to obtain the time series abnormal value.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application, the method includes at least one of the following:
The dimensions include at least one of a geographic dimension, a merchant type dimension, and a payment interface dimension;
The category includes at least one of a merchant registration category and a merchant operation category.
Optionally, the merchant risk prevention and control method provided in the first aspect of this application, the method includes at least one of the following:
The business registration category includes at least one of the following indicators: business nature, maintenance records, business content, and industry;
The business operation category includes at least one of the following indicators: transaction amount, number of complaints, product quality, service quality, and payment interface usage.
In the second aspect, the embodiment of this application also provides a merchant risk prevention and control device, including:
The first determining module is used to determine the target abnormal parameter corresponding to the target index data when the target index data of the merchant is detected to be abnormal;
The obtaining module is used to obtain the target category to which the target indicator corresponding to the target indicator data belongs and the target dimension to which the target category belongs according to the correspondence between the indicators, categories and dimensions;
The second determination module is configured to determine at least one linkage category according to the target dimension and the target category, and the at least one linkage category includes an indicator that causes the target indicator data to be abnormal;
The processing module is configured to perform merchant risk prevention and control according to the target abnormal parameter and the at least one linkage category.
In the third aspect, the embodiments of the present application also provide an electronic device, including:
Processor; and
A memory arranged to store computer-executable instructions, which when executed, cause the processor to perform the following operations:
In the case that the target index data of the merchant is detected to be abnormal, determine the target abnormal parameter corresponding to the target index data;
Obtaining the target category to which the target indicator corresponding to the target indicator data belongs and the target dimension to which the target category belongs according to the correspondence between indicators, categories and dimensions;
Determine at least one linkage category based on the target dimension and the target category, and the at least one linkage category includes an indicator that causes the target indicator data to be abnormal;
According to the target abnormal parameter and the at least one linkage category, perform merchant risk prevention and control.
In a fourth aspect, an embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs include multiple application programs. When the electronic device is executed, the electronic device is caused to perform the following operations:
In the case that the target index data of the merchant is detected to be abnormal, determine the target abnormal parameter corresponding to the target index data;
Obtaining the target category to which the target indicator corresponding to the target indicator data belongs and the target dimension to which the target category belongs according to the correspondence between indicators, categories and dimensions;
Determine at least one linkage category based on the target dimension and the target category, and the at least one linkage category includes an indicator that causes the target indicator data to be abnormal;
According to the target abnormal parameter and the at least one linkage category, perform merchant risk prevention and control.
The above at least one technical solution adopted by the embodiment of the application can achieve the following beneficial effects:
In the embodiment of this application, indicators for risk prevention and control of merchants are comprehensively set from different dimensions, and the indicators are classified to obtain corresponding categories, and the corresponding relationship between indicators, categories and dimensions is established to detect When there is an abnormal target indicator in the indicator data, according to the corresponding relationship, all the linkage categories to which the indicator causing the target indicator data is abnormal are obtained, and then the merchant risk prevention is carried out according to the obtained linkage category and the target anomaly parameter that characterizes the abnormality of the target indicator data. control. Therefore, by detecting the abnormality of the indicators related to the risk prevention and control of the merchant, and whenever an abnormal indicator is detected in the indicator data, the risk prevention and control of the merchant is carried out in real time according to the abnormality of the indicator, so as to realize the risk identification before the merchant risk is confirmed. Improve the timeliness of business risk prevention and control.
為使本申請案的目的、技術方案和優點更加清楚，下面將結合本申請案的具體實施例及相應的附圖對本申請案技術方案進行清楚、完整地描述。顯然，所描述的實施例僅是本申請案一部分實施例，而不是全部的實施例。根據本申請案中的實施例，本領域普通技術人員在沒有做出創造性勞動前提下所獲得的所有其他實施例，都屬於本申請案保護的範圍。
隨著行動支付方式的普及，人們越來越習慣於使用第三方支付平台進行便捷的行動支付。而對於行動支付而言，選擇使用第三方支付平台的用戶和商家是最重要的兩個主體，且這兩個群體相互之間存在著積極的影響：越多的商家提供可以使用第三方支付平台進行行動支付的場景和服務，會積極帶動更多的用戶使用該第三方支付平台，反之，用戶數量級的不斷增長，同樣也會帶動商家數量級的不斷增長。
然而，隨著商家數量的不斷增長，問題商家的占比也會有所增長，當問題商家進行欺詐、賭博、套現及其他違規違禁行為時，會帶來相應的風險，嚴重時可能會對用戶的利益、商家的正常營運造成危害。因此，如何及時有效地對數以萬計的商家進行風險識別和防控成為亟待解決的問題。而且，考慮到商家風險往往涉及的資金數量級大，容易引起輿情和監管部門的注意，因此，商家風險防控的及時性顯得尤為重要。
為了實現對商家風險的有效防控，可以採用以下所述的防控方案：
(1)根據商家策略的防控方案，需要策略營運人員通過人工審理及分析案件的方式提取風險特徵，然後根據提取的風險特徵配置線上防控策略，以在商家的事前准入、事中交易和事後管控環節進行層層防控。
(2)根據風險檢測模型的防控方案，需要針對特定的商家風險，比如欺詐、賭博、套現等違規違禁行為引發的商家風險，分析設計相應的風險特徵，然後根據風險特徵建立風險檢測模型，進而可以根據該風險檢測模型輸出的風險值，結合相應的防控策略進行風險防控。
(3)根據用戶投訴的防控方案，實施該防控方案時，主要是對有用戶投訴的商家進行審理定性，核定風險後對相應的風險商家進行處罰，同時一併處罰與該風險商家相關的其他商家。
然而，上述幾種商家風險防控方案一般存在以下缺陷：
(1)在根據商家策略的防控方案中，不僅需要花費較多的人力審理及分析案件以進行風險特徵的提取，而且審理及分析的案件一般是針對已經發生的風險，如此，在有新型風險出現的情況下，需要重新審理及分析案件和提取風險特徵以重新配置防控策略，很明顯會降低風險防控的時效性，另外，新策略的防控效果很多時候需要在策略上線後才能進行評價。
(2)在根據風險檢測模型的防控方案中，建立風險檢測模型時，需要利用歷史資料中的黑白樣本，確定輸入風險檢測模型中的變數，然後訓練上線模型，建模週期比較長，而且，當風險檢測模型上線後，其對於歷史上沒有出現過的商家風險的識別能力有限，會出現模型檢測能力衰退的情況，為此需要定期重新訓練模型，顯然會影響風險防控的時效性。
(3)在根據用戶投訴的防控方案中，由於該方案屬於事後防控，所以不僅需要商家風險已經發生，並且要求在該商家風險傷害了使用者利益的情況下，有使用者主動進行投訴，進而根據用戶投訴對商家風險定性之後，才能對該類商家風險進行相應的管控，時效性不好。
因此，在實際應用場景中，以上幾種防控方案的風險防控結果往往無法滿足商家風險防控的實際需求，影響用戶體驗。
有鑒於此，本申請案的實施例提供了一種商家風險防控方案，能夠對商家風險進行提前識別，實現商家風險的動態防控，能夠提高商家風險防控的時效性，且具有較強的風險動態對抗能力，適用於不同類型的商家風險，通用性好。
以下結合附圖，詳細說明本申請案的各實施例提供的技術方案。
參見圖1所示，本申請案的實施例提供一種商家風險防控方法，該方法可包括以下步驟：
S101：在檢測到商家的目標指標資料異常的情況下，確定目標指標資料對應的目標異常參數。
S103：根據指標、類別和維度之間的對應關係，獲取目標指標資料對應的目標指標所屬的目標類別，及目標類別所屬的目標維度。
可以理解的是，在本申請案的實施例中，需要對商家的目標指標資料進行異常檢測，並在檢測到目標指標資料存在異常時，一方面需要根據預先建立的指標、類別和維度之間的對應關係，查找獲取該存在異常的目標指標資料對應的目標指標所屬的目標類別以及該目標類別所屬的目標維度，另一方面需要確定該目標指標資料對應的目標異常參數。
可選的，可以藉由以下實施例實現對商家的目標指標資料的異常檢測並確定目標異常參數：
根據時序異常檢測模型，檢測商家的目標指標資料是否存在異常。
可選的，時序異常檢測模型包括ARIMA模型(Autoregressive Integrated Moving Average Model，自回歸積分滑動平均模型)、HOLT-WINTERS模型(指數平滑模型)和LSTM(Long Short-Term Memory，長短期記憶網路)模型中的一個，當然也可以採用其他能夠實現異常檢測的模型。
可選的，根據時序異常檢測模型，檢測商家的目標指標資料是否存在異常的步驟可以包括：
確定目標指標資料在當前時段內對應的多個時序實測值；
根據時序預測值與多個時序實測值，計算得到與多個時序實測值對應的多個時序異常值；
在多個時序異常值的平均值大於或等於預設值的情況下，確定檢測結果指示目標指標資料異常；
在多個時序異常值的平均值小於預設值的情況下，確定檢測結果指示目標指標資料正常。
可選的，確定時序異常值的步驟，可以包括：
確定時序實測值與時序預測值間的時序差值；
計算時序差值與時序預測值間的比值，得到時序異常值。
可選的，目標指標資料可以反映作為參變數的目標指標的取值情況，目標異常參數可以反映目標指標資料存在異常時的異常程度，優選的，目標指標資料對應的目標異常參數可以為多個時序異常值的平均值。
其中，時序實測值可以反映目標指標資料在當前時段的一個檢測時間點上對應的實際檢測值，時序預測值可以反映目標指標資料按正常走向在該檢測時間點上的預估值，而時序實測值與時序預測值間的時序差值可以反映目標指標資料在該檢測時間點上，實際測量值與正常的預估值之間的差距，藉由該時序差值則可以衡量目標指標資料在該檢測時刻點的檢測值是否異動。
可以理解的是，上述當前時段和預設值的取值可以根據進行異常檢測的商家和目標指標的實際情況確定的經驗值；譬如，可以在連續3天內檢測到的多個時序異常值的平均值大於或等於預設值時，確定檢測結果指示目標指標資料異常。
再者，在檢測結果指示目標指標資料異常的情況下，確定目標指標資料存在異常。
可選的，在建立指標、類別和維度之間的對應關係時，可以從不同的維度全面設置用於商家風險防控的指標，並將指標進行分類得到相應的類別，其中，在設置指標的維度時，可以考慮從粗到細和/或從上級到下級等角度進行多層級的設置，以使指標的設計的覆蓋範圍更加全面、更加具體。
其中，維度可以包括地域維度、商家類型維度、支付介面維度中的至少一個。
例如，地域維度從粗到細可以包括自治區、省份、城市、旗縣和街道等。又例如，商家類型維度從上級到下級可以包括：服務商、業務拓展專員、線下商家、商家交易等。還例如，支付介面維度可以包括是否簽約第三方支付介面、第三方支付介面是否為支付寶等。
可以理解的是，在本申請案的實施例中，考慮到在商家分佈於不同地域的情況下，其經營等方面可能會受一定地域特性的影響，以及不同類型的商家各自的經營等方面也會有所區別，而採用的支付介面不同，其資金流轉許可權、操作流程等方面也會有所區別，則可能引起的商家風險也會存在區別，因此，可以通過設置不同的維度對商家進行異常檢測，以實現更加全面的商家風險監控。
另外，維度下的類別可以包括商家註冊類別和商家運營類別中的至少一個。
可選的，商家註冊類別可以包括以下至少一項指標：商家性質、維護記錄、經營內容、所屬行業；商家運營類別可以包括以下至少一項指標：交易金額、投訴次數、商品品質、服務品質和支付介面使用情況。
其中，商家性質可以包括個人商家和企業商家；維度記錄包括業務拓展專員(BD，Business Development)對商家進行定期維度的記錄，維護的內容可以包括監控商家繳稅、監控商家經營許可證是否到期、到期是否更新，監控商家是否及時處理客戶投訴等，BD每次維度商家後對應生成相應的維護記錄；經營內容可以指商家註冊時填寫的商家經營的商品，比如，水果店的經營內容可以是水果，蔬菜店的經營內容可以是蔬菜；商家所屬的行業可以指商家註冊時填寫的行業，也可以指根據商家的經營內容推導出的行業；交易金額可以包括商家在設定時長內的交易總金額；投訴次數可以包括商家最近週期內的投訴次數；支付介面使用情況可以包括商家的第三方支付介面是否被其他商家使用、第三方支付介面完成交易的地理位置資訊。
當然，用於對商家進行風險防控的維度、類別、指標等的設置不限於上述內容，可以根據具體的、實際的防控需求進行相應調整。
在本申請案的實施例中，可以通過對指定維度的指定類別下的特定指標進行異常檢測，實現對商家風險防控過程中時序上發生異動的目標指標資料進行捕捉；也可以對預先設計的所有指標進行異常檢測，實現對商家風險防控過程中時序上發生異動的目標指標資料進行捕捉。其中，異常檢測的過程可以使週期性進行的，也可以是不間斷持續進行的，以及在進行週期性異常檢測的情況下，對不同指標的輪詢週期，可以相同，也可以不同。
S105：根據目標維度和目標類別，確定至少一個連動類別，至少一個連動類別下包括引起目標指標資料異常的指標。
可以理解的是，在根據檢測到存在異常的目標指標鎖定對應的目標維度和目標類別後，進一步根據目標維度和目標類別進行至少一個連動類別的獲取，該至少一個連動類別下包括能夠引起目標指標資料異常的指標，從而更加全面地找出相關的異常指標。
可選的，根據目標維度和目標類別，確定至少一個連動類別的步驟可以包括：
獲取與目標維度關聯的至少一個連動維度；
在至少一個連動維度下，獲取與目標類別關聯的至少一個連動類別。
可以理解的是，在本申請實施例中，可以維度與維度、類別與類別間的關聯關係進行至少一個連動類別的上卷、下探式查找，以更加全面地查找出相關的異常指標，可選的，維度與維度、類別與類別間的關聯關係可以記載在指標、類別和維度之間的對應關係中進行維護，也可以單獨建立並維護維度與維度、類別與類別間的關聯關係。
能夠理解的是，連動維度可以指與存在異常的目標指標資料對應的目標指標所屬的目標維度存在關聯關係的維度，連動類別可以指與存在異常的目標指標資料對應的目標指標所屬的目標類別存在關聯關係的類別，各連動類別從屬於相應的連動維度，以及各連動類別下的所有指標中存在能夠引起目標指標資料異常的指標，換言之，各連動類別下的各指標對應的各指標資料中存在能夠引起目標指標資料異常的指標資料。
在確定目標指標資料對應的目標異常參數和獲取到至少一個連動類別後，則可以據此進行商家風險防控，即執行如下步驟：
S107：根據目標異常參數和至少一個連動類別，進行商家風險防控。
可選的，該步驟S107可以包括：
在至少一個連動類別下，獲取存在異常的指標資料對應的第一指標集合；
根據目標異常參數、至少一個連動類別和第一指標集合，進行商家風險防控。
可以理解的是，根據與目標指標關聯的至少一個連動類別，可以對該至少一個連動類別下的指標對應的指標資料進行異常檢測，可選的，可以對指定時間段內的指標資料進行異常檢測，以提高與存在異常的目標指標資料間的關聯程度，提高第一指標集合中指標獲取的準確性和可靠性，以及可以採用上述檢測目標指標資料是否存在異常的檢測方案類似的方案對至少一個連動類別下的指標資料進行異常檢測，也就是說，根據時序異常檢測模型檢測至少一個連動類別下的指標對應的指標資料是否存在異常，並在檢測結果指示異常時，確定至少一個連動類別下的指標對應的指標資料存在異常，進而可以將存在異常的至少一個指標資料對應的至少一個指標形成第一指標集合，以與目標異常參數、至少一個連動類別一同用於商家風險防控。
可選的，根據目標異常參數、至少一個連動類別和第一指標集合，進行商家風險防控，可以具體包括以下步驟：
根據至少一個連動類別，確定造成目標指標資料出現異常的異常原因。
可以理解的是，在本申請案的實施例中，可以根據至少一個連動類別確定導致目標指標資料出現異常的原因，可選的，根據用戶的選擇將至少一個連動類別中用戶較為關注的連動類別確定為異常原因，可以包括以下步驟：
接收類別選擇指令；
在至少一個連動類別中，確定類別選擇指令對應的目標連動類別；
根據目標連動類別，確定異常原因。
當然，除了根據用戶的選擇外，還可以藉由其他方式根據至少一個連動類別確定異常原因，比如設置類別篩選規則，以根據該類別篩選規則自動在至少一個連動類別中篩選出符合規則要求的類別形成異常原因，等等。
進一步地，確定第一指標集合對應的第一參數集合，第一參數集合中各異常參數與第一指標集合中各指標的指標資料一一對應。
可以理解的是，對於至少一個連動類別下指標資料存在異常的指標，相應地能夠確定各指標資料的異常參數，因而能夠得到與第一指標集合對應的第一參數集合，其中，各異常參數的確定可以參照上述確定目標異常參數的實施例執行，在此不再贅述。
進一步地，根據目標異常參數、第一指標集合和第一參數集合，確定第二指標集合和第二參數集合，第二參數集合中各異常參數與第二指標集合中各指標的指標資料一一對應。
在本申請實施例中，可以根據目標異常參數將第一指標集合和第一參數集合轉換為第二指標集合和第二參數集合，以實現對商家風險防控的力度的合理控制，其中，第二指標集合包括第一指標集合中的至少一個指標，第二參數集合包括第一參數集合中的至少一個異常參數。
可選的，確定第二指標集合和第二參數集合的過程可以包括以下步驟：
確定目標異常參數與第一參數集合中的各異常參數間的差值；
在差值處於預設閾值範圍內的情況下，根據差值對應的異常參數構建第二參數集合；
根據第二參數集合中各異常參數對應的指標構建第二指標集合。
在該實施例中，可以將第一參數集合中指示的異常程度在目標指標資料對應的異常程度(即目標異常參數)以上的異常參數劃入第二參數集合，也就是當第一參數集合中的異常參數與目標異常參數的差距在一定指定的範圍內時，將該異常參數劃入第二參數集合，繼而將第二參數集合中各異常參數對應的第一指標集合中的指標劃歸為第二指標集合。
進一步則可以執行根據異常原因、第二指標集合和第二參數集合，進行商家風險防控的步驟，可選的，可以包括：
在第二指標集合中，獲取風險防控指標，風險防控指標與異常原因相匹配；
在第二參數集合中，獲取風險防控參數，風險防控參數與風險防控指標一一對應；
根據風險防控指標和風險防控參數，進行商家風險防控。
可以理解的是，在根據指標資料存在異常的指標所屬類別(即至少一個連動類別)的分佈情況確定異常原因後，可以在第二指標集合中獲取與該異常原因匹配的風險防控指標，以及在第二參數集合中獲取與該異常原因匹配的前述風險防控指標對應的風險防控參數，以進行更加合理的商家風險防控。
上述根據風險防控指標和風險防控參數，進行商家風險防控可以藉由以下具體實施例實現：
在具體實施例一中，進行商家風險防控的方案可以包括：
在風險防控參數大於異常參數閾值的情況下，獲取與風險防控指標對應的風險防控策略；
根據風險防控策略進行商家風險防控。
可以理解的是，當根據第二參數集合中的異常參數和異常原因得到的風險防控參數的值大於異常參數閾值時，說明指標的異常程度已經足夠大，此時，可以採用直接部署相應風險防控策略的方式及時進行商家風險防控，即在及時檢測到指標異常情況的同時，提高商家風險防控的時效性。
可選的，風險防控策略包括對商家進行罰款、返還欺詐所得利益、責令停業整頓、責令完善運營資質等等，以禁止商家進行任何導致風險的行為。
在具體實施例二中，可以藉由進行商家風險識別模型訓練的方式，以根據最新的指標異常情況更新商家風險識別模型，在及時檢測到指標異常情況的同時，提高商家風險防控的時效性。
可選的，在進行商家風險防控前，在本申請案的實施例中，還需要執行獲取歷史風險指標及對應的歷史異常參數的步驟，進而將歷史風險指標與當前的風險防控指標進行比對，以根據不同的比對結果執行相應的商家風險防控方案，避免出現漏掉歷史風險的情況，以實現覆蓋範圍更加全面的商家風險防控。
可選的，根據風險防控指標和風險防控參數，進行商家風險防控的方案可以包括以下兩個方面：
第一方面，在風險防控指標與歷史風險指標相比存在遺漏指標的情況下，根據第一訓練樣本，對初始模型進行訓練，得到第一商家風險識別模型；
其中，遺漏指標包含在歷史風險指標中，第一訓練樣本包括風險防控指標、風險防控參數、遺漏指標及遺漏指標對應的遺漏異常參數。
可以理解的是，在根據當前的指標異常情況確定的風險防控指標相較於歷史風險指標，存在待防控的指標覆蓋範圍不全的情況時，為了商家風險識別的時效性，即涵蓋可能出現的新風險，也確保在風險識別時不會漏掉已經確認的歷史風險指標，則可以考慮根據最新的風險防控指標及其對應風險防控參數、遺漏指標及其對應的遺漏異常參數作為第一商家風險識別模型的訓練樣本，以使根據此訓練出的最新的第一商家風險識別模型能夠識別歷史的和最新的商家風險，時效性好。
可選的，上述初始模型可以為採用孤立森林iForest演算法或符號回歸(Symbolic Regression)演算法構建的未經訓練的原始模型，也可以為根據歷史風險指標等資料訓練好的正在使用的商家風險識別模型。
可選的，根據第一訓練樣本，對初始模型進行訓練得到第一商家風險識別模型的過程，可以包括：
根據風險防控參數和遺漏異常參數，確定風險識別閾值；
根據風險防控指標和遺漏指標，生成初始模型的輸入向量；
將輸入向量輸入初始模型，得到初始模型的輸出；
根據初始模型的輸出與風險識別閾值之間的差距，調整初始模型的參數；
重複以上步驟，直至差距滿足預設條件，得到第一商家風險識別模型。
可以理解的是，考慮到風險防控參數和遺漏異常參數反映相應的指標資料的異常程度，則可以根據此確定風險識別閾值，以使風險識別標準可靠而準確。
進一步地，部署第一商家風險識別模型以用於商家風險識別，並輸出風險識別結果；
獲取與風險識別結果對應的風險防控策略，以根據風險防控策略進行風險防控。
可以理解的是，在當前的風險防控指標與歷史風險指標相比存在遺漏指標的情況下，進行商家風險識別模型訓練時，需要將遺漏的部分歷史指標及其對應的異常參數考慮在內。
需要說明的是，根據上述訓練樣本，可以確定模型訓練時的訓練集和驗證集。可選的，訓練集和驗證集的樣本數量可以靈活調配，例如，70%的訓練樣本作為訓練集，用於訓練商家風險識別模型，而剩餘30%的訓練樣本作為驗證集，驗證商家風險識別模型的輸出是否滿足要求，以實現模型效果評估。可選的，風險防控策略包括對商家進行罰款、返還欺詐所得利益、責令停業整頓、責令完善運營資質等等，以禁止商家進行任何導致風險的行為。
第二方面，在風險防控指標與歷史風險指標相比不存在遺漏指標的情況下，根據第二訓練樣本，對初始模型進行訓練，得到第二商家風險識別模型；
其中，遺漏指標包含在歷史風險指標中，第二訓練樣本包括第二風險防控指標和第二風險防控參數。
可以理解的是，在根據當前的指標異常情況確定的風險防控指標相較於歷史風險指標，不存在待防控的指標覆蓋範圍不全的情況時，可以考慮根據最新的且全面的風險防控指標及其對應風險防控參數作為第二商家風險識別模型的訓練樣本，以使根據此訓練出的最新的第二商家風險識別模型能夠識別歷史的和最新的商家風險，時效性好。
可選的，上述初始模型可以為採用孤立森林iForest演算法或符號回歸(Symbolic Regression)演算法構建的未經訓練的原始模型，也可以是根據歷史風險指標等資料訓練好的正在使用的商家風險識別模型。
可選的，根據第二訓練樣本，對初始模型進行訓練得到第二商家風險識別模型的過程，可以包括：
根據風險防控參數，確定風險識別閾值；
根據風險防控指標，生成初始模型的輸入向量；
將輸入向量輸入初始模型，得到初始模型的輸出；
根據初始模型的輸出與風險識別閾值之間的差距，調整初始模型的參數；
重複以上步驟，直至差距滿足預設條件，得到第二商家風險識別模型。
需要說明的是，根據上述第二訓練樣本，可以確定模型訓練時的訓練集和驗證集。可選的，訓練集和驗證集的樣本數量可以靈活調配，例如，70%的訓練樣本作為訓練集，用於訓練第二商家風險識別模型，而剩餘30%的訓練樣本作為驗證集，驗證第二商家風險識別模型的輸出是否滿足要求，以實現模型效果評估。
進一步地，部署第二商家風險識別模型以用於商家風險識別，並輸出風險識別結果；
獲取與風險識別結果對應的風險防控策略，以根據風險防控策略進行風險防控。
可以理解的是，在當前的風險防控指標與歷史風險指標相比不存在遺漏指標的情況下，進行商家風險識別模型訓練時，可以直接根據風險防控指標及其對應的風險防控參數執行。
可選的，風險防控策略包括對商家進行罰款、返還欺詐所得利益、責令停業整頓、責令完善運營資質等等，以禁止商家進行任何導致風險的行為。
綜上，在本申請案的實施例中，從不同的維度全面設置用於商家風險防控的指標，並將指標進行分類得到相應的類別，建立指標、類別和維度之間的對應關係，以在檢測到指標資料存在異常的目標指標時，根據該對應關係，獲取引起目標指標資料異常的指標所屬的所有連動類別，進而根據獲取到的連動類別和表徵目標指標資料異常程度的目標異常參數進行商家風險防控。因此，通過對商家風險防控相關的指標進行異常檢測，並每當檢測到指標資料存在異常的指標時，根據指標異常情況及時進行商家風險防控，實現商家風險確認前的風險提前識別，提高商家風險防控的時效性。
本申請實施例所述的商家風險防控方法，還可以通過如圖2所示的資訊流進行展示。
(1)異動感知(即異常檢測)，即監控哪裡出現異動。
可以藉由合理的維度劃分和指標設計，比如根據簽約資訊、商家類型、支付機構等劃分維度，以及在商家開戶、交易、運營等環節分別設計指標，並進行指標分類，並隨著時間推移，檢測各個維度或特定維度上指標的時序變化，根據檢測到的時序實際值與時序預測值之間的差值來判斷指標是否出現異動，如果出現異動，則輸出目標異動指標所屬的目標異動類別、目標異動維度及目標異動指標對應的目標異動程度(即目標異常參數)。
其中，可以藉由如下方式計算指標的異動程度：
異動程度=(時序實際值-時序預測值)/時序預測值。
(2)異動下探與上卷，即尋找異動原因與相關的異動指標。
根據上述輸出的目標異動類別、目標異動維度進行下探和/或上卷關聯類別、關聯維度下的明細指標資料，根據上述輸出的目標異動程度，確定合適的防控力度，異動程度越大需要的防控措施越嚴格，以對關聯類別、關聯維度下的明細指標資料進行篩選，找出所有相關的異動指標，並根據與上述相同的方式得到指標的異常程度，同時，根據各異動指標所屬類別的分佈情況可以確定異動原因(即異常原因)，以輸出異動原因、與該異動原因匹配的異動指標列表及對應的指標異動程度。
可選的，在輸出指標列表及對應的異動程度時，可以考慮已識別出的歷史風險指標及其異動程度，以避免漏過風險。
(3)異動回應
根據上述輸出的異動指標列表及對應的指標異動程度，以及採用孤立森林iForest演算法、符號回歸演算法等快速建立模型，並在上述異動明細資料基礎上進行模型評估，得到模型的預估效果，輸出風險識別模型，並推薦風險防控策略。
(4)風險防控
將上述風險識別模型輸出到風險防控平台進行模型部署，實現對模型真實結果的評估，並可以結合結果匹配風險防控策略，以快速防控新風險。
舉例來說，以城市維度為主維度對商家進行異動感知或異常檢測，當感知到城市A的指標B對應的資料上漲異常，與正常的時序預測值相比連續多天出現異動，且平均異動程度達到一定值時，輸出該指標B所屬的指標類別C，指標B的資料對應的平均異動程度以及城市維度A。
進一步地，根據指標、類別和維度之間預先建立的關係，查找確定與城市維度A關聯的其他城市維度、旗縣維度、城鎮維度等，比如在城市A被異動感知到商家在地域存在連鎖機構、分支機搆或服務商等等，以及查找確定與類別C關聯的其他類別，比如在其他地域下該商家對應的相應類別等等，則可以藉由對確定的各類別下指標的指標資料進行異動感知挖掘，找出所有相關異動指標，並根據確定的類別即相關異動指標的分佈情況分析確定異動原因，進而依據與異動原因匹配的指標及對應的異動程度等進行模型訓練組建、模型評估以及防控策略推薦等，實現商家風險防控。
從整個過程來看，藉由異動感知可以快速及時的發掘異常，並且藉由異動下探與上卷的方式能夠快速定位原因，輸出有效的異動指標，進行模型訓練和風險防控，保證了防控的時效性，另外風險的轉移會引起其他指標的異動，可以動態捕捉風險，增強了動態對抗性，可見整個系統不關注具體風險，只關注異動，任何形勢的風險只要引起異動就能被及時檢測和防控，具體很好的通用性。
可見，本申請案的實施例的商家風險防控方法具有以下優點：
(1)時效性更好：根據即時風險指標計算和監控可以更加及時地發現和定位風險；
(2)動態對抗性更強：商家風險的轉移和變異都可以被及時發現，並且可以進行策略和模型的快速組裝，完成新風險的防控；
(3)通用性更好：該發明不針對任何商家具象風險，通過全面的指標設計，可以檢測不同風險帶來的商家異常。
參見圖3所示，本申請案的實施例還提供了一種商家風險防控裝置，該裝置可包括：
第一確定模組301，用於在檢測到商家的目標指標資料異常的情況下，確定目標指標資料對應的目標異常參數；
獲取模組303，用於根據指標、類別和維度之間的對應關係，獲取目標指標資料對應的目標指標所屬的目標類別，及目標類別所屬的目標維度；
第二確定模組305，用於根據目標維度和目標類別，確定至少一個連動類別，至少一個連動類別下包括引起目標指標資料異常的指標；
處理模組307，用於根據目標異常參數和至少一個連動類別，進行商家風險防控。
能夠理解的是，圖3給出的商家風險防控裝置能夠實現圖1中所述的商家風險防控方法的各個步驟，前述實施例中關於商家風險防控方法的相關闡述均適用於商家風險防控裝置，此處不再贅述。
圖4是本申請的一個實施例電子設備的結構示意圖。請參考圖4，在硬體層面，該電子設備包括處理器，可選地還包括內部匯流排、網路介面、記憶體。其中，記憶體可能包含記憶體，例如高速隨機存取記憶體(Random-Access Memory，RAM)，也可能還包括非揮發性記憶體(non-volatile memory)，例如至少1個磁碟記憶體等。當然，該電子設備還可能包括其他業務所需要的硬體。
處理器、網路介面和記憶體可以透過內部匯流排相互連接，該內部匯流排可以是ISA(Industry Standard Architecture，工業標準架構)匯流排、PCI(Peripheral Component Interconnect，周邊部件互連標準)匯流排或EISA(Extended Industry Standard Architecture，延伸工業標準架構)匯流排等。所述匯流排可以分為位址匯流排、資料匯流排、控制匯流排等。為便於表示，圖4中僅用一個雙向箭頭表示，但並不表示僅有一根匯流排或一種類型的匯流排。
記憶體，用於存放程式。具體地，程式可以包括程式碼，所述程式碼包括電腦操作指令。記憶體可以包括記憶體和非揮發性記憶體，並向處理器提供指令和資料。
處理器從非揮發性記憶體中讀取對應的電腦程式到記憶體中然後運行，在邏輯層面上形成商家風險防控裝置。處理器，執行記憶體所存放的程式，並具體用於執行以下操作：
在檢測到商家的目標指標資料異常的情況下，確定目標指標資料對應的目標異常參數；
根據指標、類別和維度之間的對應關係，獲取目標指標資料對應的目標指標所屬的目標類別，及目標類別所屬的目標維度；
根據目標維度和目標類別，確定至少一個連動類別，至少一個連動類別下包括引起目標指標資料異常的指標；
根據目標異常參數和至少一個連動類別，進行商家風險防控。
上述如本申請前述對應實施例揭示的商家風險防控裝置執行的方法可以應用於處理器中，或者由處理器實現。處理器可能是一種積體電路晶片，具有訊號的處理能力。在實現過程中，上述方法的各步驟可以藉由處理器中的硬體的積體邏輯電路或者軟體形式的指令完成。上述的處理器可以是通用處理器，包括中央處理器(Central Processing Unit，CPU)、網路處理器(Network Processor，NP)等；還可以是數位訊號處理器(Digital Signal Processor，DSP)、專用積體電路(Application Specific Integrated Circuit，ASIC)、現場可程式閘陣列(Field-Programmable Gate Array，FPGA)或者其他可程式設計邏輯元件、分立門或者電晶體邏輯元件、分立硬體元件。可以實現或者執行本申請案的實施例中的公開的各方法、步驟及邏輯方塊圖。通用處理器可以是微處理器或者該處理器也可以是任何常規的處理器等。結合本申請實施例所公開的方法的步驟可以直接體現為硬體解碼處理器執行完成，或者用解碼處理器中的硬體及軟體模組組合執行完成。軟體模組可以位於隨機記憶體，快閃記憶體、唯讀記憶體，可程式唯讀記憶體或者電可讀寫可程式記憶體、暫存器等本領域成熟的儲存媒介中。該儲存媒介位於記憶體，處理器讀取記憶體中的資訊，結合其硬體完成上述方法的步驟。
該電子設備還可執行前述對應商家風險防控裝置執行的方法，並實現商家風險防控裝置在前述對應實施例中的功能，本申請案的實施例在此不再贅述。
本申請案的實施例還提出了一種電腦可讀儲存媒介，該電腦可讀儲存媒介儲存一個或多個程式，該一個或多個程式包括指令，該指令當被包括多個應用程式的電子設備執行時，能夠使該電子設備執行圖1所示實施例中商家風險防控裝置執行的方法，並具體用於執行：
在檢測到商家的目標指標資料異常的情況下，確定目標指標資料對應的目標異常參數；
根據指標、類別和維度之間的對應關係，獲取目標指標資料對應的目標指標所屬的目標類別，及目標類別所屬的目標維度；
根據目標維度和目標類別，確定至少一個連動類別，至少一個連動類別下包括引起目標指標資料異常的指標；
根據目標異常參數和至少一個連動類別，進行商家風險防控。
本領域內的技術人員應明白的是，本發明的實施例可提供為方法、系統、或電腦程式產品。因此，本發明可採用完全硬體實施例、完全軟體實施例、或結合軟體和硬體方面的實施例的形式。而且，本發明可採用在一個或多個其中包含有電腦可用程式碼的電腦可用儲存媒介(包括但不限於磁碟記憶體、CD-ROM、光學記憶體等)上實施的電腦程式產品的形式。
本發明是參照根據本發明實施例的方法、設備(系統)、和電腦程式產品的流程圖和/或方框圖來描述的。應理解可由電腦程式指令實現流程圖和/或方框圖中的每一流程和/或方框、以及流程圖和/或方框圖中的流程和/或方塊的結合。可提供這些電腦程式指令到通用電腦、專用電腦、嵌入式處理機或其他可程式設計資料處理設備的處理器以產生一個機器，使得通過電腦或其他可程式設計資料處理設備的處理器執行的指令產生用於實現在流程圖一個流程或多個流程和/或方塊圖一個方塊或多個方框中指定的功能的裝置。
這些電腦程式指令也可存儲在能引導電腦或其他可程式設計資料處理設備以特定方式工作的電腦可讀記憶體中，使得儲存在該電腦可讀記憶體中的指令產生包括指令裝置的製造品，該指令裝置實現在流程圖一個流程或多個流程和/或方框圖一個方塊或多個方快中指定的功能。
這些電腦程式指令也可裝載到電腦或其他可程式設計資料處理設備上，使得在電腦或其他可程式設計設備上執行一系列操作步驟以產生電腦實現的處理，從而在電腦或其他可程式設計設備上執行的指令提供用於實現在流程圖一個流程或多個流程和/或方快圖一個方塊或多個方塊中指定的功能的步驟。
在一個典型的配置中，計算設備包括一個或多個處理器(CPU)、輸入/輸出介面、網路介面和記憶體。
記憶體可能包括電腦可讀媒介中的非永久性記憶體，隨機存取記憶體(RAM)和/或非揮發性記憶體等形式，如唯讀記憶體(ROM)或快閃記憶體(flash RAM)。記憶體是電腦可讀媒介的示例。
電腦可讀媒介包括永久性和非永久性、可移動和非可移動媒體可以由任何方法或技術來實現資訊儲存。資訊可以是電腦可讀指令、資料結構、程式的模組或其他資料。電腦的儲存媒介的例子包括，但不限於相變記憶體(PRAM)、靜態隨機存取記憶體(SRAM)、動態隨機存取記憶體(DRAM)、其他類型的隨機存取記憶體(RAM)、唯讀記憶體(ROM)、電可抹除可程式設計唯讀記憶體(EEPROM)、快閃記憶體或其他記憶體技術、唯讀光碟唯讀記憶體(CD-ROM)、數位多功能光碟(DVD)或其他光學存儲、磁盒式磁帶，磁帶磁磁片存儲或其他磁性存放裝置或任何其他非傳輸媒介，可用於存儲可以被計算設備訪問的資訊。按照本文中的界定，電腦可讀介質不包括暫存電腦可讀媒體(transitory media)，如調製的資料信號和載波。
還需要說明的是，術語“包括”、“包含”或者其任何其他變體意在涵蓋非排他性的包含，從而使得包括一系列要素的過程、方法、商品或者設備不僅包括那些要素，而且還包括沒有明確列出的其他要素，或者是還包括為這種過程、方法、商品或者設備所固有的要素。在沒有更多限制的情況下，由語句“包括一個……”限定的要素，並不排除在包括所述要素的過程、方法、商品或者設備中還存在另外的相同要素。
本領域技術人員應明白的是，本申請案的實施例可提供為方法、系統或電腦程式產品。因此，本申請案可採用完全硬體實施例、完全軟體實施例或結合軟體和硬體方面的實施例的形式。而且，本申請案可採用在一個或多個其中包含有電腦可用程式碼的電腦可用儲存媒介(包括但不限於磁碟記憶體、CD-ROM、光學記憶體等)上實施的電腦程式產品的形式。
以上所述僅為本申請案的實施例而已，並不用於限制本申請案。對於本領域技術人員來說，本申請案可以有各種更改和變化。凡在本申請案的精神和原理之內所作的任何修改、等效替換、改進等，均應包含在本申請案的申請專利範圍的範圍之內。In order to make the purpose, technical solution and advantages of the application more clear, the technical solution of the application will be clearly and completely described below in conjunction with the specific embodiments of the application and the corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. According to the embodiments in this application, all other embodiments obtained by a person of ordinary skill in the art without creative work shall fall within the protection scope of this application.
With the popularization of mobile payment methods, people are becoming more and more accustomed to using third-party payment platforms for convenient mobile payments. For mobile payment, users and merchants who choose to use third-party payment platforms are the two most important subjects, and these two groups have a positive influence on each other: the more merchants offer to use third-party payment platforms The scenarios and services of mobile payment will actively drive more users to use the third-party payment platform. On the contrary, the continuous growth of the order of users will also drive the continuous growth of the order of magnitude of merchants.
However, as the number of merchants continues to grow, the proportion of problem businesses will also increase. When problem businesses engage in fraud, gambling, cash-out and other illegal activities, it will bring corresponding risks. The interests of the business and the normal operation of the business cause harm. Therefore, how to identify, prevent and control risks of tens of thousands of businesses in a timely and effective manner has become an urgent problem to be solved. Moreover, considering that the risks of merchants often involve a large order of magnitude of funds, they are likely to attract the attention of public opinion and regulatory authorities. Therefore, the timeliness of risk prevention and control for merchants is particularly important.
In order to achieve effective prevention and control of business risks, the following prevention and control solutions can be adopted:
(1) According to the prevention and control plan of the merchant strategy, the strategy operator is required to extract the risk characteristics through manual trial and analysis of the case, and then configure the online prevention and control strategy according to the extracted risk characteristics to allow the merchant to enter and trade in advance And post-event management and control links.
(2) According to the prevention and control plan of the risk detection model, it is necessary to analyze and design the corresponding risk characteristics for specific merchant risks, such as fraud, gambling, cash-out and other illegal activities, and then establish a risk detection model based on the risk characteristics. In turn, risk prevention and control can be carried out according to the risk value output by the risk detection model and the corresponding prevention and control strategy.
(3) According to the prevention and control plan for user complaints, when implementing the prevention and control plan, the main purpose of the prevention and control plan is to review and determine the merchants with user complaints. After the risk is verified, the corresponding risky merchants will be punished, and at the same time, the risky merchants will be punished. Of other businesses.
However, the above-mentioned business risk prevention and control solutions generally have the following defects:
(1) In the prevention and control plan based on the merchant’s strategy, not only does it require more manpower to examine and analyze cases to extract risk characteristics, but the cases heard and analyzed are generally for risks that have occurred. Therefore, there are new types of In the case of risks, it is necessary to re-trial and analyze the case and extract risk characteristics to reconfigure the prevention and control strategy. Obviously, it will reduce the timeliness of risk prevention and control. In addition, the prevention and control effect of the new strategy often needs to be launched after the strategy is online. Make an evaluation.
(2) In the prevention and control plan based on the risk detection model, when establishing the risk detection model, it is necessary to use the black and white samples in the historical data to determine the variables input to the risk detection model, and then train the online model. The modeling cycle is relatively long, and When the risk detection model is launched, its ability to identify merchant risks that have not occurred in history is limited, and the model detection ability will decline. For this reason, the model needs to be retrained regularly, which will obviously affect the timeliness of risk prevention and control.
(3) In the prevention and control plan based on user complaints, since the plan is an after-event prevention and control, it is not only necessary that the merchant risk has occurred, but also requires users to take the initiative to complain if the merchant risk harms the interests of users , And then the risk of the merchant can be qualitatively based on user complaints, and then the risk of this kind of merchant can be controlled accordingly, and the timeliness is not good.
Therefore, in actual application scenarios, the risk prevention and control results of the above prevention and control solutions often fail to meet the actual needs of merchants for risk prevention and control, and affect user experience.
In view of this, the embodiments of this application provide a merchant risk prevention and control solution, which can identify merchant risks in advance, realize dynamic prevention and control of merchant risks, improve the timeliness of merchant risk prevention and control, and has a strong Risk dynamic confrontation capability, suitable for different types of business risks, and good versatility.
The following describes in detail the technical solutions provided by the embodiments of the present application with reference to the accompanying drawings.
As shown in FIG. 1, the embodiment of the present application provides a method for preventing and controlling merchant risks. The method may include the following steps:
S101: When an abnormality in the target index data of the merchant is detected, determine the target abnormal parameter corresponding to the target index data.
S103: Obtain the target category to which the target indicator corresponding to the target indicator data belongs and the target dimension to which the target category belongs according to the correspondence between the indicators, categories, and dimensions.
It is understandable that in the embodiment of this application, it is necessary to perform anomaly detection on the target index data of the merchant, and when an abnormality in the target index data is detected, on the one hand, it needs to be based on the pre-established index, category and dimension. The corresponding relationship of the target index data is searched and obtained, and the target category to which the target index belongs and the target dimension to which the target category belongs. On the other hand, it is necessary to determine the target abnormal parameter corresponding to the target index data.
Optionally, the following embodiments may be used to realize the abnormal detection of the target index data of the merchant and determine the target abnormal parameters:
According to the time series anomaly detection model, detect whether the target index data of the merchant is abnormal.
Optionally, time series anomaly detection models include ARIMA model (Autoregressive Integrated Moving Average Model), HOLT-WINTERS model (exponential smoothing model) and LSTM (Long Short-Term Memory) One of the models, of course, can also adopt other models that can realize anomaly detection.
Optionally, according to the time series abnormality detection model, the step of detecting whether the target index data of the merchant is abnormal may include:
Determine the multiple time series actual measured values corresponding to the target index data in the current time period;
According to the time series predicted value and multiple time series measured values, multiple time series abnormal values corresponding to multiple time series measured values are calculated;
In the case that the average value of multiple time series abnormal values is greater than or equal to the preset value, it is determined that the detection result indicates that the target index data is abnormal;
In the case that the average value of the multiple time series abnormal values is less than the preset value, it is determined that the detection result indicates that the target index data is normal.
Optionally, the step of determining the time sequence abnormal value may include:
Determine the time series difference between the time series measured value and the time series predicted value;
Calculate the ratio between the time series difference and the time series predicted value to obtain the time series abnormal value.
Optionally, the target index data can reflect the value of the target index as a parameter, and the target abnormal parameter can reflect the degree of abnormality when the target index data is abnormal. Preferably, the target abnormal parameter corresponding to the target index data can be multiple The average value of time series outliers.
Among them, the time series measured value can reflect the actual detection value corresponding to the target index data at a detection time point in the current period, and the time series predicted value can reflect the estimated value of the target index data at the detection time point according to the normal trend, and the time series measured value The time-series difference between the value and the time-series predicted value can reflect the difference between the actual measured value and the normal estimated value of the target index data at the detection time point. The time-series difference can be used to measure the target index data Whether the detection value at the time of detection changes.
It is understandable that the values of the current time period and the preset values mentioned above can be empirical values determined according to the actual conditions of the merchants and target indicators that perform anomaly detection; for example, the number of time-series abnormal values that can be detected within 3 consecutive days When the average value is greater than or equal to the preset value, it is determined that the detection result indicates that the target index data is abnormal.
Furthermore, in the case where the detection result indicates that the target index data is abnormal, it is determined that the target index data is abnormal.
Optionally, when establishing the correspondence between indicators, categories, and dimensions, you can comprehensively set indicators for merchant risk prevention and control from different dimensions, and classify the indicators to obtain corresponding categories. When dimensioning, you can consider multi-level settings from coarse to fine and/or from superior to inferior to make the coverage of the indicator design more comprehensive and specific.
Wherein, the dimension may include at least one of a geographic dimension, a merchant type dimension, and a payment interface dimension.
For example, the geographic dimensions from coarse to fine can include autonomous regions, provinces, cities, banners, counties, and streets. For another example, the merchant type dimension from the upper level to the lower level may include: service providers, business development specialists, offline merchants, merchant transactions, etc. For another example, the dimensions of the payment interface may include whether to sign a third-party payment interface, whether the third-party payment interface is Alipay, and so on.
It is understandable that in the embodiments of this application, considering that when businesses are distributed in different regions, their operations may be affected by certain geographic characteristics, and the respective business operations of different types of businesses are also affected. There will be differences, and the payment interface used will be different, the capital flow permissions, operation procedures, etc. will also be different, and the risks of the merchants that may be caused will also be different. Therefore, you can set different dimensions for the merchants. Anomaly detection to achieve more comprehensive merchant risk monitoring.
In addition, the categories under the dimensions may include at least one of a merchant registration category and a merchant operation category.
Optionally, the merchant registration category may include at least one of the following indicators: the nature of the merchant, maintenance records, business content, and industry; the merchant operation category may include at least one of the following indicators: transaction amount, number of complaints, product quality, service quality, and Payment interface usage.
Among them, the nature of the business can include individual businesses and corporate businesses; the dimension records include the regular dimension records of the business by the Business Development Specialist (BD, Business Development), and the content of maintenance can include monitoring business tax payment and monitoring whether the business license expires , Whether to update due, monitor whether the merchant handles customer complaints in a timely manner, etc., BD generates corresponding maintenance records after each dimension merchant; the business content can refer to the products operated by the merchant filled in when the merchant registers, for example, the business content of the fruit shop can be It is fruit, the business content of the vegetable shop can be vegetables; the business to which the business belongs can refer to the business filled in when the business is registered, or the business derived from the business’s business content; the transaction amount can include the business’s transactions within the set time period The total amount; the number of complaints can include the number of complaints made by the merchant in the most recent cycle; the payment interface usage can include whether the third-party payment interface of the merchant is used by other merchants, and the geographic location information of the third-party payment interface to complete the transaction.
Of course, the settings of dimensions, categories, indicators, etc. used for risk prevention and control of businesses are not limited to the above content, and can be adjusted accordingly according to specific and actual prevention and control needs.
In the embodiments of this application, anomaly detection can be performed on specific indicators in specified categories of specified dimensions to achieve the capture of target indicator data that changes in time sequence during the risk prevention and control process of the merchant; or pre-designed All indicators are detected for anomaly, to achieve the capture of target indicator data that changes in time sequence during the risk prevention and control process of the merchant. Among them, the abnormality detection process can be performed periodically or continuously, and in the case of periodic abnormality detection, the polling cycles for different indicators can be the same or different.
S105: Determine at least one linkage category according to the target dimension and target category, and at least one linkage category includes indicators that cause abnormal target indicator data.
It is understandable that after the corresponding target dimension and target category are locked according to the abnormal target indicator detected, at least one linkage category is further acquired according to the target dimension and target category, and the at least one linkage category includes the target indicator that can cause the target. Data abnormal indicators, so as to find out related abnormal indicators more comprehensively.
Optionally, the step of determining at least one linkage category according to the target dimension and target category may include:
Acquiring at least one linked dimension associated with the target dimension;
Under at least one linkage dimension, at least one linkage category associated with the target category is acquired.
It is understandable that, in the embodiments of the present application, at least one linked category can be scrolled up and down searched on the relationship between dimensions and dimensions, categories and categories, so as to find out related abnormal indicators more comprehensively. Optionally, the relationship between dimensions and dimensions, categories and categories can be recorded in the corresponding relationships between indicators, categories and dimensions for maintenance, or the relationship between dimensions and dimensions, categories and categories can be established and maintained separately.
It is understandable that the linkage dimension can refer to the dimension that has an association relationship with the target dimension of the target indicator corresponding to the abnormal target indicator data, and the linkage category can refer to the target category of the target indicator corresponding to the abnormal target indicator data. Types of association relationship, each linkage category belongs to the corresponding linkage dimension, and all indicators under each linkage category have indicators that can cause abnormal target indicator data. In other words, there are indicators corresponding to each indicator under each linkage category. Index data that can cause abnormal target index data.
After determining the target abnormal parameter corresponding to the target index data and obtaining at least one linkage category, the merchant risk prevention and control can be performed accordingly, that is, the following steps are performed:
S107: Perform merchant risk prevention and control according to the target abnormal parameter and at least one linkage category.
Optionally, this step S107 may include:
Under at least one linkage category, obtain the first indicator set corresponding to the abnormal indicator data;
According to the target abnormal parameters, at least one linkage category and the first index set, the merchant risk prevention and control is carried out.
It is understandable that, according to at least one linkage category associated with the target indicator, anomaly detection can be performed on the indicator data corresponding to the indicator under the at least one linkage category, and optionally, anomaly detection can be performed on indicator data within a specified time period , In order to improve the degree of association with the abnormal target index data, improve the accuracy and reliability of the index acquisition in the first index set, and the above-mentioned detection scheme for detecting whether the target index data is abnormal can be used to compare at least one Anomaly detection is performed on the indicator data under the linkage category, that is, the indicator data corresponding to at least one indicator under the linkage category is detected according to the time series abnormality detection model, and when the detection result indicates an abnormality, it is determined whether the indicator data under the at least one linkage category is abnormal. The indicator data corresponding to the indicator is abnormal, and at least one indicator corresponding to the at least one indicator data with the abnormality can be formed into a first indicator set to be used together with target abnormal parameters and at least one linkage category for merchant risk prevention and control.
Optionally, performing merchant risk prevention and control based on target abnormal parameters, at least one linkage category, and first indicator set may specifically include the following steps:
According to at least one linkage category, determine the cause of the abnormality of the target indicator data.
It is understandable that, in the embodiment of the present application, the reason for the abnormality of the target index data can be determined according to at least one linkage category. Optionally, at least one linkage category that the user is more concerned about is selected according to the user's choice. Determining the cause of the abnormality can include the following steps:
Receive category selection instructions;
In at least one linkage category, determine the target linkage category corresponding to the category selection instruction;
Determine the cause of the abnormality according to the target linkage category.
Of course, in addition to the user's choice, other methods can also be used to determine the cause of the abnormality based on at least one linkage category, such as setting category screening rules to automatically filter out at least one linkage category that meets the requirements of the rule according to the category screening rules. The formation of abnormal causes, etc.
Further, a first parameter set corresponding to the first indicator set is determined, and each abnormal parameter in the first parameter set corresponds to the indicator data of each indicator in the first indicator set in a one-to-one correspondence.
It is understandable that for at least one index with abnormal index data under the linkage category, the abnormal parameters of each index data can be determined accordingly, so that the first parameter set corresponding to the first index set can be obtained, where the abnormal parameters The determination can be performed with reference to the foregoing embodiment for determining the target abnormal parameter, which is not repeated here.
Further, the second index set and the second parameter set are determined according to the target abnormal parameter, the first index set, and the first parameter set. Each abnormal parameter in the second parameter set and the index data of each index in the second index set are one by one. correspond.
In the embodiment of the present application, the first indicator set and the first parameter set can be converted into the second indicator set and the second parameter set according to the target abnormal parameter, so as to realize reasonable control of the strength of the merchant risk prevention and control. The second indicator set includes at least one indicator in the first indicator set, and the second parameter set includes at least one abnormal parameter in the first parameter set.
Optionally, the process of determining the second indicator set and the second parameter set may include the following steps:
Determine the difference between the target abnormal parameter and each abnormal parameter in the first parameter set;
In the case that the difference is within the preset threshold range, construct a second parameter set according to the abnormal parameter corresponding to the difference;
Construct a second index set according to the index corresponding to each abnormal parameter in the second parameter set.
In this embodiment, the abnormal parameters indicated in the first parameter set whose abnormality degree is higher than the abnormality degree corresponding to the target index data (that is, the target abnormal parameter) can be classified into the second parameter set, that is, when the first parameter set When the difference between the abnormal parameter and the target abnormal parameter is within a certain specified range, the abnormal parameter is classified into the second parameter set, and then the indicators in the first indicator set corresponding to each abnormal parameter in the second parameter set are classified as The second set of indicators.
Further, the steps of conducting risk prevention and control for merchants based on the reason for the abnormality, the second index set and the second parameter set can be performed. Optionally, it may include:
In the second indicator set, obtain the risk prevention and control indicators, and the risk prevention and control indicators match the abnormal cause;
In the second parameter set, the risk prevention and control parameters are obtained, and the risk prevention and control parameters correspond to the risk prevention and control indicators one to one;
According to risk prevention and control indicators and risk prevention and control parameters, carry out business risk prevention and control.
It is understandable that after determining the cause of the abnormality according to the distribution of the category (ie at least one linked category) of the indicator whose indicator data is abnormal, the risk prevention and control indicator matching the cause of the abnormality can be obtained from the second indicator set, and The risk prevention and control parameters corresponding to the aforementioned risk prevention and control indicators that match the abnormal cause are obtained from the second parameter set, so as to perform more reasonable risk prevention and control for merchants.
According to the risk prevention and control indicators and risk prevention and control parameters, the above-mentioned risk prevention and control of merchants can be implemented by the following specific embodiments:
In the first specific embodiment, the solution for risk prevention and control of merchants may include:
In the case that the risk prevention and control parameter is greater than the abnormal parameter threshold, obtain the risk prevention and control strategy corresponding to the risk prevention and control index;
Carry out merchant risk prevention and control according to risk prevention and control strategies.
It is understandable that when the value of the risk prevention and control parameter obtained according to the abnormal parameter and the abnormal reason in the second parameter set is greater than the abnormal parameter threshold, it indicates that the degree of abnormality of the index is sufficiently large. At this time, the corresponding risk can be directly deployed. The prevention and control strategy is to carry out the risk prevention and control of the merchants in a timely manner, that is, to improve the timeliness of the risk prevention and control of the merchants while detecting abnormal indicators in a timely manner.
Optionally, risk prevention and control strategies include imposing fines on merchants, returning fraudulent benefits, ordering business suspension for rectification, ordering improvement of operating qualifications, etc., to prohibit merchants from engaging in any risk-causing behavior.
In the second embodiment, the merchant risk identification model training can be performed to update the merchant risk identification model based on the latest indicator abnormalities, which can improve the timeliness of merchant risk prevention and control while detecting indicator abnormalities in time. .
Optionally, before performing merchant risk prevention and control, in the embodiment of this application, the steps of obtaining historical risk indicators and corresponding historical abnormal parameters need to be performed, and then the historical risk indicators are compared with the current risk prevention and control indicators. The comparison is to implement corresponding merchant risk prevention and control plans based on different comparison results to avoid missing historical risks, so as to achieve a more comprehensive coverage of merchant risk prevention and control.
Optionally, according to risk prevention and control indicators and risk prevention and control parameters, the plan for merchant risk prevention and control may include the following two aspects:
In the first aspect, in the case where there are missing indicators between the risk prevention and control indicators and the historical risk indicators, the initial model is trained according to the first training sample to obtain the first merchant risk identification model;
Among them, the missing indicators are included in the historical risk indicators, and the first training sample includes risk prevention and control indicators, risk prevention and control parameters, missing indicators, and missing abnormal parameters corresponding to the missing indicators.
It is understandable that when compared with historical risk indicators, the risk prevention and control indicators determined according to the current indicator abnormalities have incomplete coverage of the indicators to be prevented and controlled, for the timeliness of merchant risk identification, that is, to cover possible occurrences. In order to ensure that the confirmed historical risk indicators will not be missed during risk identification, you can consider the latest risk prevention and control indicators and their corresponding risk prevention and control parameters, missing indicators and their corresponding missing abnormal parameters as the first A training sample of a merchant risk identification model, so that the latest first merchant risk identification model trained according to this can identify historical and latest merchant risks, and has good timeliness.
Optionally, the above-mentioned initial model may be an untrained original model constructed using the Isolation Forest iForest algorithm or the Symbolic Regression algorithm, or it may be an in-use merchant risk trained based on historical risk indicators and other data. Identify the model.
Optionally, according to the first training sample, the process of training the initial model to obtain the first merchant risk identification model may include:
Determine the risk identification threshold according to risk prevention and control parameters and missing abnormal parameters;
According to risk prevention and control indicators and missing indicators, generate the input vector of the initial model;
Input the input vector into the initial model to get the output of the initial model;
Adjust the parameters of the initial model according to the gap between the output of the initial model and the risk identification threshold;
Repeat the above steps until the gap meets the preset conditions, and get the first merchant risk identification model.
It is understandable that considering that the risk prevention and control parameters and the missing abnormal parameters reflect the abnormal degree of the corresponding indicator data, the risk identification threshold can be determined based on this, so that the risk identification standard is reliable and accurate.
Further, deploy the first merchant risk identification model for merchant risk identification, and output the risk identification result;
Obtain the risk prevention and control strategy corresponding to the risk identification result to implement risk prevention and control according to the risk prevention and control strategy.
It is understandable that when the current risk prevention and control indicators have missing indicators compared with the historical risk indicators, when training the merchant risk identification model, it is necessary to take into account the missing historical indicators and their corresponding abnormal parameters.
It should be noted that, according to the above training samples, the training set and the validation set during model training can be determined. Optionally, the number of samples in the training set and validation set can be flexibly adjusted. For example, 70% of the training samples are used as the training set to train the merchant risk identification model, and the remaining 30% of the training samples are used as the verification set to verify the merchant risk identification Whether the output of the model meets the requirements in order to realize the model effect evaluation. Optionally, risk prevention and control strategies include imposing fines on merchants, returning fraudulent benefits, ordering business suspension for rectification, ordering improvement of operating qualifications, etc., to prohibit merchants from engaging in any risk-causing behavior.
In the second aspect, when the risk prevention and control index is compared with the historical risk index and there is no missing index, the initial model is trained according to the second training sample to obtain the second merchant risk identification model;
Among them, the missing indicators are included in the historical risk indicators, and the second training sample includes the second risk prevention and control indicator and the second risk prevention and control parameter.
It is understandable that when compared with historical risk indicators, the risk prevention and control indicators determined based on the current indicator abnormalities do not have incomplete coverage of the indicators to be prevented and controlled, you can consider the latest and comprehensive risk prevention and control The indicators and their corresponding risk prevention and control parameters are used as training samples of the second merchant risk identification model, so that the latest second merchant risk identification model trained according to this can identify historical and latest merchant risks with good timeliness.
Optionally, the above-mentioned initial model may be an untrained original model constructed using the Isolation Forest iForest algorithm or the Symbolic Regression algorithm, or it may be an in-use merchant risk trained based on historical risk indicators and other data. Identify the model.
Optionally, the process of training the initial model to obtain the second merchant risk identification model according to the second training sample may include:
Determine the risk identification threshold according to the risk prevention and control parameters;
According to the risk prevention and control index, the input vector of the initial model is generated;
Input the input vector into the initial model to get the output of the initial model;
Adjust the parameters of the initial model according to the gap between the output of the initial model and the risk identification threshold;
Repeat the above steps until the gap meets the preset conditions, and obtain the second merchant risk identification model.
It should be noted that, according to the above second training sample, the training set and the validation set during model training can be determined. Optionally, the number of samples in the training set and validation set can be flexibly adjusted. For example, 70% of the training samples are used as the training set to train the second merchant risk identification model, and the remaining 30% of the training samples are used as the validation set to verify the first 2. Whether the output of the merchant's risk identification model meets the requirements to realize the model effect evaluation.
Further, deploy a second merchant risk identification model for merchant risk identification, and output the risk identification result;
Obtain the risk prevention and control strategy corresponding to the risk identification result to implement risk prevention and control according to the risk prevention and control strategy.
It is understandable that when there are no missing indicators between the current risk prevention and control indicators and the historical risk indicators, when the merchant risk identification model training is carried out, it can be directly executed based on the risk prevention and control indicators and their corresponding risk prevention and control parameters. .
Optionally, risk prevention and control strategies include imposing fines on merchants, returning fraudulent benefits, ordering business suspension for rectification, ordering improvement of operating qualifications, etc., to prohibit merchants from engaging in any risk-causing behavior.
In summary, in the embodiment of this application, indicators for risk prevention and control of merchants are comprehensively set from different dimensions, and the indicators are classified to obtain corresponding categories, and the corresponding relationship between indicators, categories and dimensions is established to When an abnormal target indicator is detected in the indicator data, according to the corresponding relationship, all the linkage categories that cause the target indicator data to be abnormal are obtained, and then based on the obtained linkage category and the target anomaly parameter that characterizes the abnormality of the target indicator data. Business risk prevention and control. Therefore, through abnormal detection of indicators related to merchant risk prevention and control, and whenever an abnormal indicator is detected in indicator data, timely merchant risk prevention and control will be carried out according to the indicator abnormality, so as to realize the early identification of risks before merchant risk confirmation and improve Timeliness of business risk prevention and control.
The merchant risk prevention and control method described in the embodiment of the present application can also be displayed through the information flow as shown in FIG. 2.
(1) Change perception (that is, abnormal detection), that is, monitor where changes occur.
You can use reasonable dimension division and indicator design, such as dividing dimensions according to contract information, merchant type, payment institution, etc., and design indicators in merchant account opening, transaction, operation, etc., and classify the indicators, and over time, Detect the time series changes of indicators in each dimension or a specific dimension, and determine whether the indicator changes according to the difference between the detected time series actual value and the time series predicted value. If there is a change, output the target change category to which the target change indicator belongs. The target change dimension and the target change degree corresponding to the target change index (ie target abnormal parameter).
Among them, the degree of index change can be calculated as follows:
The degree of change = (time series actual value-time series forecast value)/time series forecast value.
(2) Exploring and scrolling the change, that is, looking for the reason for the change and related change indicators.
According to the above output target change category, target change dimension, drill down and/or roll up the detailed index data under the related category and correlation dimension, and determine the appropriate prevention and control strength according to the above output target change degree. The greater the degree of change is required The stricter the prevention and control measures are, the detailed index data under the related categories and related dimensions are screened to find all related change indicators, and the abnormal degree of the indicators is obtained in the same way as above. At the same time, according to the respective change indicators belong The distribution of the categories can determine the cause of the change (ie, the cause of the abnormality), so as to output the cause of the change, a list of change indicators that match the cause of the change, and the corresponding index change degree.
Optionally, when outputting the list of indicators and the corresponding degree of change, the identified historical risk indicators and the degree of change may be considered to avoid missing risks.
(3) Change response
According to the above output change index list and the corresponding index change degree, as well as the isolation forest iForest algorithm, symbolic regression algorithm, etc., the model is quickly established, and the model evaluation is performed on the basis of the above-mentioned change detail data to obtain the estimated effect of the model. Output risk identification models and recommend risk prevention and control strategies.
(4) Risk prevention and control
Output the above-mentioned risk identification model to the risk prevention and control platform for model deployment, realize the evaluation of the real results of the model, and combine the results to match risk prevention and control strategies to quickly prevent and control new risks.
For example, take the city dimension as the main dimension to perform abnormality detection or abnormality detection for merchants. When the data corresponding to indicator B of city A is detected to be abnormal, there are changes for multiple consecutive days compared with the normal time series forecast value, and the average change When the degree reaches a certain value, output the index category C to which the index B belongs, the average change degree corresponding to the data of the index B, and the city dimension A.
Further, according to the pre-established relationship between indicators, categories, and dimensions, search and determine other city dimensions, banner and county dimensions, town dimensions, etc. that are associated with city dimension A. For example, in city A, it is perceived that the business has a chain organization in the region. , Branches or service providers, etc., and to find and determine other categories associated with category C, such as the corresponding category corresponding to the business in other regions, etc., you can change the index data of the indicators under the determined categories Perceptual mining, find all relevant change indicators, and analyze the distribution of related change indicators to determine the cause of the change according to the determined category, and then perform model training, model evaluation and prevention based on the indicators matching the cause of the change and the corresponding degree of change. Control strategy recommendations, etc., to achieve business risk prevention and control.
From the perspective of the whole process, the abnormality can be discovered quickly and timely by the abnormal movement perception, and the reason can be quickly located by the method of abnormal movement downward and scrolling, and effective change indicators are output, model training and risk prevention and control are carried out to ensure prevention. In addition, the transfer of risks will cause changes in other indicators. It can dynamically capture risks and enhance dynamic antagonism. It can be seen that the entire system does not pay attention to specific risks, but only changes. Risks in any situation can be timely as long as they cause changes. Detection and prevention and control, specific and very good versatility.
It can be seen that the merchant risk prevention and control method of the embodiment of this application has the following advantages:
(1) Better timeliness: According to the calculation and monitoring of real-time risk indicators, risks can be found and located in a more timely manner;
(2) Stronger dynamic antagonism: The transfer and mutation of business risks can be discovered in time, and strategies and models can be quickly assembled to complete the prevention and control of new risks;
(3) Better versatility: The invention is not aimed at any commercial furniture risk. Through a comprehensive indicator design, it can detect merchant abnormalities caused by different risks.
As shown in Figure 3, the embodiment of the present application also provides a merchant risk prevention and control device, which may include:
The first determining module 301 is used to determine the target abnormal parameters corresponding to the target index data when the target index data of the merchant is detected to be abnormal;
The obtaining module 303 is used to obtain the target category to which the target indicator corresponding to the target indicator data belongs and the target dimension to which the target category belongs according to the correspondence between the indicators, categories, and dimensions;
The second determination module 305 is configured to determine at least one linkage category according to the target dimension and the target category, and the at least one linkage category includes indicators that cause abnormal target indicator data;
The processing module 307 is configured to perform merchant risk prevention and control based on target abnormal parameters and at least one linkage category.
It can be understood that the merchant risk prevention and control device shown in FIG. 3 can implement the steps of the merchant risk prevention and control method described in FIG. 1, and the relevant explanations about the merchant risk prevention and control method in the foregoing embodiments are applicable to merchant risks. The prevention and control device will not be repeated here.
Fig. 4 is a schematic structural diagram of an electronic device according to an embodiment of the present application. Please refer to FIG. 4, at the hardware level, the electronic device includes a processor, optionally an internal bus, a network interface, and a memory. Among them, the memory may include memory, such as high-speed random-access memory (Random-Access Memory, RAM), and may also include non-volatile memory (non-volatile memory), such as at least one disk memory, etc. . Of course, the electronic equipment may also include hardware required by other businesses.
The processor, network interface, and memory can be connected to each other through an internal bus, which can be an ISA (Industry Standard Architecture) bus or a PCI (Peripheral Component Interconnect) bus Or EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of presentation, only one double-headed arrow is used to indicate in FIG. 4, but it does not mean that there is only one busbar or one type of busbar.
Memory, used to store programs. Specifically, the program may include program code, and the program code includes computer operation instructions. The memory may include memory and non-volatile memory, and provide instructions and data to the processor.
The processor reads the corresponding computer program from the non-volatile memory to the memory and then runs it, forming a business risk prevention and control device at the logical level. The processor executes the programs stored in the memory, and is specifically used to perform the following operations:
When an abnormality in the target index data of the merchant is detected, determine the target abnormal parameter corresponding to the target index data;
According to the correspondence between indicators, categories and dimensions, obtain the target category to which the target indicator corresponding to the target indicator data belongs, and the target dimension to which the target category belongs;
Determine at least one linkage category according to the target dimension and target category, and at least one linkage category includes indicators that cause abnormal target indicator data;
According to target abnormal parameters and at least one linkage category, carry out risk prevention and control of merchants.
The foregoing method executed by the merchant risk prevention and control device disclosed in the foregoing corresponding embodiment of the present application may be applied to the processor or implemented by the processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, the steps of the above method can be completed by hardware integrated logic circuits in the processor or instructions in the form of software. The above-mentioned processor may be a general-purpose processor, including a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), etc.; it may also be a digital signal processor (DSP), a dedicated Integrated circuit (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic components, discrete gates or transistor logic components, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as random memory, flash memory, read-only memory, programmable read-only memory, or electronically readable and writable programmable memory, register. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
The electronic device can also execute the aforementioned method executed by the corresponding merchant risk prevention and control device, and realize the functions of the merchant risk prevention and control device in the aforementioned corresponding embodiment. The embodiments of the present application will not be repeated here.
The embodiment of the present application also proposes a computer-readable storage medium, the computer-readable storage medium stores one or more programs, the one or more programs include instructions, and the instructions are used as an electronic device that includes multiple application programs When executed, the electronic device can be made to execute the method executed by the merchant risk prevention and control device in the embodiment shown in FIG. 1, and is specifically used to execute:
When an abnormality in the target index data of the merchant is detected, determine the target abnormal parameter corresponding to the target index data;
According to the correspondence between indicators, categories and dimensions, obtain the target category to which the target indicator corresponding to the target indicator data belongs, and the target dimension to which the target category belongs;
Determine at least one linkage category according to the target dimension and target category, and at least one linkage category includes indicators that cause abnormal target indicator data;
According to target abnormal parameters and at least one linkage category, carry out risk prevention and control of merchants.
Those skilled in the art should understand that the embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention can be in the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) containing computer-usable program codes. .
The present invention is described with reference to flowcharts and/or block diagrams of methods, equipment (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to the processors of general-purpose computers, special computers, embedded processors, or other programmable data processing equipment to generate a machine that can be executed by the processors of the computer or other programmable data processing equipment A device for realizing the functions specified in one flow or multiple flows in the flowchart and/or one block or multiple blocks in the block diagram is generated.
These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory generate a manufactured product including the instruction device , The instruction device realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so that the computer or other programmable equipment The instructions executed above provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the quick diagram.
In a typical configuration, the computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
Memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.
Computer-readable media includes permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology. The information can be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), and other types of random access memory (RAM) , Read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital multi-function Optical discs (DVD) or other optical storage, magnetic cassettes, magnetic tape storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
It should also be noted that the terms "include", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device that includes a series of elements not only includes those elements, but also includes Other elements not explicitly listed, or include elements inherent to this process, method, commodity, or equipment. Without more restrictions, the element defined by the sentence "include one..." does not exclude that there are other identical elements in the process, method, commodity, or equipment that includes the element.
Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems or computer program products. Therefore, this application can adopt the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware. Moreover, this application can adopt computer program products implemented on one or more computer-usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) containing computer-usable program codes. form.
The above descriptions are only examples of this application, and are not used to limit this application. For those skilled in the art, this application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included in the scope of the patent application of this application.
