WO2018161900A1 - 一种风控事件自动处理方法及装置 - Google Patents

一种风控事件自动处理方法及装置 Download PDF

Info

Publication number
WO2018161900A1
WO2018161900A1 PCT/CN2018/078164 CN2018078164W WO2018161900A1 WO 2018161900 A1 WO2018161900 A1 WO 2018161900A1 CN 2018078164 W CN2018078164 W CN 2018078164W WO 2018161900 A1 WO2018161900 A1 WO 2018161900A1
Authority
WO
WIPO (PCT)
Prior art keywords
risk
control event
wind control
information
category
Prior art date
Application number
PCT/CN2018/078164
Other languages
English (en)
French (fr)
Inventor
章鹏
吴新琪
杨志雄
张英
Original Assignee
阿里巴巴集团控股有限公司
章鹏
吴新琪
杨志雄
张英
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司, 章鹏, 吴新琪, 杨志雄, 张英 filed Critical 阿里巴巴集团控股有限公司
Priority to JP2019524436A priority Critical patent/JP6869347B2/ja
Priority to EP18763193.2A priority patent/EP3525121A4/en
Priority to KR1020197013394A priority patent/KR102249712B1/ko
Publication of WO2018161900A1 publication Critical patent/WO2018161900A1/zh
Priority to PH12019501032A priority patent/PH12019501032A1/en
Priority to US16/421,133 priority patent/US20190279129A1/en
Priority to US17/461,111 priority patent/US20210390471A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
    • G16Z—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS, NOT OTHERWISE PROVIDED FOR
    • G16Z99/00—Subject matter not provided for in other main groups of this subclass
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
    • G06Q10/063—Operations research, analysis or management
    • G06Q10/0635—Risk analysis of enterprise or organisation activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/10—Office automation; Time management
    • G06Q10/103—Workflow collaboration or project management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/02—Payment architectures, schemes or protocols involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/01—Customer relationship services
    • G06Q30/015—Providing customer assistance, e.g. assisting a customer within a business location or via helpdesk
    • G06Q30/016—After-sales
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/018—Certifying business or products
    • G06Q30/0185—Product, service or business identity fraud
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0609—Buyer or seller confidence or verification

Definitions

  • the present application relates to the field of computer software technologies, and in particular, to a method and an apparatus for automatically processing a wind control event.
  • the trial personnel of the risk control platform will try to handle the wind control incident. Specifically, the trial personnel usually judge the wind control event according to the operation content, environment and equipment of the user on the platform. For example, the wind control event can be determined.
  • the categories to which they belong for example, case types, non-case categories, etc., different risk control events have different risks.
  • risk events with a certain degree of risk can be called cases, and other risk events can be called non-cases. ), etc., if necessary, communicate with the user to confirm, and finally a copy of the wind control event will be generated to close the case.
  • the embodiment of the present invention provides a method and a device for automatically processing a wind control event, which are used to solve the following technical problems in the prior art: the trial personnel of the safety risk control platform perform the wind control event determination by means of manual analysis, and the settlement efficiency is low. Moreover, the reliability of the results of the wind control event is difficult to verify.
  • the settlement information of the current wind control event is generated.
  • the first obtaining module acquires each risk characteristic information of the current wind control event
  • the determining module determines, according to the risk attribute information, a category to which the current wind control event belongs;
  • a second acquiring module acquiring evidence information corresponding to the result of the determining
  • the above at least one technical solution adopted by the embodiment of the present application can achieve the following beneficial effects: automatic processing of the wind control event can be realized, thereby facilitating the improvement of the settlement speed, and not only, since the evidence corresponding to the result of the wind control event determination can be automatically obtained
  • the information therefore, facilitates the convenience of verifying the reliability of the results of the wind control event determination, and can partially or completely solve the problems in the prior art.
  • FIG. 1 is a schematic flowchart of a method for automatically processing a wind control event according to an embodiment of the present application
  • FIG. 2 is a schematic diagram of an extended flow corresponding to FIG. 1 according to an embodiment of the present application
  • FIG. 3 is a schematic diagram of a decision tree according to an embodiment of the present application.
  • FIG. 4 is a schematic diagram of a decision path in the decision tree of FIG. 3 according to an embodiment of the present application;
  • FIG. 5 is a schematic diagram of comparison between the settlement information generated by the above automatic risk control event processing method and the settlement information in the prior art according to an embodiment of the present application;
  • FIG. 6 is a schematic structural diagram of a wind control event automatic processing apparatus corresponding to FIG. 1 according to an embodiment of the present application.
  • the embodiment of the present application provides a method and an apparatus for automatically processing a wind control event.
  • FIG. 1 is a schematic flowchart diagram of a method for automatically processing a wind control event according to an embodiment of the present application.
  • the execution subject of the process may be an application (APP) or a personal computer (PC) end program or the like.
  • the executive body of the process may include, but is not limited to, the following devices: personal computers, medium and large computers, computer clusters, mobile phones, tablets, smart wearable devices, car machines, and the like.
  • the process in Figure 1 can include the following steps:
  • S101 Acquire each risk characteristic information of the current wind control event.
  • the wind control event can be obtained by the user reporting the case, or can be obtained by actively monitoring a certain service.
  • the risk feature information may be used to measure the risk existing in the risk event, and therefore, the risk feature information may be used as a basis for determining the risk event.
  • the risk characteristics corresponding to the risk characteristic information can be pre-designed based on the business. Still taking the online shopping business as an example, the risk characteristics may be: the number of historical transactions between users, the geographical location of the user when the transaction is made, and the equipment used by the user during the transaction. In practical applications, the risk feature information may be a specific value of the risk feature corresponding thereto, or may be used to determine the specific value information and the like.
  • the risk characteristics used can be designed according to specific requirements to improve the effect of the solution of the present application. List three possible specific requirements for risk characteristics as follows:
  • “Determinable” requirements that is, the risk characteristics are suitable for case determination, which is related to the type of case risk. For example, “the number of historical transactions between users", when the value is large, means that the user is more familiar with the counterparty, the risk is low, and it is unlikely to be a case; otherwise, the risk is higher, more likely it is a case.
  • “Acicable” requirements that is, the risk characteristics can correspond to clear evidence information, and the evidence information is easy to obtain. For example, "the number of historical transactions between users" can clearly and easily obtain the corresponding information of each historical transaction as the corresponding evidence information.
  • S102 Determine, according to the risk attribute information, a category to which the current wind control event belongs.
  • a risk event with a high degree of risk can generally be referred to as a case, and other risk events may be referred to as non-cases.
  • the category to which the risk control event belongs may be: a case category or a non-case category.
  • case category or the non-case category can be further subdivided.
  • case category can be subdivided into “device loss-case” and “account stolen-case” categories; non-case categories can be subdivided into “acquaintance generation”.
  • dividing the risk event according to whether it is a case is only an example of the division method. There are other ways of dividing, for example, multiple different risk level categories can be set, and each wind control event is divided into at least one risk level category in each risk level category, and so on.
  • the evidence information may be obtained according to the determining process, or may be obtained according to each risk characteristic information.
  • the evidence information may be, for example, detailed information of the process of determination, detailed information of the risk characteristic information, and the like. Assuming that the risk characteristic information is: the number of historical transactions between the users is 5; the detailed information of the risk characteristic information may be: details of the transaction records of the 5 transactions.
  • the reliability of the corresponding wind control event determination result can be verified based on the evidence information.
  • S104 Generate settlement information of the current wind control event according to the result of the determination and the evidence information.
  • the countermeasure in addition to generating the settlement information, may be performed for the current wind control event according to the result of the determination. For example, if it is determined that the current wind control event belongs to the case category, the countermeasures such as the banned transaction account number and the refusal of the transaction may be performed for the current risk control event to protect the transaction security.
  • the automatic processing of the wind control event can be realized, thereby facilitating the improvement of the settlement speed. Moreover, since the evidence information corresponding to the result of the wind control event determination can be automatically obtained, it is convenient to conveniently verify the wind control event. The reliability of the judgment result.
  • the embodiment of the present application further provides some specific implementation manners of the method, and an extended solution, which will be described below.
  • the determining, according to the risk attribute information, the category to which the current wind control event belongs may specifically include: obtaining a classification trained according to the risk feature information of the sample wind control event.
  • the class to which the current wind control event belongs is determined by classifying the current wind control event according to the classifier and the risk characteristic information.
  • a classifier can be implemented based on a decision tree, a classifier can be implemented based on a neural network, and the like.
  • the classifiers described above are typically pre-trained based on multiple sample wind control events.
  • the risk feature information blacklist may be preset, and then each risk feature information of the current wind control event is matched with the blacklist. If the matching is successful, the current wind control event is directly determined to belong to the case category, and the like.
  • the evidence information corresponding to the result of the determination may be obtained according to each risk characteristic information.
  • different risk feature information often corresponds to different evidence information.
  • the evidence information corresponding to all the risk feature information of the current risk event may be obtained indiscriminately, and when the risk characteristics are When it is more, this may not be appropriate, because it will consume more processing resources and time, thus increasing the cost.
  • the contribution characterization value may be used to measure the importance of the risk feature information.
  • the obtaining the evidence information corresponding to the result of the determination may specifically include: determining each of the The contribution characteristic value of the risk characteristic information; obtaining the evidence information corresponding to the result of the determination according to the contribution representation value and the corresponding risk characteristic information.
  • the risk characteristic information that is relatively important in the part may be determined by sorting based on the contribution representation value or comparing the contribution representation value with the set threshold.
  • the manner in which the information is sorted based on the value of the contribution is used to obtain the evidence information corresponding to the result of the determination, which may include: performing the risk characteristic information according to the determined contribution characteristic value of each risk characteristic information. Sorting; according to the result of the sorting, obtaining evidence information corresponding to the N-large risk feature information before the feature value, as the evidence information corresponding to the result of the determination, wherein N is an integer not less than 1.
  • FIG. 2 is a schematic diagram of an extended flow corresponding to FIG. 1 according to an embodiment of the present application.
  • the process in Figure 2 can include the following steps:
  • the flow in FIG. 2 is compared with the flow in FIG. 1 with emphasis on the determination of the contribution characterization value of the risk characteristic information, which will be described in detail below.
  • the contribution characterization value of the risk feature information may be determined based on one or more aspects. Several factors are listed below as examples:
  • the importance of evidence As mentioned above, after determining the category described in the risk control event, evidence information is also obtained, that is, proof is also required.
  • the importance of evidence can reflect the importance of the evidence information corresponding to the risk characteristics information.
  • the category determines contributions.
  • the category decision contribution may reflect the contribution of the risk feature information in determining the category to which the risk control event belongs.
  • the feature dimension contribution may reflect the contribution of the risk feature corresponding to the risk feature information to the result of determining the category to which the wind control event belongs, and the contribution may be independent of the process of the decision.
  • the feature dimension contribution can reflect the anomaly of the risk feature information. For example, it may be the degree of the standard value used in the process of deviating the risk characteristic information from the determination, etc., wherein the standard value is used to compare with the risk characteristic information to determine how to select the branch in the process of the determination.
  • the determining the contribution representation value of each risk characteristic information may specifically include: determining at least one specific representation value of the risk attribute information: evidence importance representation value, category Determining a contribution representation value, a feature dimension contribution representation value, and a feature anomaly representation value; and determining a contribution representation value of each of the risk characteristic information according to the determined specific representation value.
  • the contribution representation value of the risk characteristic information of the wind control event is: a contribution representation value of the risk characteristic corresponding to the risk characteristic information.
  • the classifier is classified by a decision tree, that is, in step S102, based on the decision tree, the category to which the current wind control event belongs is determined.
  • the at least part of the nodes of the decision tree include the risk characteristics corresponding to the respective risk feature information.
  • FIG. 3 is a schematic diagram of the foregoing decision tree according to an embodiment of the present application.
  • the decision tree contains five nodes, each node contains a risk feature and a standard value corresponding to the risk feature.
  • the leaf nodes of the decision tree are divided into two categories: category 1, category 2, and input decision tree.
  • category 1, category 2, and input decision tree The information is generally determined to belong to category 1 or belongs to category 2.
  • each risk characteristic information of the obtained current wind control event may be input into the decision tree to determine the category to which the current wind control event belongs.
  • F 1 >1 indicates that the risk feature contained in node 1 is denoted as F 1 , and the corresponding standard value is 1; when the risk characteristic information of the input F 1 is not greater than 1, The left branch of node 1 is selected, that is, the next node is node 2; when the risk characteristic information of the input F 1 is greater than 1, the right branch of node 1 is selected, that is, the next node is node 3.
  • the evidence importance representation value is denoted as FC k (f)
  • the category judgment contribution representation value is denoted as FC c (f)
  • the feature dimension contribution representation value is denoted as FC F (f)
  • the feature anomaly The characterization value is denoted as FO C (f), where f denotes a risk characteristic, and f may also represent risk trait information corresponding to the risk characteristic for a certain risk event. At least one determination manner of these several representative values is separately described.
  • FC k (f) For the evidence importance value FC k (f). It can generally be determined based on a priori domain knowledge, allowing domain experts to give each risk feature f the importance of subsequent proofs. For example, FC k (f) ⁇ [0, 1] can be defined. If the risk characteristic f is more important for subsequent evidence, the FC k (f) can be determined as the value interval [0, 1]. Value.
  • FC c (f) Determining, according to the manner, a category determination contribution representation value of the risk characteristic information of the current wind control event: determining, on the decision tree, a decision path corresponding to the result of the determination; according to the inclusion in the decision path Before and after the specific node, the concentration change information of the sample wind control event belonging to the specified category determines the category determination contribution representation value of the risk characteristic information of the current wind control event, and the specific node includes the risk feature corresponding to the risk characteristic information.
  • category 1 is a case category and category 2 is a non-case category
  • the above specified category may generally be a case category
  • the concentration change information of the sample wind control event belonging to the specified category is: case concentration change information
  • the case concentration can be, for example, the proportion of the case.
  • the case ratio is assumed. Assume that node 2 is on the decision path. Before node 2 filters, the proportion of sample wind control events is one tenth, and after filtering through node 2 The proportion of cases of sample wind control incidents has increased to one-half, and the increase from one tenth to one-half is used as the above-mentioned concentration change information.
  • the degree of case concentration increase can reflect the contribution of the risk characteristics contained in the node to the classification decision.
  • the contribution of the risk feature to the classification may be determined based on the contribution of the risk feature to the classification at least a portion of the nodes including the risk feature, based on all of the nodes included in the decision path.
  • the risk characteristics may be accumulated or weighted, respectively, at a portion of the nodes including the risk feature, contributions to the classification, and the like.
  • F is the set of risk features contained in the upstream node of node n
  • C(x) is the classification result of the current wind control event x
  • P n (y C(x)
  • F) is filtered by the upstream node and enters node n
  • the proportion of wind control events (eg, cases) of a specified category in each sample wind control event, P n (y C(x)
  • F, f) is the specified category in each sample wind control event filtered by node n
  • the proportion of risk control events (eg, cases).
  • the category determination contribution characterization value FC c (f) may specifically be:
  • R(x) is the decision path of the experience of x on the decision tree, and for node n on the decision path, the standard value of f contained is F n .
  • FIG. 4 is a schematic diagram of a decision path in the decision tree of FIG. 3 according to an embodiment of the present application.
  • each risk feature information of x is input to node 1, from node 1 to node 2, from node 2 to node 4, and from node 4 to the leaf node corresponding to category 2.
  • the category of the risk characteristic F 1 determines that the contribution characterization value is: FC 1 (F 1 )+FC 4 (F 1 ), that is, the risk characteristic information corresponding to the risk feature F 1 among the risk characteristic information of x
  • the category determination contribution representation value of the risk feature F 2 is: FC 2 (F 2 ), that is, the category determination contribution characterization corresponding to the risk feature information of the risk feature F 2 in each risk feature information of x Value; and risk characteristics F 3 , F 4 do not contribute to the category determination of x.
  • the decision tree on which the category of the current wind control event belongs may be determined, such as a random forest.
  • the category decision contribution can be separately determined for each decision tree, and then added or averaged as the category judgment contribution characterization value.
  • Equation 2 can be extended to get:
  • T is a random forest for class decision and t is a decision tree in T.
  • the contribution characterization value is determined for the class corresponding to the decision tree t calculated according to Equation 2.
  • the solution of the present application also provides a countermeasure, for example, by setting a virtual sample wind control event, so that the sample size can be maintained at a relatively good level.
  • the determining, according to the concentration change information of the sample wind control event of the specified category, before and after the specific node included in the decision path, determining the category determination contribution representation value of the risk characteristic information of the current wind control event includes: setting a virtual sample wind control event; determining a risk of the current wind control event according to concentration change information of a sample wind control event and a virtual sample wind control event belonging to a specified category before and after a specific node included in the decision path
  • the category of the feature information determines the contribution characterization value.
  • the virtual sample wind control event can be set according to a priori probability distribution, or it can be set randomly.
  • the setting of the virtual sample may include: setting a virtual sample according to a priori probability distribution assumed for the sample wind control event belonging to the specified category.
  • the mean is:
  • FC F (f) For the feature dimension contribution value FC F (f).
  • FC c (f) generally measures the risk characteristic f by filtering the sample risk event through the node containing the risk feature f in the decision path in the decision tree. The contribution of this is essentially a measure of the path in the decision tree. Further, the contribution of the risk feature f can also be measured independently of the path in the decision tree, for example, by FC F (f).
  • the feature dimension contribution representation value of the risk feature information of the current wind control event may be determined as follows: determining a plurality of sets corresponding to the risk feature corresponding to the risk feature information; determining the risk feature information in the a set of the plurality of sets; determining a feature dimension contribution representative value of the risk feature information according to the concentration of the sample wind control event belonging to the specified category corresponding to the belonging set; wherein the risk feature corresponds to any risk feature
  • the information belongs to at least one of the plurality of sets.
  • the risk characteristics may be numerical variables or non-numeric variables; accordingly, the risk characteristic information may be numerical or non-numeric.
  • the plurality of sets may specifically be a plurality of numerical intervals divided by the value range of the risk feature, and each set is one of the numerical intervals.
  • the numerical interval defined for the risk characteristic f is denoted as T F (f)
  • the degree of the case risk concentration of the current risk event x in the corresponding numerical interval can be regarded as the risk characteristic f.
  • the characteristic dimension contributes to the representation value, ie:
  • f(x) ⁇ T F (f))-P(y C(x));
  • f(x) is the risk characteristic information of x corresponding to the risk characteristic f
  • f(x) is the risk characteristic information of x corresponding to the risk characteristic f
  • P(y C(x)
  • f ⁇ T F (f)) is the case of x in the numerical interval Proportion
  • the numerical interval division can be implemented based on the quantization algorithm, and the quantization algorithm can be various, for example, uniform interval division, single variable decision tree, and the like.
  • the plurality of sets may be a plurality of non-numeric variable value sets divided by the non-numeric variable values corresponding to the risk feature, and each set is one of the non-numeric types.
  • non-numeric variables can be Categorical variables, string variables, and so on.
  • conditional probability on the f(x) value can be seen, and the characteristic dimension contribution representation value is calculated according to the conditional probability, wherein the conditional probability can be based on the case concentration mentioned above. Calculation. That is:
  • f C (x)).
  • FO C (f) For the characteristic anomaly characterization value FO C (f).
  • FO C (f) is a measure of contribution to this situation, and FO C (f) can be used to adjust FC c (f).
  • the feature abnormality representation value of the risk feature information of the current wind control event may be determined according to the following: according to the specific node included in the decision path, the sample belonging to the specified category Determining a situation of the wind control event, determining a characteristic abnormality representation value of the risk characteristic information of the current wind control event, wherein the specific node includes a risk feature corresponding to the risk feature information.
  • the feature anomaly characterization value can be determined based on the posterior probability:
  • FO C (f) ⁇ [0, 1] such that FO C (f) is of the same order of magnitude as FC c (f).
  • the characteristic anomaly characterization value can be used not only to adjust FC c (f), but also to adjust FC F (f). For distinguishing, it will be used to adjust the characteristic anomaly characterization value of FC F (f). Recorded as FO F (f).
  • f ⁇ f(x) ⁇ f ⁇ T F (f)), P(y C(x)
  • the factors enumerating several contribution characterization values that can be used to determine the risk characteristic information are described above in detail. Based on determining the characterization values of the various factors, the contribution characterization values of the risk trait information can be determined in a variety of ways. Two types of methods are listed: heuristic-based design, machine learning based on annotation samples. Explain the two types of methods separately.
  • the characterization value of the above factors can be comprehensively calculated by designing a suitable formula to obtain the contribution characterization value of the risk characteristic information.
  • FC(f) FC k (f) ⁇ [ ⁇ FO F (f) ⁇ FC F (f)+(1 ⁇ ) ⁇ FO C (f) ⁇ FC C (f)]; (Formula 9);
  • ⁇ is an adjustable weight coefficient
  • Machine learning based on annotation samples This approach mainly consists of two major steps:
  • a description vector can be constructed: [FC k (f i,j ), FO F (f i,j ), FC F (f i,j ), FO C (f i,j ) , FC c (f i,j )].
  • the index y i,j can be fitted by a suitable sorting model, such as rank-SVM, to obtain the contribution characterization value of the corresponding risk feature information.
  • the obtaining the evidence information corresponding to the result of the determination may specifically include: sorting the risk characteristic information according to the determined contribution representation value of each risk characteristic information; As a result, the evidence information corresponding to the N-large risk characteristic information of the contribution representation value is obtained as the evidence information corresponding to the result of the determination.
  • the threshold value of the contribution characterization value may be set in advance, and the evidence information corresponding to the risk characteristic information whose contribution characterization value is not less than the threshold value may be acquired as the evidence information corresponding to the result of the determination.
  • the evidence information may be processed based on a certain format template as part of the final generated settlement information.
  • the present application does not limit the format template, and may be a text format template, a tabular data format template, or a graph data format template.
  • the reliability of each subsequent step based on the result of the determination is also difficult to ensure. Therefore, it may be necessary to adjust the relevant parameters, and then re-determine the category to which the current wind control event belongs until the confidence level of the determined result reaches a higher level; or, instead, manually determine the category to which the current wind control event belongs. Among them, how high the confidence level needs to be reached can be pre-defined with the set threshold.
  • the method may further perform: calculating a confidence level of the result of the determining; determining that the confidence of the result of the determining is not less than Set the threshold.
  • the settlement information may include the result of the determination and the evidence information, and may also include other related information such as a confidence level.
  • the result of the determination, the evidence information, and the like may be assembled according to the preset settlement information template, so as to generate the settlement information, and the settlement information template may be defined according to a specific application scenario, which is not limited in this application.
  • the embodiment of the present application further provides a comparison diagram of the settlement information generated according to the above automatic risk control event automatic processing method and the settlement information in the prior art, as shown in FIG. 5 .
  • Figure 5 contains two sub-pictures: “Prior Art Manual Processing” and “Automatic Processing of the Solution of the Present Application”.
  • the settlement information includes three parts: a task remark, a model score, and a settlement testimony.
  • Wind Remarks describes the detailed information of the current wind control events, such as the user's mobile phone number, user gender, user's email address, some scene information obtained by direct communication with the user (such as family and friends are not used, etc.), the financial products involved, and Bank card number, the location where the bank card is opened, the status of the bank card, etc.
  • Model scores describe the scores of some of the models used in implementing the scheme of the present application, which may measure the function or performance of the model to some extent.
  • the model may be, for example, a model for a classifier, a model for determining a contribution characterization value, a model for obtaining evidence information, and the like.
  • the “Calculation Testimony” describes the results of the current wind control event determination and its confidence, and determines some of the risk characteristics information and its contribution representation value and corresponding evidence information.
  • the current wind control event is determined to belong to the non-case category with a confidence of 0.973.
  • the risk characteristic information used for the determination includes "equipment credibility", "city credibility”, and the like. Taking “equipment credibility” as an example, the contribution characterization value can be the evidence weight 0.653, and the corresponding evidence information is "history transaction 13 days, cumulative transaction 10 2461.6 yuan (the last transaction: Saudi purchasing genuine watch xxxx)"
  • the evidence information indicates that there are a large number of historical transactions on the user's current device, and thus it can be inferred that the current device is a common device of the user, and therefore, there is a greater probability that the device is a trusted device.
  • the solution of the present application can save manpower, speed up the processing speed of the wind control event, and facilitate more comprehensive consideration of multiple risk characteristic information,
  • the wind control event is judged; moreover, each piece of evidence information for supporting the result of the determination can be conveniently given, which is advantageous for the reliability of the result of the wind control event determination.
  • the embodiment of the present application further provides a corresponding device, as shown in FIG. 6 .
  • FIG. 6 is a schematic structural diagram of an apparatus for automatically processing a wind control event corresponding to FIG. 1 according to an embodiment of the present disclosure.
  • the apparatus may be located in an execution body of the process in FIG. 1, and includes:
  • the first obtaining module 601 acquires each risk characteristic information of the current wind control event
  • the determining module 602 determines, according to the risk attribute information, a category to which the current wind control event belongs;
  • the second obtaining module 603 is configured to obtain evidence information corresponding to the result of the determining
  • the generating module 604 is configured to generate settlement information of the current wind control event according to the result of the determining and the evidence information.
  • the determining module 602 determines, according to the risk information information, a category to which the current wind control event belongs, specifically:
  • the determining module 602 obtains a classifier trained according to the risk feature information of the sample wind control event, and determines the current wind control by classifying the current wind control event according to the classifier and the risk characteristic information. The category to which the event belongs.
  • the second obtaining module 603 is configured to obtain the evidence information corresponding to the result of the determining, which specifically includes:
  • the second obtaining module 603 determines a contribution characterization value of each risk feature information, and obtains evidence information corresponding to the result of the determination according to the contribution characterization value and the corresponding risk feature information.
  • the second obtaining module 603 determines a contribution characterization value of each risk feature information, specifically:
  • the second obtaining module 603 determines at least one specific characterization value of each of the risk characteristic information:
  • the classifier is classified by a decision tree, and at least a part of nodes of the decision tree include risk features corresponding to the respective risk feature information.
  • the second obtaining module 603 determines, according to the manner, a category determination contribution representation value of the risk feature information of the current wind control event:
  • the second obtaining module 603 determines, on the decision tree, a decision path corresponding to the result of the determining, according to the concentration change information of the sample wind control event belonging to the specified category before and after the specific node included in the decision path. Determining a category determination contribution representation value of the risk characteristic information of the current wind control event, the specific node including a risk feature corresponding to the risk characteristic information.
  • the second obtaining module 603 determines the category of the risk feature information of the current wind control event according to the concentration change information of the sample wind control event belonging to the specified category before and after the specific node included in the decision path. Determining the contribution representation value, specifically including:
  • the second obtaining module 603 sets a virtual sample wind control event, and determines the current according to the concentration change information of the sample wind control event and the virtual sample wind control event belonging to the specified category before and after the specific node included in the decision path.
  • the category of the risk characteristic information of the wind control event determines the contribution characterization value.
  • the second obtaining module 603 sets a virtual sample, specifically:
  • the second obtaining module 603 sets a virtual sample according to a prior probability distribution assumed for the sample wind control event belonging to the specified category.
  • the second obtaining module 603 determines a feature dimension contribution representation value of the risk feature information of the current wind control event according to the following manner:
  • the second obtaining module 603 determines a plurality of sets corresponding to the risk features corresponding to the risk feature information, and determines a set to which the risk feature information belongs in the plurality of sets, and belongs to the specified category according to the belonging set.
  • the concentration of the sample wind control event determines a feature dimension contribution representation value of the risk feature information, wherein any risk feature information corresponding to the risk feature belongs to at least one of the plurality of sets.
  • the second obtaining module 603 determines a feature abnormality representation value of the risk feature information of the current wind control event according to the following manner:
  • the second obtaining module 603 determines a characteristic anomaly representation of the risk feature information of the current wind control event according to a determination situation of a sample wind control event belonging to the specified category at a specific node included in the decision path. a value, the specific node includes a risk feature corresponding to the risk feature information.
  • the second obtaining module 603 is configured to obtain the evidence information corresponding to the result of the determining, which specifically includes:
  • the second obtaining module 603 sorts the risk characteristic information according to the determined contribution representative value of each risk characteristic information, and obtains the risk attribute information corresponding to the N largest contribution value according to the sorted result.
  • Evidence information as evidence information corresponding to the result of the determination.
  • the generating module 604 before the generating module 604 generates the settlement information of the current wind control event, calculating a confidence level of the result of the determining, determining that the confidence of the result of the determining is not less than a set threshold.
  • the category to which the current wind control event belongs is a case category or a non-case category.
  • the device and the method provided in the embodiments of the present application have a one-to-one correspondence. Therefore, the device also has similar beneficial technical effects as the corresponding method. Since the beneficial technical effects of the method have been described in detail above, the details are not described herein. A beneficial technical effect of the corresponding device.
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • HDL Hardware Description Language
  • the controller can be implemented in any suitable manner, for example, the controller can take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (eg, software or firmware) executable by the (micro)processor.
  • computer readable program code eg, software or firmware
  • examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, The Microchip PIC18F26K20 and the Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic.
  • the controller can be logically programmed by means of logic gates, switches, ASICs, programmable logic controllers, and embedding.
  • Such a controller can therefore be considered a hardware component, and the means for implementing various functions included therein can also be considered as a structure within the hardware component.
  • a device for implementing various functions can be considered as a software module that can be both a method of implementation and a structure within a hardware component.
  • the system, device, module or unit illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product having a certain function.
  • a typical implementation device is a computer.
  • the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or A combination of any of these devices.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology.
  • the information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device.
  • computer readable media does not include temporary storage of computer readable media, such as modulated data signals and carrier waves.
  • the application can be described in the general context of computer-executable instructions executed by a computer, such as a program module.
  • program modules include routines, programs, objects, components, data structures, and the like that perform particular tasks or implement particular abstract data types.
  • the present application can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network.
  • program modules can be located in both local and remote computer storage media including storage devices.

Abstract

一种风控事件自动处理方法及装置。所述方法包括：获取当前风控事件的各风险特征信息（S101）；根据所述各风险特征信息，判定所述当前风控事件所属的类别（S102）；获取所述判定的结果对应的证据信息（S103）；根据所述判定的结果和所述证据信息，生成所述当前风控事件的结案信息（S104）。利用本方法，可以实现风控事件的自动处理，进而有利于提高结案速度。不仅如此，由于可以自动获取风控事件判定的结果对应的证据信息，因此，有利于便利地核验风控事件判定结果的可靠性。

Description

一种风控事件自动处理方法及装置 技术领域
本申请涉及计算机软件技术领域，尤其涉及一种风控事件自动处理方法及装置。
背景技术
在风控平台上，每天都会接到很多用户来电报案，每一次报案的内容可以视为一次风控事件。风控平台的审理人员接手风控事件后会对其进行审理，具体地，审理人员通常根据用户在平台上的操作内容、环境、设备，对风控事件进行判定，比如，可以判定风控事件所属的类别(比如，案件类别、非案件类别等，不同的风控事件所存在的风险不同，一般可以将风险高到一定程度的风险事件称为案件，则其他的风险事件可以称为非案件)等，必要时还会与用户进行沟通确认，最终会生成一份该风控事件的结案信息，以对该风控事件结案。
但是，目前审理人员是以人工分析的方式进行风控事件判定，结案效率低下，不仅如此，风控事件判定结果的可靠性也难以核验。
发明内容
本申请实施例提供一种风控事件自动处理方法及装置，用以解决现有技术中的如下技术问题：安全风控平台的审理人员是以人工分析的方式进行风控事件判定，结案效率低下，不仅如此，风控事件判定结果的可靠性也难以核验。
为解决上述技术问题，本申请实施例是这样实现的：
本申请实施例提供的一种风控事件自动处理方法，包括：
获取当前风控事件的各风险特征信息；
根据所述各风险特征信息，判定所述当前风控事件所属的类别；
获取所述判定的结果对应的证据信息；
根据所述判定的结果和所述证据信息，生成所述当前风控事件的结案信 息。
本申请实施例提供的一种风控事件自动处理装置，包括：
第一获取模块，获取当前风控事件的各风险特征信息；
判定模块，根据所述各风险特征信息，判定所述当前风控事件所属的类别；
第二获取模块，获取所述判定的结果对应的证据信息；
生成模块，根据所述判定的结果和所述证据信息，生成所述当前风控事件的结案信息。
本申请实施例采用的上述至少一个技术方案能够达到以下有益效果：可以实现对风控事件的自动处理，进而有利于提高结案速度，不仅如此，由于可以自动获取风控事件判定的结果对应的证据信息，因此，有利于便利地核验风控事件判定结果的可靠性，可以部分或全部地解决现有技术中的问题。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请中记载的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本申请实施例提供的一种风控事件自动处理方法的流程示意图；
图2为本申请实施例提供的对应于图1的一种扩展流程示意图；
图3为本申请实施例提供的一种决策树的示意图；
图4为本申请实施例提供的在图3的决策树中的一种判决路径示意图；
图5为本申请实施例提供的按照上述风险控制事件自动处理方法所生成的结案信息与现有技术中的结案信息的对比示意图；
图6为本申请实施例提供的对应于图1的一种风控事件自动处理装置的结构示意图。
具体实施方式
本申请实施例提供一种风控事件自动处理方法及装置。
为了使本技术领域的人员更好地理解本申请中的技术方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都应当属于本申请保护的范围。
图1为本申请实施例提供的一种风控事件自动处理方法的流程示意图。从程序角度而言，该流程的执行主体可以是应用(APP)或个人计算机(PC)端程序等。从设备角度而言，该流程的执行主体可以包括但不限于以下设备：个人计算机、大中型计算机、计算机集群、手机、平板电脑、智能可穿戴设备、车机等。
图1中的流程可以包括以下步骤：
S101：获取当前风控事件的各风险特征信息。
在本申请实施例中，风控事件可以通过用户报案得到，也可以通过主动对某项业务进行监控得到。
以网购业务为例，当用户觉得自己的某笔网购交易存在问题时，可以针对该笔网购交易，向相应的风控平台报案，则该笔网购交易成为一个风控事件；当然，风控平台也可以主动监控用户的每笔网购交易，则每笔网购交易都成为一个风控事件。
在本申请实施例中，风险特征信息可以用于度量风险事件所存在的风险，因此，可以将风险特征信息作为对风险事件进行判定的依据。
风险特征信息对应的风险特征可以基于业务预先设计。仍以网购业务为例，风险特征比如可以是：用户之间的历史交易次数、用户交易时的所在地理位置、用户交易时所使用的设备等。在实际应用中，风险特征信息可以是其所对应的风险特征的具体取值，或者可用于确定所述具体取值的信息等。
在实际应用中，可以按照特定要求设计所使用的风险特征，以提高本申请的方案的效果。列举3个可能的对风险特征的特定要求如下：
“可判定”要求：即风险特征适合用于案件判定，其与案件风险类型相关。比如“用户之间的历史交易次数”，当该值很大时，意味着用户与交易对方较为熟悉，风险低，不太可能是案件；反之则风险较高，更有可能是案件。
“可理解”要求：即风险特征的含义易于理解。比如“用户之间的历史交易次数”有着非常明确的含义。
“可取证”要求：即风险特征可以对应到明确的证据信息，且该证据信息易于获取。比如“用户之间的历史交易次数”，可以明确且容易地获取到对应的每笔历史交易的信息，作为对应的证据信息。
S102：根据所述各风险特征信息，判定所述当前风控事件所属的类别。
在本申请实施例中，不同的风控事件所存在的风险不同，一般可以将风险高到一定程度的风险事件称为案件，则其他的风险事件可以称为非案件。基于这种前提，风控事件所属的类别可以是：案件类别或者非案件类别。
进一步地，案件类别或者非案件类别还可以进一步地细分，比如，案件类别可以细分为“设备丢失-案件”、“账号被盗-案件”类别；非案件类别可以细分为“熟人代用户操作-非案件”类别、“用户自己操作-非案件”类别等。
需要说明的是，按照是否是案件来划分风险事件仅是一种划分方式示例。也有其他的划分方式，比如，可以设定多个不同的风险等级类别，每个风控事件会被划分至各风险等级类别中的至少一个风险等级类别中，等等。
S103：获取所述判定的结果对应的证据信息。
在本申请实施例中，证据信息可以根据判定的过程获得，也可以根据各风险特征信息获得。证据信息比如可以是：判定的过程的明细信息，风险特征信息的明细信息等。假定某风险特征信息为：用户之间的历史交易次数为5次；则该风险特征信息的明细信息可以为：这5次交易的交易记录详情等。
若有需要，可以根据证据信息核验对应的风控事件判定结果的可靠性。
S104：根据所述判定的结果和所述证据信息，生成所述当前风控事件的结案信息。
在本申请实施例中，除了生成结案信息以外，还可以根据判定的结果，针 对当前风控事件执行应对措施。比如，若判定当前风控事件属于案件类别，则可以针对当前风控事件，执行诸如封禁交易账号、拒绝交易继续进行等应对措施，以保护交易安全。
通过图1的方法，可以实现风控事件的自动处理，进而有利于提高结案速度，不仅如此，由于可以自动获取风控事件判定的结果对应的证据信息，因此，有利于便利地核验风控事件判定结果的可靠性。
基于图1的方法，本申请实施例还提供了该方法的一些具体实施方案，以及扩展方案，下面进行说明。
在本申请实施例中，对步骤S102，所述根据所述各风险特征信息，判定所述当前风控事件所属的类别，具体可以包括：获得根据样本风控事件的风险特征信息训练得到的分类器；通过根据所述分类器以及所述各风险特征信息对所述当前风控事件进行分类，判定所述当前风控事件所属的类别。
分类器的实现方式有多种，比如，可以基于决策树实现分类器，可以基于神经网络实现分类器等。上述的分类器通常是基于多个样本风控事件预先训练得到的。
当然，要判定当前风控事件所属的类别，也未必要依靠上述的分类器。比如，可以预先设定风险特征信息黑名单，然后，将当前风控事件的各风险特征信息与该黑名单进行匹配，若匹配成功，则直接判定当前风控事件属于案件类别，等等。
在本申请实施例中，如前所述，可以根据各风险特征信息获得判定的结果对应的证据信息。在这种情况下，不同的风险特征信息往往对应于不同的证据信息，当风险特征较少时，可以不加选择地获取当前风险事件所有的风险特征信息所对应的证据信息，而当风险特征较多时，这样未必合适，因为会耗费较多的处理资源和时间，从而提升了成本。
考虑到这样的问题，可以有选择地只获取部分相对重要的风险特征信息所对应的证据信息。比如，在本申请实施例中，可以采用贡献表征值来度量风险特征信息的重要性，那么，对于步骤S103，所述获取所述判定的结果对应的证 据信息，具体可以包括：确定所述各风险特征信息的贡献表征值；根据所述贡献表征值及其对应的风险特征信息，获取所述判定的结果对应的证据信息。
进一步地，沿用上例，可以通过基于贡献表征值排序，或者与将贡献表征值与设定阈值比较等方式，确定所述部分相对比较重要的风险特征信息。
以基于贡献表征值排序的方式为例，所述获取所述判定的结果对应的证据信息，具体可以包括：根据确定的所述各风险特征信息的贡献表征值，对所述各风险特征信息进行排序；根据所述排序的结果，获取贡献表征值前N大的风险特征信息对应的证据信息，作为所述判定的结果对应的证据信息，其中，N为不小于1的整数。
按照上面的思路，可以将图1中的流程进行扩展，得到更详细的一种流程，如图2所示。
图2为本申请实施例提供的对应于图1的一种扩展流程示意图。
图2中的流程可以包括以下步骤：
获取当前风控事件的各风险特征信息；
根据所述各风险特征信息，判定所述当前风控事件所属的类别；
确定所述各风险特征信息的贡献表征值；
根据所述贡献表征值，对所述各风险特征信息进行排序；
根据所述排序的结果，获取贡献表征值前N大的风险特征信息对应的证据信息，作为所述判定的结果对应的证据信息；
根据所述判定的结果和所述证据信息，生成所述当前风控事件的结案信息。
图2中的流程相比于图1中的流程，重点在于风险特征信息的贡献表征值的确定，下面对此进行详细说明。
在本申请实施例中，可以基于一方面或多方面的因素，确定风险特征信息的贡献表征值。下面列出几种因素作为示例：
第一，证据重要性。如前所述，在判定风控事件所述的类别后，还要获取证据信息，也即，还需要举证。证据重要性可以反映风险特征信息所对应的证 据信息的重要性。
第二，类别判定贡献。类别判定贡献可以反映风险特征信息在判定风控事件所属类别的过程中的贡献。
第三，特征维度贡献。特征维度贡献可以反映风险特征信息对应的风险特征对判定风控事件所属类别的结果的贡献，该贡献可以不依赖于判定的过程。
第四，特征异常性。特征维度贡献可以反映风险特征信息的异常性。比如，可以是风险特征信息偏离判定的过程中所使用的标准值的程度等，其中，所述标准值用于与风险特征信息进行比较，以确定如何选择判定的过程中的分支。
上面的因素也可以用相应的表征值进行表示，从而便于运算。则以上述4种因素为例，所述确定所述各风险特征信息的贡献表征值，具体可以包括：确定所述各风险特征信息的以下至少一种特定表征值：证据重要性表征值、类别判定贡献表征值、特征维度贡献表征值、特征异常性表征值；根据确定出的各特定表征值，确定所述各风险特征信息的贡献表征值。
另外，对于风险特征信息已确定的风控事件而言，该风控事件的风险特征信息的贡献表征值即为：该风险特征信息对应的风险特征的贡献表征值。原因在于：此时该风控事件的风险特征并不是变量，而就是该风险特征信息本身。
为了便于理解，基于一种实际应用场景，对确定上述各表征值可采用的一种方案进行说明。
在该场景下，上述分类器是通过决策树进行分类的，也即，在步骤S102中，基于该决策树来判定当前风控事件所属的类别。其中，所述决策树的至少部分节点包含所述各风险特征信息对应的风险特征。
图3为本申请实施例提供的一种上述决策树的示意图。在图3中，决策树中包含有5个节点，每个节点包含一个风险特征及对应于该风险特征的标准值，决策树的叶节点分为类别1、类别2两种节点，输入决策树的信息一般会被判定属于类别1或者属于类别2，对于步骤S102，可以将获取的当前风控事件的各风险特征信息输入决策树，以判定当前风控事件所属的类别。
以节点1为例，节点1中的“F 1＞1”表示：节点1包含的风险特征记作F 1，对应的标准值为1；当输入的F 1的风险特征信息不大于1时，选择节点1的左分支，也即，下一个节点是节点2；当输入的F 1的风险特征信息大于1时，选择节点1的右分支，也即，下一个节点是节点3。
为了便于描述，将证据重要性表征值记作FC k(f)，将类别判定贡献表征值记作FC c(f)，将特征维度贡献表征值记作FC F(f)，将特征异常性表征值记作FO C(f)，其中，f表示风险特征，对于某个风险事件而言，f也可以表示该风险特征对应的风险特征信息。分别对这几种表征值的至少一种确定方式进行说明。
一、对于证据重要性表征值FC k(f)。一般可以基于先验的领域知识确定，可以让领域专家给出每个风险特征f对于后续举证的重要性。比如，可以定义FC k(f)∈[0,1]，若风险特征f对于后续举证的重要性越大，可以相应地将FC k(f)确定为取值区间[0,1]中越大的值。
二、对于类别判定贡献表征值FC c(f)。可以按照如下方式，确定所述当前风控事件的风险特征信息的类别判定贡献表征值：在所述决策树上，确定所述判定的结果对应的判决路径；根据在所述判决路径中包含的特定节点前后，属于指定类别的样本风控事件的浓度变化信息，确定所述当前风控事件的风险特征信息的类别判定贡献表征值，所述特定节点包含该风险特征信息对应的风险特征。
结合图3，假定类别1为案件类别，类别2为非案件类别，则上述的指定类别一般可以是案件类别，属于指定类别的样本风控事件的浓度变化信息即为：案件浓度变化信息。
案件浓度比如可以是案件比例等数据，以案件比例为例，假定节点2处于判决路径上，在节点2过滤前，样本风控事件的案件比例为十分之一，而在经过节点2过滤后，样本风控事件的案件比例提升到二分之一，而从十分之一到二分之一的提升即可作为上述的浓度变化信息。
在经过判决路径上包含的某个节点后，案件浓度提升的程度可以反映该节点中包含的风险特征的对于分类判决的贡献程度。对于任任意风险特征，根据判决路径上所包含的全部节点中，该风险特征分别在包含该风险特征的至少部分节点处的对于分类的贡献，可以确定该风险特征对于分类的贡献。具体如何确定可以有多种方式，比如，可以累加或加权相加该风险特征分别在包含该风险特征的至少部分节点处的对于分类的贡献等。
为了便于理解，用公式进行说明。
对于决策树上的节点n，假定节点n包含有风险特征f，且节点n包含在判决路径中，类别有两种，分别用y＝0和y＝1表示，则风险特征f在节点n处对于分类的贡献为：
Figure PCTCN2018078164-appb-000001
其中，F是节点n的上游节点包含的风险特征集合，C(x)为当前风控事件x的分类结果，P n(y＝C(x)|F)为经过上游节点过滤后进入节点n的各样本风控事件中指定类别的风控事件(比如，案件)的比例，P n(y＝C(x)|F,f)为经过节点n过滤后的各样本风控事件中指定类别的风控事件(比如，案件)的比例。
进一步地，可以累加判决路径上的各节点对应的贡献得到：
对于风险特征f，类别判定贡献表征值FC c(f)具体可以为：
Figure PCTCN2018078164-appb-000002
其中，R(x)是x在决策树上的经历的判决路径，对于在判决路径上的节点n，其包含的f的标准值为F n。
图4为本申请实施例提供的在图3的决策树中的一种判决路径示意图。
在图4中，对于x，经历的判决路径为：x的各风险特征信息输入到节点1，由节点1到节点2，由节点2到节点4，由节点4到类别2对应的叶节点。则根据公式2，风险特征F 1的类别判定贡献表征值为：FC 1(F 1)+FC 4(F 1)，即为x的各风险特征信息中对应于风险特征F 1的风险特征信息的类别判定贡献表征值； 风险特征F 2的类别判定贡献表征值为：FC 2(F 2)，即为x的各风险特征信息中对应于风险特征F 2的风险特征信息的类别判定贡献表征值；而风险特征F 3、F 4对于x的类别判定无贡献。
进一步地，在实际应用中，对于步骤S102，判定当前风控事件所属的类别时所基于的决策树可能有多棵，比如，随机森林等。对于这种情况，可以分别针对每棵决策树分别确定类别判定贡献，再相加或者取平均值，作为类别判定贡献表征值。
以取平均值为例，可以对公式2进行扩展，得到：
Figure PCTCN2018078164-appb-000003
其中，T为用于类别判决的随机森林，t为T中的决策树，
Figure PCTCN2018078164-appb-000004
为按照公式2计算的对应于决策树t的类别判定贡献表征值。
更进一步地，在实际应用中，对于决策树，接近叶节点时，样本风控事件的数量会逐渐减少，由此可能导致概率估计不准确，进而影响确定出的类别判定贡献表征值的可靠性。对于该问题，本申请的方案也提供的应对措施，比如，可以通过设置虚拟样本风控事件，使得样本数量可以维持在一个相对好的水平。
具体地，所述根据在所述判决路径中包含的特定节点前后，属于指定类别的样本风控事件的浓度变化信息，确定所述当前风控事件的风险特征信息的类别判定贡献表征值，可以包括：设置虚拟样本风控事件；根据在所述判决路径中包含的特定节点前后，属于指定类别的样本风控事件和虚拟样本风控事件的浓度变化信息，确定所述当前风控事件的风险特征信息的类别判定贡献表征值。
虚拟样本风控事件的具体设置方式可以有多种，比如，可以按照先验的概率分布设置，也可以随机设置等。以前一种方式为例，所述设置虚拟样本，具体可以包括：根据为所述属于指定类别的样本风控事件所假设的先验的概率分 布，设置虚拟样本。
例如，假定指定类别的样本风控事件为案件，假设案件概率p服从先验Beta分布：
Figure PCTCN2018078164-appb-000005
其中，p的均值为
Figure PCTCN2018078164-appb-000006
方差为
Figure PCTCN2018078164-appb-000007
假定观测了m个样本风控事件，其中，案件有z个，则案件概率p的后验分布为Beta分布，参数为：
α'＝α+z，β'＝β+m-z；
均值为：
Figure PCTCN2018078164-appb-000008
由此可以，通过假定的先验Beta分布，相当于设置了α+β个虚拟样本事件，其中，案件有α个。为了提高可靠性，在实际应用中，设置虚拟样本事件中的案件比例可以与实际的样本事件的案件比例p 0相同，假定共设置虚拟样本事件m 0个，则：
α＝m 0·p 0，β＝m 0·(1-p 0)。(公式5)
三、对于特征维度贡献表征值FC F(f)。沿用图3的例子进行说明，如上所述，上面的FC c(f)一般是通过决策树中判决路径中的包含风险特征f的节点过滤样本风险事件后，案件浓度的提升来度量风险特征f的贡献的，这本质上是依赖决策树中的路径的度量方式。进一步地，也可以不依赖于决策树中的路径，对风险特征f的贡献进行度量，比如，用FC F(f)度量。
具体地，可以按照如下方式，确定所述当前风控事件的风险特征信息的特征维度贡献表征值：确定该风险特征信息对应的风险特征所对应的多个集合；确定该风险特征信息在所述多个集合中所属的集合；根据所述所属的集合对应的属于指定类别的样本风控事件的浓度，确定该风险特征信息的特征维度贡献表征值；其中，所述风险特征对应的任意风险特征信息属于所述多个集合中的 至少一个集合。
在实际应用中，风险特征可能是数值型变量，也可能是非数值型变量；相应地，风险特征信息可能为数值，也可能是非数值。
当风险特征为数值型变量时，所述多个集合具体可以是由风险特征的取值范围划分出的多个数值区间，每个集合为其中一个数值区间。
比如，当风险特征f为数值型变量时，针对风险特征f划分出的数值区间记作T F(f)，可以将当前风险事件x在所属数值区间中案件浓度提升的程度，作为风险特征f的特征维度贡献表征值，也即：
FC F(f)＝P(y＝C(x)|f(x)∈T F(f))-P(y＝C(x))；(公式6)
其中，f(x)为x的对应于风险特征f的风险特征信息，在这里为数值，P(y＝C(x)|f∈T F(f))为x在所属数值区间中的案件比例，P(y＝C(x))为全区间中的案件比例。
数值区间划分可以基于量化算法实现，量化算法可以有多种，比如，均匀区间划分，单变量决策树等。
当风险特征为非数值型变量时，所述多个集合具体可以是由风险特征对应的各非数值型变量值划分出的多个非数值型变量值集合，每个集合为其中一个非数值型变量值集合。其中，非数值型变量可以是Categorical(类别)变量、字符串变量等。
又比如，当风险特征f为Categorical(类别)变量时，可以看f(x)取值上的条件概率，根据该条件概率计算特征维度贡献表征值，其中，该条件概率可以根据上述的案件浓度计算。也即：
FC F(f)＝P(y＝C(x)|f＝C(x))。
四、对于特征异常性表征值FO C(f)。根据上面的说明可知，在确定类别判定贡献表征值FC c(f)时，只要落在决策树的同一个节点下的同一分支，则在该节点处的FO C(f)都是相同的。然而，应当考虑：比如，对于若某节点为f＞10时， 则f＝10.1和f＝10000的贡献显然是不一样的。FO C(f)正是针对这种情况的贡献度量因素，可以用FO C(f)来调整FC c(f)。
在本申请实施例中，可以按照如下方式，确定所述当前风控事件的风险特征信息的特征异常性表征值：根据在所述判决路径的中包含的特定节点处，对属于指定类别的样本风控事件的判定情况，确定所述当前风控事件的风险特征信息的特征异常性表征值，所述特定节点包含该风险特征信息对应的风险特征。
进一步地，上一段中的方式有多种具体实现方案。比如，可以基于后验概率确定特征异常性表征值：
FO C(f)＝max[P(y＝C(x)|f≥f(x)∩f∈N(f)),P(y＝C(x)|f＜f(x)∩f∈N(f))]；(公式7)
其中，N(f)是判决路径上风险特征f所决定的空间，以图3中的判决路径为例，N(F 1)＝(F 1＞1)∩(F 1＞4)＝F 1＞4。另外，公式7的一个好处在于，让FO C(f)∈[0,1]，从而使得FO C(f)与FC c(f)在同一量级。
在实际应用中，特征异常性表征值不仅可以用于调整FC c(f)，也可以用于调整FC F(f)，为了区分，将用于调整FC F(f)的特征异常性表征值记作FO F(f)。
可以按照类似的方式计算FO F(f)：
FO F(f)＝max[P(y＝C(x)|f≥f(x)∩f∈T F(f)),P(y＝C(x)|f＜f(x)∩f∈T F(f))]；(公式8)。
上面分别对列举几种可用于确定风险特征信息的贡献表征值的因素进行了详细说明。基于确定各因素的表征值，可以采用多种方式确定风险特征信息的贡献表征值。列举两类方式：基于启发式的设计、基于标注样本的机器学习。分别对这两类方式进行说明。
基于启发式设计。可以通过设计合适的公式，把上述各因素的表征值综合计算得到风险特征信息的贡献表征值。比如：
FC(f)＝FC k(f)·[λ·FO F(f)·FC F(f)+(1-λ)·FO C(f)·FC C(f)]；(公式9)；
其中，λ为可调的权重系数。
基于标注样本的机器学习。这种方式主要包括两大步骤：
1、标注样本获取；可以采样一些案件和非案件，由专家对这些样本的风险特征的相关性或样本之间的相关性进行评级。这样就获得了一个标注数据集，其包含样本x i的风险特征f i,j，以及相关性标签y i,j。
学习方法：当拥有标注数据集{(x i，f i,j，y i,j)，1≤i≤N,1≤j≤K}，对于样本x i及其风险特征f i,j，可以根据上述各因素的表征值，构成一个描述向量：[FC k(f i,j),FO F(f i,j),FC F(f i,j),FO C(f i,j),FC c(f i,j)]。这是一个典型的排序学习(learning-to-rank)的问题，可以通过适当的排序模型，比如rank-SVM来拟合标注y i,j，从而获得对应的风险特征信息的贡献表征值。
进一步地，对于步骤S103，获取所述判定的结果对应的证据信息，具体可以包括：根据确定的所述各风险特征信息的贡献表征值，对所述各风险特征信息进行排序；根据所述排序的结果，获取贡献表征值前N大的风险特征信息对应的证据信息，作为所述判定的结果对应的证据信息。或者，也可以不排序，而是预先设定贡献表征值的阈值，获取贡献表征值不小于该阈值的风险特征信息对应的证据信息，作为所述判定的结果对应的证据信息。
在实际应用中，在获取到证据信息后，可以基于一定的格式模板处理证据信息，以作为最终生成的结案信息的一部分。本申请对所述格式模板并不做限定，可以是文本格式模板，也可以是表格数据格式模板或图数据格式模板等。
在本申请实施例中，在基于决策树判定当前风控事件所属的类别的情况下，还有相应的方案可以计算判定的结果的置信度。
若判定的结果的置信度较低，则基于判定的结果的各后续步骤的可靠性也难以保证。因此，可能需要调整相关的参数后，再重新判定当前风控事件所属的类别，直至判定的结果的置信度达到较高的程度；或者，转为采用人工方式判定当前风控事件所属的类别。其中，置信度具体需要达到多高程度可以用设 定阈值预先定义。
根据上一段中的分析，对于步骤S104，所述生成所述当前风控事件的结案信息前，还可以执行：计算所述判定的结果的置信度；确定所述判定的结果的置信度不小于设定阈值。
计算置信度的方案有多种。比如，针对当前风控事件在判决路径上落到的叶节点，确定落到该叶节点的各样本风控事件被正确分类的后验概率，作为置信度；又比如，对于随机森林，计算当前风控事件在该随机森林中各决策树中的判定的结果中，数量最多结果所占比例，作为置信度；等等。
在本申请实施例中，对于步骤S104，结案信息可以包含判定的结果和证据信息，还可以包含置信度等其他的相关信息。一般地，可以按照预设的结案信息模板，对判定的结果、证据信息等信息进行拼装，从而生成结案信息，结案信息模板可以根据具体的应用场景定义，本申请不做限定。
更直观地，本申请实施例还提供了按照上述风险控制事件自动处理方法所生成的结案信息与现有技术中的结案信息的对比示意图，如图5所示。
图5中包含两个子图：“现有技术人工处理”和“本申请的方案自动处理”。
在图5中的上侧，可以看到，在现有技术中，由于是人工处理，所以结案信息比较简单，主要是对当前风控事件“某用户在2015-06-18 10:48:09购买裙子”进行了简单说明，以及给出了判定结果“非案件”，结案信息中包含的信息较少。
在图5中的下侧，可以看到，基于本申请的方案，生成了一份比较详细的结案信息，结案信息中包括：任务备注、模型分值、结案证词这三部分。
“任务备注”描述了当前风控事件的详细信息，比如，用户手机号码、用户性别、用户邮箱、与用户直接沟通获取的一些场景信息(如家人朋友都未使用等)、涉及的理财产品和银行卡号、银行卡的开户所在地、银行卡的状态等。
“模型分值”描述了在实施本申请的方案时所使用的一些模型的分值，该分值一定程度上可以度量模型的功能或性能。所述模型比如可以是用于分类器模型、用于确定贡献度表征值的模型、用于获取证据信息的模型等。
“结案证词”描述了对当前风控事件判定的结果及其置信度，判定所涉及的部分风险特征信息及其贡献表征值和对应的证据信息等。
具体地，当前风控事件被判定为属于非案件类别，置信度为0.973。判定所使用的风险特征信息包括“设备可信程度”、“城市可信程度”等。以“设备可信程度”为例，其贡献表征值可以为证据权重0.653，对应的证据信息为“历史交易13天，累计交易10笔2461.6元(最后一笔交易：沙特代购正品手表xxxx)”，该证据信息表明在用户的当前设备上历史交易数量较多，由此可以推测当前设备是该用户的常用设备，因此，有较大概率是可信设备。
基于图5中对现有技术和本申请的方案的对比，可以看出：本申请的方案可以节省人力，加快对风控事件的处理速度；有利于更全面地考虑多种风险特征信息，以对风控事件进行判定；而且，可以便利地给出用于支持判定的结果的各证据信息，有利于风控事件判定的结果的可靠性。
上面为本申请实施例提供的一种风控事件自动处理方法，基于同样的发明思路，本申请实施例还提供了对应的装置，如图6所示。
图6为本申请实施例提供的对应于图1的一种风控事件自动处理装置的结构示意图，该装置可以位于图1中流程的执行主体，包括：
第一获取模块601，获取当前风控事件的各风险特征信息；
判定模块602，根据所述各风险特征信息，判定所述当前风控事件所属的类别；
第二获取模块603，获取所述判定的结果对应的证据信息；
生成模块604，根据所述判定的结果和所述证据信息，生成所述当前风控事件的结案信息。
可选地，所述判定模块602根据所述各风险特征信息，判定所述当前风控事件所属的类别，具体包括：
所述判定模块602获得根据样本风控事件的风险特征信息训练得到的分类器，通过根据所述分类器以及所述各风险特征信息对所述当前风控事件进行分类，判定所述当前风控事件所属的类别。
可选地，所述第二获取模块603获取所述判定的结果对应的证据信息，具体包括：
所述第二获取模块603确定所述各风险特征信息的贡献表征值，根据所述贡献表征值及其对应的风险特征信息，获取所述判定的结果对应的证据信息。
可选地，所述第二获取模块603确定所述各风险特征信息的贡献表征值，具体包括：
所述第二获取模块603确定所述各风险特征信息的以下至少一种特定表征值：
证据重要性表征值、类别判定贡献表征值、特征维度贡献表征值、特征异常性表征值；
根据确定出的各特定表征值，确定所述各风险特征信息的贡献表征值。
可选地，所述分类器是通过决策树进行分类的，所述决策树的至少部分节点包含所述各风险特征信息对应的风险特征。
可选地，所述第二获取模块603按照如下方式，确定所述当前风控事件的风险特征信息的类别判定贡献表征值：
所述第二获取模块603在所述决策树上，确定所述判定的结果对应的判决路径，根据在所述判决路径中包含的特定节点前后，属于指定类别的样本风控事件的浓度变化信息，确定所述当前风控事件的风险特征信息的类别判定贡献表征值，所述特定节点包含该风险特征信息对应的风险特征。
可选地，所述第二获取模块603根据在所述判决路径中包含的特定节点前后，属于指定类别的样本风控事件的浓度变化信息，确定所述当前风控事件的风险特征信息的类别判定贡献表征值，具体包括：
所述第二获取模块603设置虚拟样本风控事件，根据在所述判决路径中包含的特定节点前后，属于指定类别的样本风控事件和虚拟样本风控事件的浓度变化信息，确定所述当前风控事件的风险特征信息的类别判定贡献表征值。
可选地，所述第二获取模块603设置虚拟样本，具体包括：
所述第二获取模块603根据为所述属于指定类别的样本风控事件所假设的 先验的概率分布，设置虚拟样本。
可选地，所述第二获取模块603按照如下方式，确定所述当前风控事件的风险特征信息的特征维度贡献表征值：
所述第二获取模块603确定该风险特征信息对应的风险特征所对应的多个集合，确定该风险特征信息在所述多个集合中所属的集合，根据所述所属的集合对应的属于指定类别的样本风控事件的浓度，确定该风险特征信息的特征维度贡献表征值，其中，所述风险特征对应的任意风险特征信息属于所述多个集合中的至少一个集合。
可选地，所述第二获取模块603按照如下方式，确定所述当前风控事件的风险特征信息的特征异常性表征值：
所述第二获取模块603根据在所述判决路径的中包含的特定节点处，对属于指定类别的样本风控事件的判定情况，确定所述当前风控事件的风险特征信息的特征异常性表征值，所述特定节点包含该风险特征信息对应的风险特征。
可选地，所述第二获取模块603获取所述判定的结果对应的证据信息，具体包括：
所述第二获取模块603根据确定的所述各风险特征信息的贡献表征值，对所述各风险特征信息进行排序，根据所述排序的结果，获取贡献表征值前N大的风险特征信息对应的证据信息，作为所述判定的结果对应的证据信息。
可选地，所述生成模块604生成所述当前风控事件的结案信息前，计算所述判定的结果的置信度，确定所述判定的结果的置信度不小于设定阈值。
可选地，所述当前风控事件所属的类别为案件类别或者非案件类别。
本申请实施例提供的装置与方法是一一对应的，因此，装置也具有与其对应的方法类似的有益技术效果，由于上面已经对方法的有益技术效果进行了详细说明，因此，这里不再赘述对应装置的有益技术效果。
在20世纪90年代，对于一个技术的改进可以很明显地区分是硬件上的改进(例如，对二极管、晶体管、开关等电路结构的改进)还是软件上的改进(对于方法流程的改进)。然而，随着技术的发展，当今的很多方法流程的改进已 经可以视为硬件电路结构的直接改进。设计人员几乎都通过将改进的方法流程编程到硬件电路中来得到相应的硬件电路结构。因此，不能说一个方法流程的改进就不能用硬件实体模块来实现。例如，可编程逻辑器件(Programmable Logic Device,PLD)(例如现场可编程门阵列(Field Programmable Gate Array，FPGA))就是这样一种集成电路，其逻辑功能由用户对器件编程来确定。由设计人员自行编程来把一个数字系统“集成”在一片PLD上，而不需要请芯片制造厂商来设计和制作专用的集成电路芯片。而且，如今，取代手工地制作集成电路芯片，这种编程也多半改用“逻辑编译器(logic compiler)”软件来实现，它与程序开发撰写时所用的软件编译器相类似，而要编译之前的原始代码也得用特定的编程语言来撰写，此称之为硬件描述语言(Hardware Description Language，HDL)，而HDL也并非仅有一种，而是有许多种，如ABEL(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL(Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language)等，目前最普遍使用的是VHDL(Very-High-Speed Integrated Circuit Hardware Description Language)与Verilog。本领域技术人员也应该清楚，只需要将方法流程用上述几种硬件描述语言稍作逻辑编程并编程到集成电路中，就可以很容易得到实现该逻辑方法流程的硬件电路。
控制器可以按任何适当的方式实现，例如，控制器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式，控制器的例子包括但不限于以下微控制器：ARC 625D、Atmel AT91SAM、Microchip PIC18F26K20以及Silicone Labs C8051F320，存储器控制器还可以被实现为存储器的控制逻辑的一部分。本领域技术人员也知道，除了以纯计算机可读程序代码方式实现控制器以外，完全可以通过将方法步骤进行逻辑编程来使得控制 器以逻辑门、开关、专用集成电路、可编程逻辑控制器和嵌入微控制器等的形式来实现相同功能。因此这种控制器可以被认为是一种硬件部件，而对其内包括的用于实现各种功能的装置也可以视为硬件部件内的结构。或者甚至，可以将用于实现各种功能的装置视为既可以是实现方法的软件模块又可以是硬件部件内的结构。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机。具体的，计算机例如可以为个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任何设备的组合。
为了描述的方便，描述以上装置时以功能分为各种单元分别描述。当然，在实施本申请时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个 流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本申请可以在由计算机执行的计算机可执行指令的一般上下文中描述，例 如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本申请，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (26)

  1. 一种风控事件自动处理方法，其特征在于，包括：
    获取当前风控事件的各风险特征信息；
    根据所述各风险特征信息，判定所述当前风控事件所属的类别；
    获取所述判定的结果对应的证据信息；
    根据所述判定的结果和所述证据信息，生成所述当前风控事件的结案信息。
  2. 如权利要求1所述的方法，其特征在于，所述根据所述各风险特征信息，判定所述当前风控事件所属的类别，具体包括：
    获得根据样本风控事件的风险特征信息训练得到的分类器；
    通过根据所述分类器以及所述各风险特征信息对所述当前风控事件进行分类，判定所述当前风控事件所属的类别。
  3. 如权利要求2所述的方法，其特征在于，所述获取所述判定的结果对应的证据信息，具体包括：
    确定所述各风险特征信息的贡献表征值；
    根据所述贡献表征值及其对应的风险特征信息，获取所述判定的结果对应的证据信息。
  4. 如权利要求3所述的方法，其特征在于，所述确定所述各风险特征信息的贡献表征值，具体包括：
    确定所述各风险特征信息的以下至少一种特定表征值：
    证据重要性表征值、类别判定贡献表征值、特征维度贡献表征值、特征异常性表征值；
    根据确定出的各特定表征值，确定所述各风险特征信息的贡献表征值。
  5. 如权利要求4所述的方法，其特征在于，所述分类器是通过决策树进行分类的，所述决策树的至少部分节点包含所述各风险特征信息对应的风险特征。
  6. 如权利要求5所述的方法，其特征在于，按照如下方式，确定所述当前风控事件的风险特征信息的类别判定贡献表征值：
    在所述决策树上，确定所述判定的结果对应的判决路径；
    根据在所述判决路径中包含的特定节点前后，属于指定类别的样本风控事件的浓度变化信息，确定所述当前风控事件的风险特征信息的类别判定贡献表征值，所述特定节点包含该风险特征信息对应的风险特征。
  7. 如权利要求6所述的方法，其特征在于，所述根据在所述判决路径中包含的特定节点前后，属于指定类别的样本风控事件的浓度变化信息，确定所述当前风控事件的风险特征信息的类别判定贡献表征值，具体包括：
    设置虚拟样本风控事件；
    根据在所述判决路径中包含的特定节点前后，属于指定类别的样本风控事件和虚拟样本风控事件的浓度变化信息，确定所述当前风控事件的风险特征信息的类别判定贡献表征值。
  8. 如权利要求7所述的方法，其特征在于，所述设置虚拟样本，具体包括：
    根据为所述属于指定类别的样本风控事件所假设的先验的概率分布，设置虚拟样本。
  9. 如权利要求4所述的方法，其特征在于，按照如下方式，确定所述当前风控事件的风险特征信息的特征维度贡献表征值：
    确定该风险特征信息对应的风险特征所对应的多个集合；
    确定该风险特征信息在所述多个集合中所属的集合；
    根据所述所属的集合对应的属于指定类别的样本风控事件的浓度，确定该风险特征信息的特征维度贡献表征值；
    其中，所述风险特征对应的任意风险特征信息属于所述多个集合中的至少一个集合。
  10. 如权利要求5所述的方法，其特征在于，按照如下方式，确定所述当前风控事件的风险特征信息的特征异常性表征值：
    根据在所述判决路径的中包含的特定节点处，对属于指定类别的样本风控事件的判定情况，确定所述当前风控事件的风险特征信息的特征异常性表征值，所述特定节点包含该风险特征信息对应的风险特征。
  11. 如权利要求3所述的方法，其特征在于，获取所述判定的结果对应的证据信息，具体包括：
    根据确定的所述各风险特征信息的贡献表征值，对所述各风险特征信息进行排序；
    根据所述排序的结果，获取贡献表征值前N大的风险特征信息对应的证据信息，作为所述判定的结果对应的证据信息。
  12. 如权利要求1所述的方法，其特征在于，所述生成所述当前风控事件的结案信息前，所述方法还包括：
    计算所述判定的结果的置信度；
    确定所述判定的结果的置信度不小于设定阈值。
  13. 如权利要求1～12任一项所述的方法，其特征在于，所述当前风控事件所属的类别为案件类别或者非案件类别。
  14. 一种风控事件自动处理装置，其特征在于，包括：
    第一获取模块，获取当前风控事件的各风险特征信息；
    判定模块，根据所述各风险特征信息，判定所述当前风控事件所属的类别；
    第二获取模块，获取所述判定的结果对应的证据信息；
    生成模块，根据所述判定的结果和所述证据信息，生成所述当前风控事件的结案信息。
  15. 如权利要求14所述的装置，其特征在于，所述判定模块根据所述各风险特征信息，判定所述当前风控事件所属的类别，具体包括：
    所述判定模块获得根据样本风控事件的风险特征信息训练得到的分类器，通过根据所述分类器以及所述各风险特征信息对所述当前风控事件进行分类，判定所述当前风控事件所属的类别。
  16. 如权利要求15所述的装置，其特征在于，所述第二获取模块获取所 述判定的结果对应的证据信息，具体包括：
    所述第二获取模块确定所述各风险特征信息的贡献表征值，根据所述贡献表征值及其对应的风险特征信息，获取所述判定的结果对应的证据信息。
  17. 如权利要求16所述的装置，其特征在于，所述第二获取模块确定所述各风险特征信息的贡献表征值，具体包括：
    所述第二获取模块确定所述各风险特征信息的以下至少一种特定表征值：
    证据重要性表征值、类别判定贡献表征值、特征维度贡献表征值、特征异常性表征值；
    根据确定出的各特定表征值，确定所述各风险特征信息的贡献表征值。
  18. 如权利要求17所述的装置，其特征在于，所述分类器是通过决策树进行分类的，所述决策树的至少部分节点包含所述各风险特征信息对应的风险特征。
  19. 如权利要求18所述的装置，其特征在于，所述第二获取模块按照如下方式，确定所述当前风控事件的风险特征信息的类别判定贡献表征值：
    所述第二获取模块在所述决策树上，确定所述判定的结果对应的判决路径，根据在所述判决路径中包含的特定节点前后，属于指定类别的样本风控事件的浓度变化信息，确定所述当前风控事件的风险特征信息的类别判定贡献表征值，所述特定节点包含该风险特征信息对应的风险特征。
  20. 如权利要求19所述的装置，其特征在于，所述第二获取模块根据在所述判决路径中包含的特定节点前后，属于指定类别的样本风控事件的浓度变化信息，确定所述当前风控事件的风险特征信息的类别判定贡献表征值，具体包括：
    所述第二获取模块设置虚拟样本风控事件，根据在所述判决路径中包含的特定节点前后，属于指定类别的样本风控事件和虚拟样本风控事件的浓度变化信息，确定所述当前风控事件的风险特征信息的类别判定贡献表征值。
  21. 如权利要求20所述的装置，其特征在于，所述第二获取模块设置虚拟样本，具体包括：
    所述第二获取模块根据为所述属于指定类别的样本风控事件所假设的先验的概率分布，设置虚拟样本。
  22. 如权利要求17所述的装置，其特征在于，所述第二获取模块按照如下方式，确定所述当前风控事件的风险特征信息的特征维度贡献表征值：
    所述第二获取模块确定该风险特征信息对应的风险特征所对应的多个集合，确定该风险特征信息在所述多个集合中所属的集合，根据所述所属的集合对应的属于指定类别的样本风控事件的浓度，确定该风险特征信息的特征维度贡献表征值，其中，所述风险特征对应的任意风险特征信息属于所述多个集合中的至少一个集合。
  23. 如权利要求18所述的装置，其特征在于，所述第二获取模块按照如下方式，确定所述当前风控事件的风险特征信息的特征异常性表征值：
    所述第二获取模块根据在所述判决路径的中包含的特定节点处，对属于指定类别的样本风控事件的判定情况，确定所述当前风控事件的风险特征信息的特征异常性表征值，所述特定节点包含该风险特征信息对应的风险特征。
  24. 如权利要求16所述的装置，其特征在于，所述第二获取模块获取所述判定的结果对应的证据信息，具体包括：
    所述第二获取模块根据确定的所述各风险特征信息的贡献表征值，对所述各风险特征信息进行排序，根据所述排序的结果，获取贡献表征值前N大的风险特征信息对应的证据信息，作为所述判定的结果对应的证据信息。
  25. 如权利要求14所述的装置，其特征在于，所述生成模块生成所述当前风控事件的结案信息前，计算所述判定的结果的置信度，确定所述判定的结果的置信度不小于设定阈值。
  26. 如权利要求14～25任一项所述的装置，其特征在于，所述当前风控事件所属的类别为案件类别或者非案件类别。
PCT/CN2018/078164 2017-03-09 2018-03-06 一种风控事件自动处理方法及装置 WO2018161900A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
JP2019524436A JP6869347B2 (ja) 2017-03-09 2018-03-06 リスク制御イベント自動処理の方法および装置
EP18763193.2A EP3525121A4 (en) 2017-03-09 2018-03-06 METHOD AND DEVICE FOR AUTOMATIC PROCESSING OF RISK CONTROL EVENTS
KR1020197013394A KR102249712B1 (ko) 2017-03-09 2018-03-06 리스크 제어 이벤트 자동 처리 방법 및 장치
PH12019501032A PH12019501032A1 (en) 2017-03-09 2019-05-09 Risk control event automatic processing method and apparatus
US16/421,133 US20190279129A1 (en) 2017-03-09 2019-05-23 Risk control event automatic processing method and apparatus
US17/461,111 US20210390471A1 (en) 2017-03-09 2021-08-30 Risk control event automatic processing method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710136278.5A CN108596410B (zh) 2017-03-09 2017-03-09 一种风控事件自动处理方法及装置
CN201710136278.5 2017-03-09

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/421,133 Continuation US20190279129A1 (en) 2017-03-09 2019-05-23 Risk control event automatic processing method and apparatus

Publications (1)

Publication Number Publication Date
WO2018161900A1 true WO2018161900A1 (zh) 2018-09-13

Family

ID=63447332

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/078164 WO2018161900A1 (zh) 2017-03-09 2018-03-06 一种风控事件自动处理方法及装置

Country Status (8)

Country Link
US (2) US20190279129A1 (zh)
EP (1) EP3525121A4 (zh)
JP (1) JP6869347B2 (zh)
KR (1) KR102249712B1 (zh)
CN (1) CN108596410B (zh)
PH (1) PH12019501032A1 (zh)
TW (1) TW201833851A (zh)
WO (1) WO2018161900A1 (zh)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110008986B (zh) * 2019-02-19 2023-05-12 创新先进技术有限公司 批量风险案件识别方法、装置及电子设备
CN110348806A (zh) * 2019-06-26 2019-10-18 阿里巴巴集团控股有限公司 应对突发事件的方法和装置
CN110753032B (zh) * 2019-09-24 2021-11-16 支付宝(杭州)信息技术有限公司 一种风险维度组合挖掘方法、装置及设备
CN111178452B (zh) * 2020-01-02 2020-10-13 平安科技（深圳）有限公司 驾驶风险识别方法、电子装置及可读存储介质
CN111260223A (zh) * 2020-01-17 2020-06-09 山东省计算中心（国家超级计算济南中心） 一种审判风险智能识别与预警方法、系统、介质及设备
CN111582722B (zh) * 2020-05-09 2022-06-07 拉扎斯网络科技（上海）有限公司 风险识别方法、装置、电子设备及可读存储介质
CN112116028B (zh) * 2020-09-29 2024-04-26 联想(北京)有限公司 模型决策解释实现方法、装置及计算机设备
CN113111333B (zh) * 2021-04-15 2022-03-04 广东省林业科学研究院 一种快检平台用远程交互系统
CN115170304B (zh) * 2022-06-22 2023-03-28 支付宝(杭州)信息技术有限公司 风险特征描述的提取方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104091073A (zh) * 2014-07-11 2014-10-08 中国人民解放军国防科学技术大学 虚拟资产不平衡交易数据的采样方法
CN105991609A (zh) * 2015-03-02 2016-10-05 阿里巴巴集团控股有限公司 一种风险事件确定方法及装置
CN106033515A (zh) * 2015-03-16 2016-10-19 阿里巴巴集团控股有限公司 欺诈事件的识别方法和装置
US20170039637A1 (en) * 2015-08-05 2017-02-09 Telefonica Digital Espana, S.L.U. Computer-implemented method, a system and computer program products for assessing the credit worthiness of a user

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2001073652A1 (en) * 2000-03-24 2001-10-04 Access Business Group International Llc System and method for detecting fraudulent transactions
US7246102B2 (en) * 2001-12-21 2007-07-17 Agere Systems Inc. Method of improving the lookup performance of three-type knowledge base searches
JP2009528634A (ja) * 2006-03-01 2009-08-06 タウンセンド・アナリティクス・リミテッド リスク管理のための方法およびシステム
CN1835014A (zh) * 2006-03-28 2006-09-20 阿里巴巴公司 一种对在线业务进行风险监控的方法及系统
JP4905086B2 (ja) * 2006-11-29 2012-03-28 富士通株式会社 イベント種類推定システム、イベント種類推定方法およびイベント種類推定プログラム
US8489499B2 (en) * 2010-01-13 2013-07-16 Corelogic Solutions, Llc System and method of detecting and assessing multiple types of risks related to mortgage lending
US20130185180A1 (en) * 2012-01-18 2013-07-18 Bank Of America Corporation Determining the investigation priority of potential suspicious events within a financial institution
US20140156340A1 (en) * 2012-12-03 2014-06-05 Bank Of America Corporation System and method for identifying outlier risks
US20140250011A1 (en) * 2013-03-01 2014-09-04 Lance Weber Account type detection for fraud risk
US9811830B2 (en) * 2013-07-03 2017-11-07 Google Inc. Method, medium, and system for online fraud prevention based on user physical location data
US11188916B2 (en) * 2014-03-28 2021-11-30 First Data Resources, Llc Mitigation of fraudulent transactions conducted over a network
US9904916B2 (en) * 2015-07-01 2018-02-27 Klarna Ab Incremental login and authentication to user portal without username/password
CN106157132A (zh) * 2016-06-20 2016-11-23 中国工商银行股份有限公司 信用风险监控系统及方法
US10586235B2 (en) * 2016-06-22 2020-03-10 Paypal, Inc. Database optimization concepts in fast response environments

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104091073A (zh) * 2014-07-11 2014-10-08 中国人民解放军国防科学技术大学 虚拟资产不平衡交易数据的采样方法
CN105991609A (zh) * 2015-03-02 2016-10-05 阿里巴巴集团控股有限公司 一种风险事件确定方法及装置
CN106033515A (zh) * 2015-03-16 2016-10-19 阿里巴巴集团控股有限公司 欺诈事件的识别方法和装置
US20170039637A1 (en) * 2015-08-05 2017-02-09 Telefonica Digital Espana, S.L.U. Computer-implemented method, a system and computer program products for assessing the credit worthiness of a user

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3525121A4 *

Also Published As

Publication number Publication date
EP3525121A1 (en) 2019-08-14
TW201833851A (zh) 2018-09-16
JP2020501232A (ja) 2020-01-16
EP3525121A4 (en) 2019-10-23
CN108596410A (zh) 2018-09-28
KR20190075083A (ko) 2019-06-28
CN108596410B (zh) 2021-01-22
US20190279129A1 (en) 2019-09-12
PH12019501032A1 (en) 2019-12-11
JP6869347B2 (ja) 2021-05-12
KR102249712B1 (ko) 2021-05-11
US20210390471A1 (en) 2021-12-16

Similar Documents

Publication Publication Date Title
WO2018161900A1 (zh) 一种风控事件自动处理方法及装置
TWI718643B (zh) 異常群體識別方法及裝置
TWI769190B (zh) 風險管控方法及裝置
KR101939554B1 (ko) 일시적 거래 한도 결정
CN107563757B (zh) 数据风险识别的方法及装置
WO2019157946A1 (zh) 一种反洗钱方法、装置及设备
TW201928841A (zh) 訓練風控模型和風控的方法、裝置及設備
TWI745589B (zh) 風險特徵篩選、描述報文產生方法、裝置以及電子設備
TWI687841B (zh) 待處理業務的風險識別方法及裝置、電子設備
US20200034749A1 (en) Training corpus refinement and incremental updating
WO2015135452A1 (en) Text information processing method and apparatus
TW201905773A (zh) 車險風險預測方法、裝置及伺服器
US20120136812A1 (en) Method and system for machine-learning based optimization and customization of document similarities calculation
TW201913441A (zh) 模型安全檢測方法、裝置以及電子設備
CN109711440A (zh) 一种数据异常检测方法和装置
CN110069545B (zh) 一种行为数据评估方法及装置
CN110929799A (zh) 用于检测异常用户的方法、电子设备和计算机可读介质
TW201931150A (zh) 社交內容風險識別方法、裝置及設備
CN107622413A (zh) 一种价格敏感度计算方法、装置及其设备
CN111898675B (zh) 信贷风控模型生成方法、装置、评分卡生成方法、机器可读介质及设备
CN111126623A (zh) 一种模型更新方法、装置及设备
CN109684477A (zh) 一种专利文本特征提取方法及系统
WO2020155831A1 (zh) 数据标签生成、模型训练、事件识别方法和装置
CN105786929A (zh) 一种信息监测方法及装置
CN115456801A (zh) 个人信用的人工智能大数据风控系统、方法和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18763193

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 20197013394

Country of ref document: KR

Kind code of ref document: A

Ref document number: 2019524436

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2018763193

Country of ref document: EP

Effective date: 20190509

NENP Non-entry into the national phase

Ref country code: DE