WO2020253348A1 - 异常信息识别方法、装置、计算机设备及存储介质 - Google Patents

异常信息识别方法、装置、计算机设备及存储介质 Download PDF

Info

Publication number
WO2020253348A1
WO2020253348A1 PCT/CN2020/085569 CN2020085569W WO2020253348A1 WO 2020253348 A1 WO2020253348 A1 WO 2020253348A1 CN 2020085569 W CN2020085569 W CN 2020085569W WO 2020253348 A1 WO2020253348 A1 WO 2020253348A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
abnormal
characteristic information
rule
preset
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/085569
Other languages
English (en)
French (fr)
Inventor
向纯玉
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
OneConnect Smart Technology Co Ltd
Original Assignee
OneConnect Smart Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by OneConnect Smart Technology Co Ltd filed Critical OneConnect Smart Technology Co Ltd
Publication of WO2020253348A1 publication Critical patent/WO2020253348A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/03—Credit; Loans; Processing thereof

Definitions

  • This application relates to the field of data analysis, and in particular to an abnormal information identification method, device, computer equipment and storage medium.
  • this application provides an abnormal information identification method, device, computer equipment, and storage medium, which are used to automatically and timely discover that a user has a credit crisis, improve the accuracy and efficiency of monitoring abnormal behavior of users, and also improve In order to determine the efficiency and speed of abnormality, the user can stop loss in time.
  • a method for identifying abnormal information including:
  • the rule engine is selected according to the abnormal rule matching the characteristic information, the abnormal rule matching the characteristic information is invoked through the selected rule engine, and the characteristic information is processed through the invoked abnormal rule Corresponding to the information object, and obtain the output processing result; the processing result includes an abnormality;
  • the characteristic information of the abnormal party whose processing result is abnormal is sent to a preset management party.
  • An abnormal information recognition device including:
  • An information acquisition module for acquiring characteristic information of a user, and constructing an information table according to the characteristic information
  • the change detection module is used to detect whether the preset key information in the characteristic information of the same user has been changed through the information table;
  • the marking module is used to mark the user as an abnormal party when the preset key information in the characteristic information of the same user has been changed;
  • the allocation module is used to call the distributed computing engine to traverse the information table, and after the characteristic information of all the abnormal parties in the information table is distributed, allocate each group of the abnormal The feature information of the party is converted into an information object;
  • the rule matching module is used to obtain a preset abnormal rule set, and determine the abnormal rule matching the characteristic information in the information object in the abnormal rule set;
  • the abnormal information identification module is configured to select a rule engine according to the abnormal rule matching the characteristic information, call the abnormal rule matching the characteristic information through the selected rule engine, and use the called abnormal Rule processing of the information object corresponding to the characteristic information, and obtain an output processing result; the processing result includes an abnormality;
  • the sending module is configured to send the characteristic information of the abnormal party whose processing result is abnormal to a preset management party.
  • a computer device includes a memory, a processor, and a computer program that is stored in the memory and can run on the processor, and the processor implements the steps of the abnormal information identification method when the computer program is executed.
  • a computer-readable storage medium that stores a computer program that, when executed by a processor, implements the steps of the abnormal information identification method.
  • the above-mentioned abnormal information identification method, device, computer equipment and storage medium utilize distributed computing engine to perform distributed processing on a large amount of user data (that is, the characteristic information in the information table), and at the same time, select abnormal rules and The rule engine then uses the rule engine to call the selected exception rules to evaluate whether the user has an abnormality.
  • a third-party financial institution replaces the user for repayment for various reasons (abnormality)
  • it can automatically and timely find that the user has occurred
  • the credit crisis has improved the accuracy and efficiency of monitoring users' abnormal behaviors, and at the same time improved the efficiency and speed of determining abnormalities, thereby promptly stopping losses for users.
  • FIG. 1 is a schematic diagram of an application environment of an abnormal information identification method in an embodiment of the present application
  • Fig. 2 is a flowchart of a method for identifying abnormal information in an embodiment of the present application
  • step S10 of the method for identifying abnormal information in an embodiment of the present application
  • step S50 is a flowchart of step S50 of the method for identifying abnormal information in an embodiment of the present application
  • FIG. 5 is a flowchart of a method for identifying abnormal information in another embodiment of the present application.
  • Fig. 6 is a flowchart of a method for identifying abnormal information in another embodiment of the present application.
  • FIG. 7 is a schematic diagram of an abnormal information identification device in an embodiment of the present application.
  • Fig. 8 is a schematic diagram of an information acquisition module of an abnormal information identification device in an embodiment of the present application.
  • FIG. 9 is a schematic diagram of a rule matching module of an abnormal information identification device in an embodiment of the present application.
  • Fig. 10 is a schematic diagram of a computer device in an embodiment of the present application.
  • the abnormal information identification method provided by this application can be applied in the application environment as shown in Fig. 1, where the client (computer equipment/terminal equipment) communicates with the server (server) through the network. Distributed processing is performed on a large amount of user data (that is, the characteristic information in the information table) using a distributed computing engine, and an abnormal rule and a rule engine are selected according to the characteristic information of the user, and then the selected abnormal rule evaluation is invoked through the rule engine Whether the user is abnormal.
  • the client includes, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices.
  • the server can be implemented as an independent server or a server cluster composed of multiple servers.
  • a method for identifying abnormal information is provided, and the method is applied to the server in FIG. 1 as an example for description, including the following steps:
  • S10 Acquire characteristic information of the user, and construct an information table according to the characteristic information.
  • the user may be a person who applies for a loan from a bank through a third-party financial agency such as a channel party or an intermediary, because in this application scenario, it is mainly aimed at monitoring various channel parties or intermediaries and other third parties Whether the financial agency has fraudulent behavior that replaces the user to repay the bank, therefore, in this embodiment, the range of the user needs to be limited, so that in the data collection process, only the limited range of all the information needs to be obtained
  • the feature information is described to prevent data redundancy, and improve the acquisition efficiency and subsequent data processing efficiency.
  • the characteristic information refers to various personal information and identity information that the user needs to provide when applying for a loan, including but not limited to mobile phone number, bank card number used to receive loans, bank card number used to repay loans, and other Contacts other than the user (mainly relatives, but also friends), ID number, home address, work unit and other information.
  • the characteristic information may be obtained from data such as application information entered when the user applies for a loan, approval records when the bank approves the loan, and the user's repayment flow.
  • the information table is a data table storing the characteristic information.
  • the information table may be an information wide table, and the information wide table is a multi-field database table, which is a data table constructed by associating business-related indicators, dimensions, attributes, etc., that is, The information wide table contains multiple related fields. It must be noted that, in this embodiment, what is acquired is the characteristic information of multiple users. According to the acquired characteristic information of all users, the information wide table is constructed, and the massive amount of characteristic information is integrated into one The wide table is used to quickly retrieve the required data in the subsequent steps to improve the execution efficiency of the subsequent steps.
  • the feature information has 3 items of information, namely mobile phone number, bank card number, and ID number. Then, each item of information is used as a dimension to construct 3 data tables and store the 3 data tables associatively.
  • the database In this embodiment, multiple data tables are constructed through multiple dimensions, and each data table stores only one item of characteristic information, which can avoid data redundancy and improve query efficiency.
  • S20 Through the information table, detect whether preset key information in the characteristic information of the same user has been changed.
  • the preset key information is information preset by the user according to actual conditions or needs.
  • the characteristic information includes a mobile phone number, an ID number, and a bank card number, and according to the above three characteristics The importance of the information and the importance to the user, the ID number and bank card number can be set as preset key information for subsequent testing.
  • only the preset key information is set to be detected, because according to historical data, the possibility of non-preset key information being changed is high, and after the user's non-preset key information is changed, the user The possibility of abnormality is low. Therefore, only detecting the preset key information can improve the detection efficiency and improve the accuracy of identifying the fraud of the user.
  • the detecting whether the preset key information in the feature information of the same user has changed that is, it is detected whether the preset key information in the feature information of the same user has been changed after the feature information is entered. Specifically, by retrieving the information table, all the feature information of the same user is obtained, and then it is detected whether the preset key information in the feature information of the user has been changed, when the preset key information in the feature information of the user has been changed.
  • step S30 is entered; when the preset key information in the user's characteristic information has not been changed, it means that the probability of the abnormality of the user is very low. At this time, it is confirmed that the user is not abnormal.
  • the preset key information in the feature information of the same user has been changed after the user entered the information, it represents that the user has changed the feature information that may have a significant impact on whether the repayment is scheduled, such as the repayment bank card number .
  • the characteristic information such as the repayment person, that is, the user may be at risk of fraud.
  • the user is marked as an abnormal party to distinguish users whose preset key information in other characteristic information has not been changed, so that In the subsequent steps, the abnormal party is further evaluated for abnormality.
  • the distributed computing engine is an engine based on distributed computing.
  • the distributed computing is a computing method as opposed to centralized computing.
  • the distributed processing of the distributed computing engine can be roughly divided into the following steps : Data reading, data calculation and data storage; the distributed computing can decompose huge data (information table) into many relatively small data (the characteristic information of each group of the abnormal party), and distribute them to multiple Computer processing can improve the efficiency of data processing.
  • the distributed computing engine is called to traverse the information table, and after the characteristic information of different abnormal parties in the information table is distributed, each group (or groups) of characteristic information is allocated to different computers.
  • each group of feature information after being distributed by the distributed computing engine may not be directly processed by the exception rules obtained in the subsequent steps, it is necessary to assign each group of the abnormal
  • the feature information of the party is transformed into an information object that can be directly processed by the business rules obtained subsequently (ie Po, Persisent Object, persistent object), and then the feature information in the information object can be further distributed. deal with.
  • a large amount of user data that is, the feature information in the information table
  • is processed in a distributed manner by using the call of the distributed computing engine which can improve the processing efficiency, and further improve the efficiency and speed of abnormality determination.
  • S50 Obtain a preset abnormal rule set, and determine an abnormal rule in the abnormal rule set that matches the characteristic information in the information object;
  • the abnormal rules in the abnormal rule set are selected as follows: the owner of the user's mobile phone number in the characteristic information is not the user corresponding to the characteristic information; the contact person in the characteristic information There is no immediate family member of the user corresponding to the characteristic information; the card owner of the repayment bank card number in the characteristic information is not the user corresponding to the characteristic information; when the user is a company, the company in the characteristic information has been cancelled and dissolved by industry and commerce Kind or more.
  • the abnormal rules in the abnormal rule set can be preset by the user according to actual conditions and requirements.
  • the characteristic information in the information object contains all the information to be input that needs to be input in the abnormal rule (all the characteristic information required for the abnormal rule processing to obtain the corresponding processing result), when the characteristic information in the information object
  • the feature information contains all the information to be input that needs to be entered in the exception rule (for example, an exception rule in the exception rule set is: the owner of the user's mobile phone number in the feature information is not the user corresponding to the feature information; and the information in the information object
  • the characteristic information contains the user’s mobile phone number, the owner information of the user’s mobile phone number, and the user’s personal information of the characteristic information.
  • an abnormality rule matching the characteristic information in the information object is determined for processing the characteristic information according to the abnormality rule in a subsequent step.
  • the corresponding rule engine is selected according to the abnormal rule matching the characteristic information in the information object, and then the abnormal rule is invoked through the selected rule engine (that is, the abnormal rule matching the characteristic information) , And process the information object corresponding to the characteristic information through the called exception rule, and obtain the output processing result, the processing result including the presence and absence of abnormality. Obtain the outputted processing result, so as to screen out the abnormal parties that are actually abnormal from the abnormal parties that may have abnormalities accordingly, for subsequent further determination and analysis.
  • This embodiment evaluates whether the user has an abnormality based on the characteristic information, instead of evaluating whether the user has an abnormality based on whether the user has repaid in full or/and whether the user has repaid on time. It can be replaced by a third-party financial institution for various reasons. When the user repays (that is, helps users who do not pay in full and in time to conceal fraud), the user can also be found in a timely manner that the user has a credit crisis, that is, an abnormality, so that the bank can take early countermeasures and reduce the number of banks. Loss.
  • S70 Send the characteristic information of the abnormal party whose processing result is abnormal to a preset management party.
  • the characteristic information of the abnormal party with the abnormality is sent to the preset management party, and the management party further verifies the abnormal abnormality based on the characteristic information. Whether the party has in fact been unable to repay, or has in fact no longer repaid the bank in full and on time, but has been replaced by a third-party financial agency.
  • the management party may be preset according to actual needs, and may be the abnormal control department of the bank, or the loan fraud processing department of the bank.
  • the management party obtains the characteristic information of the abnormal party with the abnormality, it can contact by telephone, query and analyze the repayment record, query personal credit information and other information to determine whether the abnormal party with the abnormality has actually appeared.
  • the loan cannot be repaid, or the loan has not been repaid in full on time, thereby improving the accuracy of testing the user's repayment credit, improving the efficiency of testing users, and reducing bank losses.
  • a distributed computing engine is used to perform distributed processing on a large amount of user data (that is, the characteristic information in the information table), and at the same time, an abnormal rule and a rule engine are selected according to the characteristic information of the user, and then the selected rule engine is called
  • the exception rule evaluates whether the user is abnormal.
  • a third-party financial institution replaces the user for repayment for various reasons (abnormality)
  • it can automatically and promptly find that the user has a credit crisis, which improves the user’s repayment credit
  • the accuracy and efficiency of monitoring have also improved the efficiency and speed of determining abnormalities, and thus timely stop losses for users.
  • the step S10 includes:
  • S101 Acquire characteristic information of a user and the time when the characteristic information is generated or updated, and normalize fields with the same meaning in the characteristic information.
  • the user is a person who applies for a loan from a bank through a third-party financial agency such as a channel party or an intermediary, and the feature information is collected by a third-party financial agency when the user applies for a loan.
  • the bank s requirements, its own actual situation, and the information requested from users.
  • different third-party financial agencies may require users to provide feature information with different names, but the names have the same meaning. For example: the same It is the ID number, which may be called the certificate number in the agency A and the identity number in the agency B.
  • the time when the characteristic information is generated refers to the time when the user enters the characteristic information
  • the time when the characteristic information is updated refers to the time when the user updates the characteristic information previously entered.
  • the meanings of the fields may be the same. Therefore, for storage convenience and to construct a concise information table, in this embodiment , Normalize the names of the fields with the same meaning in the feature information, for example: in all the obtained feature information, the meaning is the field of the bank card number, which may have different names, such as bank card number , Account number. At this time, normalize the names of the two fields with the same meaning as bank card number and account number. For example, normalize the "account number" field to the "bank card number” field, or the "bank card number” field and The "account” field is normalized to the "A" field, etc.
  • the normalization form can be multiple, that is, as long as the fields with the same meaning but not the same are converted into the same field, this application does not specifically limit it.
  • the fields with the same meaning in the feature information are normalized, so as to construct a concise and efficient information table in the subsequent steps, and improve storage and query efficiency.
  • S102 according to the normalized feature information, construct an information table in the order of the time when the feature information is generated or updated.
  • the characteristic information may change according to the actual situation of the corresponding user. For example, when the home address of the corresponding user changes, the characteristic information changes accordingly. When the contact information changes, the characteristic information will also change accordingly. Understandably, every time the characteristic information changes, the time of the change will be recorded, or when the user enters the characteristic information for the first time, The time entered will also be recorded.
  • the normalized feature information is sorted in chronological order according to its corresponding entry time or change time, and the information table is constructed.
  • the query efficiency can be improved, and the feature information can be compared intuitively in time through the information table to detect Whether the feature information changes with time, thereby improving the efficiency of detecting whether the user's feature information has changed.
  • the step S50 includes:
  • S501 Detect whether there are zero abnormal rules in the abnormal rule set that match the characteristic information of the information object. Understandably, there may be zero, one, or two or more abnormal rules in the abnormal rule set that match the user's heart of the information object, and it is checked whether they are zero for use in subsequent steps. Select alternative exception rules for the information object to deal with it. In this embodiment, when there are one or more abnormal rules in the set of abnormal rules that match the characteristic information of the information object, all the rules that match the characteristic information of the information object are selected. The abnormal rule is confirmed as the abnormal rule of the rule engine to be matched, so that it can be matched with the corresponding rule engine in the subsequent steps.
  • the replacement exception rule is any exception rule that can process the information object after some processing in the set of exception rules.
  • S503 According to the conversion relationship between the feature information in the information object and the feature information to be input that is required to replace the exception rule, call a preset custom function and interceptor, and use the self
  • the definition function and the interceptor convert the characteristic information in the information object into the characteristic information to be input, and at the same time confirm that the replacement exception rule matches the characteristic information to be input in the information object.
  • the feature information to be input is the feature information that needs to be input to replace the abnormal rule.
  • the preset custom function through the Java plug-in interface, and input the characteristic information in the information object into the custom function for running calculations, and obtain the output calculation results, the calculation results It is composed of multiple sub-objects.
  • the pre-configured interceptor is called through the Java plug-in interface to intercept the preset behavior objects in the operation result, and all operation results except the preset behavior object
  • the other sub-objects are confirmed as the feature information to be input.
  • the feature information in the information object is converted into the feature information to be input.
  • the replacement exception rule and all the features in the information object The feature information to be input matches.
  • an alternative exception rule can be determined in the set of exception rules that can still obtain a processing result matching the abnormal party, so that even when there is no exception rule matching the characteristic information of the information object
  • the information object is processed to obtain the processing result of the information object.
  • the method further includes:
  • S80 Acquire characteristic information of all users processed by the same agent in the information table.
  • the agent is the agent bank loan business, a third-party financial agency that lends to the bank or introduces/provides users, such as various channel parties, intermediaries, and financial companies.
  • the characteristic information of all users processed by the same agent in the information table is acquired, so that in the subsequent steps, according to the acquired characteristic information, it is evaluated whether the agent is abnormal, that is, whether it will be When the user handled by the agent actually loses the ability to repay, or has a long-term insufficient amount to repay the loan on schedule, out of considerations such as obtaining intermediary fees and increasing the agent’s credit rating in the bank, repay the loan for the user handled by the agent , In order to deceive the bank's fraud.
  • S90 When the characteristic information of the user processed by the same agent meets a preset abnormal situation, evaluate that the agent has an abnormality; the preset abnormal situation includes: two or more users processed by the same agent The repayment card number is the same; the repayment time of the preset number of users processed by the same agent is concentrated in one or more of the preset time periods;
  • the preset abnormal situation may be preset by the user according to actual conditions.
  • several of the preset abnormal scenarios are described below: following the above-mentioned embodiment, two or more users processed by the same agent have the same repayment card number.
  • the probability that two people use the same bank card number is very low, so when two or more users are repaid by the same agent
  • the card number is the same, it means that the agent is likely to repay the loan on behalf of multiple users who do not repay, so the agent is abnormal; the repayment time of the preset number of users processed by the same agent is concentrated in the preset
  • the preset number can be preset according to the actual situation, for example, set 10; the preset time period can be pre-defined by the user according to the actual situation, for example, within 1 minute is the preset time period
  • the agent is not a bank, and the number of customers cannot reach the number of bank customers.
  • the preset abnormal situation can be preset by the user in combination with the actual situation, as long as it can be analyzed to determine that the agent is abnormal, and the specific content and form are not specifically limited in this application.
  • the evaluating whether the agent has an abnormality specifically, firstly, according to the characteristic information of all users processed by the same agent, it is determined whether it meets the preset abnormal situation, and when the result is yes, the agent can be determined Fang has an abnormality. For example, taking the preset abnormal scenarios listed above as an example, based on the characteristic information of all users processed by the same agent, it is determined whether two or more users processed by the same agent have the same repayment card number. When the judgment result is yes, it means that the preset abnormal scenario that appears in the preset abnormal scenario has occurred. At this time, it can be confirmed that the agent has an abnormality.
  • the method further includes:
  • S100 Detect whether the number of abnormal parties with abnormalities processed by the same agent is greater than a preset abnormality threshold.
  • the abnormal threshold may be preset according to actual conditions, for example, according to the number of users of the agent.
  • the abnormal party with abnormality is the abnormal user. If the number of abnormal users processed by the same agent reaches a certain number, it means that the agent is likely to be abnormal. Therefore, in this embodiment Detecting that the number of abnormal parties with abnormalities processed by the same agent exceeds the abnormality threshold, so as to determine whether the agent is abnormal in subsequent steps.
  • the agent When the number of abnormal parties processed by the same agent exceeds the abnormal threshold, it means that the number of abnormal parties processed by the agent has exceeded a certain value, that is, the agent may be abnormal At this time, it is confirmed that the agent is abnormal; when the number of abnormal parties processed by the same agent is less than or equal to the abnormal threshold, it means that the agent is more likely to be abnormal. Low, at this time, confirm that there is no abnormality in the agent, or send a summary of the situation to a preset management party for judgment by the management party.
  • This embodiment performs data monitoring on all users processed by the same agent. By horizontally comparing whether the number of fraudulent abnormal parties processed by the same agent exceeds a preset abnormality threshold, it is determined whether the agent is abnormal. In order to perform abnormality management and control in time when the agent is abnormal, such as suspending loans to users processed by the agent, which reduces the bank's losses. This solution can further improve the efficiency of monitoring whether the agent is abnormal.
  • This application uses a distributed computing engine to perform distributed processing on a large amount of user data (that is, the characteristic information in the information table), and at the same time, select an exception rule and a rule engine according to the user's characteristic information, and then call the selected exception through the rule engine
  • the rule evaluates whether a user has an abnormality, so that when a third-party financial institution repays the user for various reasons (abnormality), it can automatically and promptly find that the user has a credit crisis, which improves the user's repayment credit monitoring
  • the accuracy and efficiency of the system also improve the efficiency and speed of determining abnormalities, and then stop losses in time for users.
  • an abnormal information identification device is provided, and the abnormal information identification device corresponds to the abnormal information identification method in the above-mentioned embodiment one-to-one.
  • the abnormal information identification device includes an information acquisition module 11, a change detection module 12, a marking module 13, an allocation module 14, a rule matching module 15, an abnormal information identification module 16 and a sending module 17.
  • the detailed description of each functional module is as follows:
  • the information acquisition module 11 is configured to acquire characteristic information of a user, and construct an information table according to the characteristic information;
  • the change detection module 12 is configured to detect whether the preset key information in the characteristic information of the same user has been changed through the information table;
  • the marking module 13 is configured to mark the user as an abnormal party when the preset key information in the characteristic information of the same user has been changed;
  • the allocation module 14 is used to call a distributed computing engine to traverse the information table, and after the characteristic information of all the abnormal parties in the information table is distributed, allocate each group The characteristic information of the abnormal party is converted into an information object;
  • the rule matching module 15 is configured to obtain a preset abnormal rule set, and determine an abnormal rule in the abnormal rule set that matches the characteristic information in the information object;
  • the abnormal information identification module 16 is configured to select a rule engine according to the abnormal rule matching the characteristic information, call the abnormal rule matching the characteristic information through the selected rule engine, and call The abnormality rule processes the information object corresponding to the characteristic information, and obtains an output processing result; the processing result includes an abnormality;
  • the sending module 17 is configured to send the characteristic information of the abnormal party whose processing result is abnormal to a preset management party.
  • the information acquisition module 11 includes:
  • the normalization unit 111 is used to obtain the characteristic information of the user and the time when the characteristic information is generated or updated, and normalize the fields with the same meaning in the characteristic information;
  • the constructing unit 112 is configured to construct an information table according to the normalized characteristic information in the order of the time sequence when the characteristic information is generated or updated.
  • the rule matching module 15 includes:
  • the quantity detecting unit 151 is configured to detect whether the number of abnormal rules matching the characteristic information of the information object in the abnormal rule set is zero;
  • the replacement acquiring unit 152 is configured to acquire the replacement exception rule in the exception rule set and acquire the replacement exception rule when the number of exception rules matching the characteristic information of the information object in the exception rule set is zero.
  • the rule conversion unit 153 is configured to call a preset custom function and interceptor according to the conversion relationship between the characteristic information in the information object and the characteristic information to be input required to replace the abnormal rule, And convert the characteristic information in the information object into the characteristic information to be input through the custom function and the interceptor, and at the same time confirm that the replacement exception rule and the characteristic information to be input in the information object match.
  • Each module in the above-mentioned abnormal information identification device can be implemented in whole or in part by software, hardware and a combination thereof.
  • the foregoing modules may be embedded in the form of hardware or independent of the processor in the computer device, or may be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the foregoing modules.
  • a computer device is provided.
  • the computer device may be a server, and its internal structure diagram may be as shown in FIG. 10.
  • the computer equipment includes a processor, a memory, a network interface and a database connected through a system bus.
  • the processor of the computer device is used to provide calculation and control capabilities.
  • the memory of the computer device includes a non-volatile storage medium and an internal memory.
  • the non-volatile storage medium stores an operating system, a computer program, and a database.
  • the internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium.
  • the network interface of the computer device is used to communicate with an external terminal through a network connection.
  • the computer program is executed by the processor to realize an abnormal information identification method.
  • a computer device including a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and the processor implements the following steps when the processor executes the computer program:
  • the rule engine is selected according to the abnormal rule matching the characteristic information, the abnormal rule matching the characteristic information is invoked through the selected rule engine, and the characteristic information is processed through the invoked abnormal rule Corresponding to the information object, and obtain the output processing result; the processing result includes an abnormality;
  • the characteristic information of the abnormal party whose processing result is abnormal is sent to a preset management party.
  • a computer-readable storage medium is provided.
  • the computer-readable storage medium is a volatile storage medium or a non-volatile storage medium, and a computer program is stored thereon, and the computer program is executed by a processor.
  • the rule engine is selected according to the abnormal rule matching the characteristic information, the abnormal rule matching the characteristic information is invoked through the selected rule engine, and the characteristic information is processed through the invoked abnormal rule Corresponding to the information object, and obtain the output processing result; the processing result includes an abnormality;
  • the characteristic information of the abnormal party whose processing result is abnormal is sent to a preset management party.
  • Non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory.
  • Volatile memory may include random access memory (RAM) or external cache memory.
  • RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Channel (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

Landscapes

  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Engineering & Computer Science (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Strategic Management (AREA)
  • Technology Law (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

一种异常信息识别方法、装置、计算机设备及存储介质，所述方法包括：获取用户的特征信息，构建信息表（S10）；当同一用户的特征信息中的预设关键信息发生过变更时，标记用户为异常方（S30）；调用分布式计算引擎遍历信息表，并在对将信息表中的所有异常方的特征信息进行分布式分配之后，将分配之后的每一组异常方的特征信息转换成一个信息对象（S40）；确定异常规则集中与信息对象中的特征信息匹配的异常规则（S50）；选取规则引擎，利用规则引擎获取输出的处理结果；将处理结果为存在异常的异常方的特征信息发送给预设的管理方（S70）。所述方法提升了对用户的异常监测的准确性和效率，同时也提升了对于异常的判定效率和速度，进而为用户及时止损。

Description

异常信息识别方法、装置、计算机设备及存储介质
本申请要求于2019年6月17日提交中国专利局、申请号为201910522395.4，发明名称为“异常信息识别方法、装置、计算机设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据分析领域，尤其涉及一种异常信息识别方法、装置、计算机设备及存储介质。
背景技术
现今贷款业务的范围越来越宽，其中比较大的一部分贷款业务需要通过各类渠道方和中介向借款人放贷，发明人意识到，这些渠道方和中介因为不是银行机构，在出现借款人未及时还贷或拒绝还贷的情况下，为向其代理的银行机构获取服务费，以及降低借款人的失信率从而提升其在银行机构的征信，时常会有为借款人代偿还款等作假行为，延长了银行机构识别出借款人出现欺诈行为的时间，导致大量资金损失，而如今尚未有能够准确识别代理方或用户的行为发生异常的方法。
发明内容
基于此，本申请提供一种异常信息识别方法、装置、计算机设备及存储介质，用于自动且及时地发现用户出现信贷危机，提升了对用户的异常行为监测的准确性和效率，同时也提升了对于异常的判定效率和速度，进而为用户及时止损。
一种异常信息识别方法，包括：
获取用户的特征信息，根据所述特征信息构建信息表；
通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更；
当同一用户的所述特征信息中的所述预设关键信息发生过变更时，标记所述用户为异常方；
调用分布式计算引擎遍历所述信息表，并在对将所述信息表中的所有所述异常方的特征信息进行分布式分配之后，将分配之后的每一组所述异常方的特征信息转换成一个信息对象；
获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则；
根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果；所述处理结果包括存在异常；
将所述处理结果为存在异常的所述异常方的特征信息发送给预设的管理方。
一种异常信息识别装置，包括：
信息获取模块，用于获取用户的特征信息，根据所述特征信息构建信息表；
变更检测模块，用于通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更；
标记模块，用于当同一用户的所述特征信息中的所述预设关键信息发生过变更时，标记所述用户为异常方；
分配模块，用于调用分布式计算引擎遍历所述信息表，并在对将所述信息表中的所有所述异常方的特征信息进行分布式分配之后，将分配之后的每一组所述异常方的特征信息转换成一个信息对象；
规则匹配模块，用于获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则；
异常信息识别模块，用于根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果；所述处理结果包括存在异常；
发送模块，用于将所述处理结果为存在异常的所述异常方的特征信息发送给预设的管理方。
一种计算机设备，包括存储器、处理器以及存储在所述存储器中并可在所述处 理器上运行的计算机程序，所述处理器执行所述计算机程序时实现上述异常信息识别方法的步骤。
一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时实现上述异常信息识别方法的步骤。
上述异常信息识别方法、装置、计算机设备及存储介质，利用分布式计算引擎对大量的用户数据(即所述信息表中的特征信息)进行分布式处理，同时根据用户的特征信息选取异常规则和规则引擎，进而通过该规则引擎调用选取的异常规则评估用户是否存在异常，如此，可以在第三方金融机构出于各种原因代替用户还款(存在异常)时，可以自动且及时地发现用户出现信贷危机，提升了对用户的异常行为监测的准确性和效率，同时也提升了对于异常的判定效率和速度，进而为用户及时止损。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对本申请实施例的描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请一实施例中异常信息识别方法的一应用环境示意图；
图2是本申请一实施例中异常信息识别方法的流程图；
图3是本申请一实施例中异常信息识别方法的步骤S10的流程图；
图4是本申请一实施例中异常信息识别方法的步骤S50的流程图；
图5是本申请另一实施例中异常信息识别方法的流程图；
图6是本申请另一实施例中异常信息识别方法的流程图；
图7是本申请一实施例中异常信息识别装置的示意图；
图8是本申请一实施例中异常信息识别装置的信息获取模块的示意图；
图9是本申请一实施例中异常信息识别装置的规则匹配模块的示意图；
图10是本申请一实施例中计算机设备的示意图。
具体实施方式
本申请提供的异常信息识别方法，可应用在如图1的应用环境中，其中，客户端(计算机设备/终端设备)通过网络与服务器(服务端)进行通信。利用分布式计算引擎对大量的用户数据(即所述信息表中的特征信息)进行分布式处理，同时根据用户的特征信息选取异常规则和规则引擎，进而通过该规则引擎调用选取的异常规则评估用户是否存在异常。其中，客户端(计算机设备/终端设备)包括但不限于各种个人计算机、笔记本电脑、智能手机、平板电脑和便携式可穿戴设备。服务器可以用独立的服务器或者是多个服务器组成的服务器集群来实现。
在一实施例中，如图2所示，提供一种异常信息识别方法，以该方法应用在图1中的服务器为例进行说明，包括如下步骤：
S10，获取用户的特征信息，根据所述特征信息构建信息表。
在一实施例中，所述用户可以是通过渠道方或中介等第三方金融代理机构向银行申请贷款的人，因为在本应用场景中，主要是针对于监控各种渠道方或中介等第三方金融代理机构是否存在代替用户向银行进行还款的欺诈行为，因此，在本实施例中需要对所述用户的范围进行限定，以便于在数据采集过程中，只需获取在限定范围内的所述特征信息，防止数据冗余，提升获取效率和后续的数据处理效率。所述特征信息是指所述用户在申请贷款时，所需要提供的各种个人信息以及身份信息，包括但不限于手机号、用于接收贷款的银行卡号、用于偿还贷款的银行卡号、除用户本人以外的联系人(主要是亲属，也可以是好友)、身份证号、家庭住址、工作单位等信息。所述特征信息可以从所述用户申请贷款时录入的申请信息、银行审批贷款时的审批记录、所述用户的还款流水等数据中获取。
所述信息表是存储所述特征信息的数据表。在一实施例中，所述信息表可以为信息宽表，所述信息宽表为多字段的数据库表，是将与业务相关的指标、维度、属性等关联在一起构建的数据表，也即所述信息宽表包含多个相关字段。必须说明的是，在本实施例中，所获取的是多个用户的特征信息，根据获取到的所有用户的特征信息，构建所述信息宽表，通过将海量的所述特征信息整合在一张宽表中，以供在后续步骤中快速的检索出需要的数据进而提升后续步骤的 执行效率。
在另一实施例中，还可以根据获取到的所有所述用户的特征信息，以一项信息为一个维度去构建多个数据表，并将构建的多个数据表关联起来。举例说明：所述特征信息有3项信息，分别是手机号、银行卡号、身份证号，则以每一项信息为一个维度，构建3个数据表，并将构建的3个数据表关联存储在数据库中。此实施例通过多个维度构建多个数据表，每一数据表只存储一项特征信息，可以避免造成数据冗余，提高查询效率。
S20，通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更。
其中，所述预设关键信息为用户根据实际情况或需求所预先设定的信息，比如在一实施例中，所述特征信息有手机号、身份证号、银行卡号，而根据上述三种特征信息的重要性和对用户的重要程度，可以将身份证号和银行卡号设定为预设关键信息，以供后续进行检测。在本实施例中，仅设定检测所述预设关键信息，是因为根据历史数据，非预设关键信息发生变更的可能性高，且在用户的非预设关键信息发生变更后，该用户会出现异常的可能性低，因此仅检测所述预设关键信息，可以提高检测效率，并提升识别出所述用户出现欺诈的准确率。
所述检测同一用户的所述特征信息中的预设关键信息是否发生变更，即检测同一用户在录入其特征信息后，其特征信息中的预设关键信息是否发生过变更。具体地，通过检索所述信息表，获取同一用户的所有所述特征信息，接着，检测该用户的特征信息中的预设关键信息是否发生过变更，当该用户的特征信息中的预设关键信息发生过变更时，进入步骤S30，；当该用户的特征信息中的预设关键信息没有发生变更时，代表该用户存在异常的概率很低，此时，确认该用户不存在异常。
S30，当同一用户的所述特征信息中的所述预设关键信息发生过变更时，标记所述用户为异常方。
当同一用户的所述特征信息中的预设关键信息在该用户录入信息后发生过变更时，代表该用户的更改了对其是否按期还款可能有重大影响的特征信息，如还 款银行卡号，还款人等特征信息，即该用户可能具有欺诈的风险，此时，将该用户标记为异常方，用于区分其他特征信息中的预设关键信息未发生过变更的用户，以便于在后续步骤中对所述异常方进行进一步的异常评估。
S40，调用分布式计算引擎遍历所述信息表，并在对将所述信息表中的所有所述异常方的特征信息进行分布式分配之后，将分配之后的每一组所述异常方的特征信息转换成一个信息对象；
其中，所述分布式计算引擎是基于分布式计算的引擎，所述分布式计算是一种与集中计算相对的计算方法，所述分布式计算引擎的分布式处理大体可以分为以下几个步骤：数据读取、数据计算和数据存储；所述分布式计算可以将庞大的数据(信息表)分解出许多相对小的数据(每一组所述异常方的特征信息)，并分配给多台计算机进行处理，能够提高数据处理的效率。而调用所述分布式计算引擎遍历所述信息表，对信息表中的不同异常方的特征信息进行分布式分配之后，使得其中的每一组(或者多组)特征信息被分配给不同的计算机进行处理，同时，由于被分布式计算引擎分配之后的每一组特征信息可能并不能被后续步骤中获取到的异常规则进行直接处理，因此，需要在进行分配之后，将每一组所述异常方的特征信息转化为一个可以被后续获取的业务规则能直接进行处理的信息对象(即Po，Persisent Object，持久对象)，才能进一步地的对在所述信息对象中的特征信息进行分布式的处理。本实施例中，通过运用分布式计算引擎的调用，对大量的用户数据(即所述信息表中的特征信息)进行分布式处理，可以提升处理效率，进而提升异常的判定效率和速度。
S50，获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则；
为了清楚的说明所述异常规则集，下面选取所述异常规则集中的几种异常规则进行列举：特征信息中的用户手机号的机主并非该特征信息对应的用户本人；特征信息中的联系人没有该特征信息对应的用户的直系亲属；特征信息中的还款银行卡号的卡主并非该特征信息对应的用户本人；当用户为公司时，特征信息中的公司已经工商注销并解散中的一种或多种。其中，所述异常规则集中的异常规则可以由用户根据实际情况和需求预先设定。
可理解地，由于不同的特征信息可以通过不同的异常规则从而处理得到不同的处理结果，故需要根据所述信息对象中的特征信息确定所述异常规则集中与所述特征信息匹配的异常规则，具体地，检测所述信息对象中的特征信息是否包含异常规则中所需输入的所有待输入信息(异常规则处理获得与其对应的处理结果所需的所有特征信息)，当所述信息对象中的特征信息包含异常规则中所需输入的所有待输入信息(比如，异常规则集中有一条异常规则为：特征信息中的用户手机号的机主并非该特征信息对应的用户本人；而信息对象中的特征信息中包含用户手机号、用户手机号的机主信息和该特征信息的用户本人信息，此时认为该异常规则与该信息对象中的特征信息匹配)时，代表所述异常规则与所述信息对象中的特征信息匹配。在本实施例中，确定与所述信息对象中的特征信息相匹配的异常规则，以供在后续步骤中根据所述异常规则对所述特征信息进行处理。
S60，根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果；所述处理结果包括存在异常。
本实施例根据与所述信息对象中的特征信息匹配的所述异常规则选取对应的规则引擎，然后，通过选取的所述规则引擎调用该异常规则(即与所述特征信息匹配的异常规则)，并通过调用的所述异常规则处理与所述特征信息对应的信息对象，并获取输出的处理结果，所述处理结果包括存在异常和不存在异常。获取输出的所述处理结果，以便于据此从各可能存在异常的异常方中，筛选出实际存在异常的异常方，以供后续进行进一步地判定和分析。
下面对所述异常规则对所述信息对象中的特征信息处理的过程进行举例说明：
本实施例通过特征信息评估用户是否存在异常，而非根据用户是否有足额还款或/和是否有按期限还款来评估用户是否具有异常，可以在第三方金融机构出于各种原因代替所述用户还款(也即帮助不及时足额还款的用户隐瞒欺诈行为)时，也能及时的发现用户出现信贷危机，也即出现异常，以便于银行能够及早的采取应对措施，减少银行的损失。
S70，将所述处理结果为存在异常的所述异常方的特征信息发送给预设的管理方。
在上述步骤中判定出用户存在异常后，即将所述存在异常的所述异常方的特征信息发送给预设的管理方，由所述管理方根据所述特征信息进一步核实所述存在异常的异常方是否事实上已出现还款不能，或事实上已经不再按期足额的还款给银行，而是由第三方金融代理机构代替还款。所述管理方可以根据实际需求预先设定，可以是银行的异常管控部门，也可以是银行的贷款欺诈处理部门等。所述管理方获取所述存在异常的异常方的特征信息后，即可通过电话联系，查询分析还款记录，查询个人征信等信息来判断所述存在异常的异常方是否已经出现事实上的还款不能，或已经不按期足额的偿还贷款，从而提升了对用户的还款信用进行检测的准确性，以及提升对用户进行检测的效率，降低银行损失。
本实施例利用分布式计算引擎对大量的用户数据(即所述信息表中的特征信息)进行分布式处理，同时根据用户的特征信息选取异常规则和规则引擎，进而通过该规则引擎调用选取的异常规则评估用户是否存在异常，如此，可以在第三方金融机构出于各种原因代替用户还款(存在异常)时，可以自动且及时地发现用户出现信贷危机，提升了对用户的还款信用监测的准确性和效率，同时也提升了对于异常的判定效率和速度，进而为用户及时止损。
在一实施例中，如图3所示，所述步骤S10包括：
S101，获取用户的特征信息，以及所述特征信息生成或更新的时间，将所述特征信息中具有相同含义的字段进行归一化。
承接上述实施例，所述用户为通过渠道方或中介等第三方金融代理机构向银行申请贷款的人，而所述特征信息，是用户在申请贷款时，由第三方金融代理机构集合其代理的银行的要求，以及自身的实际情况，向用户要求提供的信息，可理解地，不同的第三方金融代理机构，其要求用户提供的特征信息可能名称不同，但名称的含义相同，举例说明：同为身份证号，在甲代理机构可能称为证件号，在乙代理机构可能称为身份号。可理解地，所述特征信息生成的时间是指所述用户录入所述特征信息的时间，所述特征信息更新的时间是指所述用 户更新其之前录入的特征信息的时间。
因此，所获取到的不同用户的特征信息中，即使其字段(也即信息的名称)不同时，该字段的含义可能相同，故为了存储方便，以及构建简洁的信息表，在本实施例中，对所述特征信息中具有相同含义的字段进行名称的归一化，举例说明：所获取到的所有所述特征信息中，含义均为银行卡号的字段，可能有不同的名称，比如银行卡号、账号，此时，将银行卡号和账号这两个含义相同的字段，进行名称的归一化，如将“账号”字段归一化为“银行卡号”字段，或将“银行卡号”字段和“账号”字段归一化为“A”字段等，归一化的形式可以是多种，即只要将具有相同含义但不相同的字段转换为相同的字段即可，本申请不做具体限定。将所述特征信息中具有相同含义的字段进行归一化，以供在后续步骤中构建简洁高效的信息表，提高存储和查询效率。
S102，根据归一化后的所述特征信息，以所述特征信息生成或更新的时间先后为序构建信息表。
可理解地，所述特征信息可能会随着其对应的用户的实际情况而发生变更，比如，当其对应的用户家庭住址发生变更时，所述特征信息随之发生变更，当其对应的用户联系方式发生变更时，所述特征信息亦会随之发生变更，可理解地，每一次所述特征信息发生变更时，都会记录发生变更的时间，或所述用户第一次录入特征信息时，也会记录录入的时间。在本实施例中，将归一化后的所述特征信息根据其对应的录入时间或变更时间，按照时间先后顺序排序，构建所述信息表，则在后续执行过程中当需要查询某时间节点的特征信息时，可以提高在遍历和查询信息表中某时间节点的特征信息时的查询效率，还可以直观的通过所述信息表，对所述特征信息进行时间上的纵向比对，以检测所述特征信息是否随着时间的变化而发生变更，从而提升对用户的特征信息是否发生变更进行检测的效率。
在一实施例中，如图4所示，所述步骤S50包括：
S501，检测所述异常规则集中与所述信息对象的所述特征信息匹配的所述异常规则是否为零个。可理解地，所述异常规则集中与所述信息对象的所述用户心相匹配的所述异常规则可能为零个、一个或两个以上，检测其是否为零个，以 供在后续步骤中为该信息对象选取替代的异常规则对其进行处理。在本实施例中，当所述异常规则集中与所述信息对象的所述特征信息匹配的所述异常规则为一个或两个以上时，将所有与所述信息对象的所述特征信息匹配的所述异常规则确认为待匹配规则引擎的异常规则，以供在后续步骤中为其匹配相应的规则引擎。
S502，当所述异常规则集中与所述信息对象的所述特征信息匹配的所述异常规则为零个时，获取所述异常规则集中的代替异常规则，并获取所述代替异常规则所需的待输入特征信息，以供在后续步骤中为该信息对象选取代替的异常规则对其进行处理。其中，所述代替异常规则为所述异常规则集中经过一些处理后可以对所述信息对象进行处理的任一异常规则。
S503，根据所述信息对象中的所述特征信息与所述代替异常规则所需的所述待输入特征信息之间的转换关系调取预设的自定义函数和拦截器，并通过所述自定义函数和所述拦截器将所述信息对象中的特征信息转换为所述待输入特征信息，同时确认所述代替异常规则与所述信息对象中的所述待输入特征信息匹配。
其中，如上所述，所述待输入特征信息为所述代替异常规则所需输入的特征信息。
具体地，首先通过Java插件接口调用预设的所述自定义函数，并将所述信息对象中的特征信息输入至所述自定义函数中进行运行计算，获得输出的运算结果，所述运算结果由多个子对象组成，接着，通过Java插件接口调用预先配置的所述拦截器，拦截所述运算结果中预设的行为对象，将除所述预设的行为对象之外的所有运算结果中的其他子对象确认为所述待输入特征信息，此时，即将所述信息对象中的特征信息转换为了所述待输入特征信息，进一步地，确认所述代替异常规则与所述信息对象中的所述待输入特征信息匹配。本实施例可以在所述异常规则集中确定一个依旧可以得出与所述异常方匹配的处理结果的代替异常规则，以便于即使在没有与所述信息对象的特征信息匹配的异常规则时也可以对所述信息对象处理，从而得出所述信息对象的处理结果。
在一实施例中，如图5所示，所述步骤S20之后，还包括：
S80，获取所述信息表中经由同一代理方处理的所有用户的特征信息。
在一实施例中，所述代理方即代理银行贷款业务，为银行放贷或介绍/提供用户的第三方金融代理机构，如各种渠道方、中介、金融公司等。在本实施例中，获取所述信息表中经由同一代理方处理的所有用户的特征信息，以便在后续步骤中根据获取的特征信息，评估所述代理方是否存在异常，也即是否会在经由该代理方处理的用户在事实上失去偿还能力，或长期不足额按期偿还贷款时，出于获取中介费、提高该代理方在银行的征信等考虑，为经由该代理方处理的用户偿还贷款，以此来欺骗银行的欺诈行为。
S90，在经由同一代理处理的用户的特征信息满足预设异常情景时，评估所述代理方存在异常；所述预设异常情景包括：两个或两个以上的经由同一代理方处理的用户的还款卡号相同；预设数量的经由同一代理方处理的用户的还款时间均集中在预设时长内中的一种或多种；
其中，所述预设异常情景可以根据实际情况由用户预先设定。为了清楚地描述所述预设异常情景，下面对其中几种预设异常情景进行说明：承接上述实施例，两个或两个以上的经由同一代理方处理的用户的还款卡号相同，可理解地，由于不同的用户都会有专属于自己的银行卡号，会出现两个人同用一张银行卡号的概率很低，因此当两个或两个以上的经由同一代理方处理的用户的还款卡号相同时，代表该代理方很有可能在代替不还款的多个用户偿还贷款，所以该代理方存在异常；预设数量的经由同一代理方处理的用户的还款时间均集中在预设时长内时，所述预设数量可以根据实际情况预先设定，比如设定10；所述预设时长可以由用户根据实际情况预先进行界定，比如规定1分钟内即为所述预设时长内，可理解地，代理方并非银行，在客户数量上达不到银行客户的数量，因此在预设时长内出现一定数量(也即所述预设数量)的用户还款的可能性低，因此当所述预设数量设定的足够大时，当预设数量的经由同一代理方处理的用户的还款时间均集中在预设时长内时，代表该代理方很有可能在代替不还款的多个用户偿还处理。可理解地，所述预设异常情景可以由用户结合实际情况预先设定，只要可以分析判定出代理方存在异常即可，而具体的内容和形式，本申请不做具体限定。
所述评估所述代理方是否存在异常，具体地，首先根据经由同一代理方处理的所有用户的特征信息，判定是否符合所述预设异常情景，当结果为是时，即可判定所述代理方存在异常。比如，以上述列举的预设异常情景为例，根据经由同一代理方处理的所有用户的特征信息，判定是否有两个或两个以上的经由同一代理方处理的用户的还款卡号相同，当判定结果为是时，即代表出现了预设异常情景中出现的预设异常情景，此时，即可确认所述代理方存在异常。
本实施例通过引入预设异常情景对经由同一代理方处理的所有用户进行数据监控，可以判断出该代理方有无异常，以便于在该代理方出现异常时，可以及时进行异常管控，例如银行可以暂停向经由该代理机构处理的用户发放贷款，降低了银行的损失。
在一实施例中，如图6所示，所述步骤S60之后，还包括：
S100，检测经由同一代理方处理的存在异常的所述异常方的人数是否大于预设的异常阈值。
其中，所述异常阈值可以根据实际情况预先设定，比如根据代理方的用户数量。
如上所述，所述存在异常的异常方为出现了异常的用户，若经由同一代理方处理的用户出现异常的人数达到一定数值，代表该代理方很有可能出现异常，故在本实施例中，检测经由同一代理方处理的所述存在异常的异常方的人数是超过所述异常阈值，以便于在后续步骤中对所述代理方是否出现异常进行判定。
S110，当经由同一代理方处理的存在异常的所述异常方的人数大于所述异常阈值时，确认所述代理方存在异常。
当经由同一代理方处理的所述存在异常的异常方的人数超过所述异常阈值时，代表该经由该代理方处理的用户出现异常的人数已经超过一定数值，也即该代理方出现异常的可能性很高，此时，确认所述代理方存在异常；当经由同一代理方处理的所述存在异常的异常方的人数小于或等于所述异常阈值时，代表该代理方出现异常的可能性较低，此时，确认该代理方不存在异常，或者将情况汇总发送至预设的管理方，由所述管理方进行判断。
本实施例对经由同一代理方处理的所有用户进行数据监控，通过横向比对同一 代理方处理的存在欺诈的异常方的人数是否超过预设的异常阈值，进而判断出该代理方有无异常，以便于在该代理方出现异常时，及时进行异常管控，例如暂停向经由该代理机构处理的用户发放贷款，降低了银行的损失，该方案可以进一步提升对于代理方是否异常的监测效率。
本申请利用分布式计算引擎对大量的用户数据(即所述信息表中的特征信息)进行分布式处理，同时根据用户的特征信息选取异常规则和规则引擎，进而通过该规则引擎调用选取的异常规则评估用户是否存在异常，如此，可以在第三方金融机构出于各种原因代替用户还款(存在异常)时，可以自动且及时地发现用户出现信贷危机，提升了对用户的还款信用监测的准确性和效率，同时也提升了对于异常的判定效率和速度，进而为用户及时止损。
应理解，上述实施例中各步骤的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
在一实施例中，提供一种异常信息识别装置，该异常信息识别装置与上述实施例中异常信息识别方法一一对应。如图7所示，该异常信息识别装置包括信息获取模块11、变更检测模块12、标记模块13、分配模块14、规则匹配模块15、异常信息识别模块16和发送模块17。各功能模块详细说明如下：
所述信息获取模块11，用于获取用户的特征信息，根据所述特征信息构建信息表；
所述变更检测模块12，用于通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更；
所述标记模块13，用于当同一用户的所述特征信息中的所述预设关键信息发生过变更时，标记所述用户为异常方；
所述分配模块14，用于调用分布式计算引擎遍历所述信息表，并在对将所述信息表中的所有所述异常方的特征信息进行分布式分配之后，将分配之后的每一组所述异常方的特征信息转换成一个信息对象；
所述规则匹配模块15，用于获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则；
所述异常信息识别模块16，用于根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果；所述处理结果包括存在异常；
所述发送模块17，用于将所述处理结果为存在异常的所述异常方的特征信息发送给预设的管理方。
在一实施例中，如图8所示，所述信息获取模块11包括：
归一单元111，用于获取用户的特征信息，以及所述特征信息生成或更新的时间，将所述特征信息中具有相同含义的字段进行归一化；
构建单元112，用于根据归一化后的所述特征信息，以所述特征信息生成或更新的时间先后为序构建信息表。
在一实施例中，如图9所示，所述规则匹配模块15包括：
数量检测单元151，用于检测所述异常规则集中与所述信息对象的所述特征信息匹配的所述异常规则是否为零个；
代替获取单元152，用于当所述异常规则集中与所述信息对象的所述特征信息匹配的所述异常规则为零个时，获取所述异常规则集中的代替异常规则，并获取所述代替异常规则所需的待输入特征信息；
规则转换单元153，用于根据所述信息对象中的所述特征信息与所述代替异常规则所需的所述待输入特征信息之间的转换关系调取预设的自定义函数和拦截器，并通过所述自定义函数和所述拦截器将所述信息对象中的特征信息转换为所述待输入特征信息，同时确认所述代替异常规则与所述信息对象中的所述待输入特征信息匹配。
关于异常信息识别装置的具体限定可以参见上文中对于异常信息识别方法的限定，在此不再赘述。上述异常信息识别装置中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
在一个实施例中，提供了一种计算机设备，该计算机设备可以是服务器，其内 部结构图可以如图10所示。该计算机设备包括通过系统总线连接的处理器、存储器、网络接口和数据库。其中，该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失性存储介质、内存储器。该非易失性存储介质存储有操作系统、计算机程序和数据库。该内存储器为非易失性存储介质中的操作系统和计算机程序的运行提供环境。该计算机设备的网络接口用于与外部的终端通过网络连接通信。该计算机程序被处理器执行时以实现一种异常信息识别方法。
在一个实施例中，提供了一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，处理器执行计算机程序时实现以下步骤：
获取用户的特征信息，根据所述特征信息构建信息表；
通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更；
当同一用户的所述特征信息中的所述预设关键信息发生过变更时，标记所述用户为异常方；
调用分布式计算引擎遍历所述信息表，并在对将所述信息表中的所有所述异常方的特征信息进行分布式分配之后，将分配之后的每一组所述异常方的特征信息转换成一个信息对象；
获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则；
根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果；所述处理结果包括存在异常；
将所述处理结果为存在异常的所述异常方的特征信息发送给预设的管理方。
在一个实施例中，提供了一种计算机可读存储介质，所述计算机可读存储介质为易失性存储介质或非易失性存储介质，其上存储有计算机程序，计算机程序被处理器执行时实现以下步骤：
获取用户的特征信息，根据所述特征信息构建信息表；
通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更；
当同一用户的所述特征信息中的所述预设关键信息发生过变更时，标记所述用户为异常方；
调用分布式计算引擎遍历所述信息表，并在对将所述信息表中的所有所述异常方的特征信息进行分布式分配之后，将分配之后的每一组所述异常方的特征信息转换成一个信息对象；
获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则；
根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果；所述处理结果包括存在异常；
将所述处理结果为存在异常的所述异常方的特征信息发送给预设的管理方。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一非易失性计算机可读取存储介质中，该计算机程序在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和/或易失性存储器。非易失性存储器可包括只读存储器(ROM)、可编程ROM(PROM)、电可编程ROM(EPROM)、电可擦除可编程ROM(EEPROM)或闪存。易失性存储器可包括随机存取存储器(RAM)或者外部高速缓冲存储器。作为说明而非局限，RAM以多种形式可得，诸如静态RAM(SRAM)、动态RAM(DRAM)、同步DRAM(SDRAM)、双数据率SDRAM(DDRSDRAM)、增强型SDRAM(ESDRAM)、同步链路(Synchlink)DRAM(SLDRAM)、存储器总线(Rambus)直接RAM(RDRAM)、直接存储器总线动态RAM(DRDRAM)、以及存储器总线动态RAM(RDRAM)等。
发明概述
技术问题
问题的解决方案
发明的有益效果

Claims (20)

  1. 一种异常信息识别方法，其中，包括：
    获取用户的特征信息，根据所述特征信息构建信息表；
    通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更；
    当同一用户的所述特征信息中的所述预设关键信息发生过变更时，标记所述用户为异常方；
    调用分布式计算引擎遍历所述信息表，并在对将所述信息表中的所有所述异常方的特征信息进行分布式分配之后，将分配之后的每一组所述异常方的特征信息转换成一个信息对象；
    获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则；
    根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果；所述处理结果包括存在异常；
    将所述处理结果为存在异常的所述异常方的特征信息发送给预设的管理方。
  2. 如权利要求1所述的异常信息识别方法，其中，所述获取用户的特征信息，根据所述特征信息构建信息表，包括：
    获取用户的特征信息，以及所述特征信息生成或更新的时间，将所述特征信息中具有相同含义的字段进行归一化；
    根据归一化后的所述特征信息，以所述特征信息生成或更新的时间先后为序构建信息表。
  3. 如权利要求1所述的异常信息识别方法，其中，所述获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则，包括：
    检测所述异常规则集中与所述信息对象的所述特征信息匹配的所 述异常规则是否为零个；
    当所述异常规则集中与所述信息对象的所述特征信息匹配的所述异常规则为零个时，获取所述异常规则集中的代替异常规则，并获取所述代替异常规则所需的待输入特征信息；
    根据所述信息对象中的所述特征信息与所述代替异常规则所需的所述待输入特征信息之间的转换关系调取预设的自定义函数和拦截器，并通过所述自定义函数和所述拦截器将所述信息对象中的特征信息转换为所述待输入特征信息，同时确认所述代替异常规则与所述信息对象中的所述待输入特征信息匹配。
  4. 如权利要求1所述的异常信息识别方法，其中，所述通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更之后，还包括：
    获取所述信息表中经由同一代理方处理的所有用户的特征信息；
    在经由同一代理处理的用户的特征信息满足预设异常情景时，评估所述代理方存在异常；所述预设异常情景包括：两个或两个以上的经由同一代理方处理的用户的还款卡号相同；预设数量的经由同一代理方处理的用户的还款时间均集中在预设时长内中的一种或多种。
  5. 如权利要求1所述的异常信息识别方法，其中，所述根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果之后，还包括：
    检测经由同一代理方处理的存在异常的所述异常方的人数是否大于预设的异常阈值；
    当经由同一代理方处理的存在异常的所述异常方的人数大于所述异常阈值时，确认所述代理方存在异常。
  6. 一种异常信息识别装置，其中，包括：
    信息获取模块，用于获取用户的特征信息，根据所述特征信息构建信息表；
    变更检测模块，用于通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更；
    标记模块，用于当同一用户的所述特征信息中的所述预设关键信息发生过变更时，标记所述用户为异常方；
    分配模块，用于调用分布式计算引擎遍历所述信息表，并在对将所述信息表中的所有所述异常方的特征信息进行分布式分配之后，将分配之后的每一组所述异常方的特征信息转换成一个信息对象；
    规则匹配模块，用于获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则；
    异常信息识别模块，用于根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果；所述处理结果包括存在异常；
    发送模块，用于将所述处理结果为存在异常的所述异常方的特征信息发送给预设的管理方。
  7. 如权利要求6所述的异常信息识别装置，其中，所述信息获取模块包括：
    归一单元，用于获取用户的特征信息，以及所述特征信息生成或更新的时间，将所述特征信息中具有相同含义的字段进行归一化；
    构建单元，用于根据归一化后的所述特征信息，以所述特征信息生成或更新的时间先后为序构建信息表。
  8. 如权利要求6所述的异常信息识别装置，其中，所述规则匹配模块包括：
    数量检测单元，用于检测所述异常规则集中与所述信息对象的所述特征信息匹配的所述异常规则是否为零个；
    代替获取单元，用于当所述异常规则集中与所述信息对象的所述特征信息匹配的所述异常规则为零个时，获取所述异常规则集中的代替异常规则，并获取所述代替异常规则所需的待输入特征信息；
    规则转换单元，用于根据所述信息对象中的所述特征信息与所述代替异常规则所需的所述待输入特征信息之间的转换关系调取预设的自定义函数和拦截器，并通过所述自定义函数和所述拦截器将所述信息对象中的特征信息转换为所述待输入特征信息，同时确认所述代替异常规则与所述信息对象中的所述待输入特征信息匹配。
  9. 如权利要求6所述的异常信息识别装置，其中，所述通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更之后，还包括：
    获取所述信息表中经由同一代理方处理的所有用户的特征信息；
    在经由同一代理处理的用户的特征信息满足预设异常情景时，评估所述代理方存在异常；所述预设异常情景包括：两个或两个以上的经由同一代理方处理的用户的还款卡号相同；预设数量的经由同一代理方处理的用户的还款时间均集中在预设时长内中的一种或多种。
  10. 如权利要求6所述的异常信息识别装置，其中，所述根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果之后，还包括：
    检测经由同一代理方处理的存在异常的所述异常方的人数是否大于预设的异常阈值；
    当经由同一代理方处理的存在异常的所述异常方的人数大于所述异常阈值时，确认所述代理方存在异常。
  11. 一种计算机设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，其中，所述处理器执行所述计算机程序时实现一种异常信息识别方法，其中，所述异常信息识别方法包括：获取用户的特征信息，根据所述特征信息构建信息表；
    通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更；
    当同一用户的所述特征信息中的所述预设关键信息发生过变更时，标记所述用户为异常方；
    调用分布式计算引擎遍历所述信息表，并在对将所述信息表中的所有所述异常方的特征信息进行分布式分配之后，将分配之后的每一组所述异常方的特征信息转换成一个信息对象；
    获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则；
    根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果；所述处理结果包括存在异常；
    将所述处理结果为存在异常的所述异常方的特征信息发送给预设的管理方。
  12. 如权利要求11所述的计算机设备，其中，所述获取用户的特征信息，根据所述特征信息构建信息表，包括：
    获取用户的特征信息，以及所述特征信息生成或更新的时间，将所述特征信息中具有相同含义的字段进行归一化；
    根据归一化后的所述特征信息，以所述特征信息生成或更新的时间先后为序构建信息表。
  13. 如权利要求11所述的计算机设备，其中，所述获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则，包括：
    检测所述异常规则集中与所述信息对象的所述特征信息匹配的所述异常规则是否为零个；
    当所述异常规则集中与所述信息对象的所述特征信息匹配的所述异常规则为零个时，获取所述异常规则集中的代替异常规则，并获取所述代替异常规则所需的待输入特征信息；
    根据所述信息对象中的所述特征信息与所述代替异常规则所需的所述待输入特征信息之间的转换关系调取预设的自定义函数和拦截器，并通过所述自定义函数和所述拦截器将所述信息对象中的特征信息转换为所述待输入特征信息，同时确认所述代替异常规则与所述信息对象中的所述待输入特征信息匹配。
  14. 如权利要求11所述的计算机设备，其中，所述通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更之后，还包括：
    获取所述信息表中经由同一代理方处理的所有用户的特征信息；
    在经由同一代理处理的用户的特征信息满足预设异常情景时，评估所述代理方存在异常；所述预设异常情景包括：两个或两个以上的经由同一代理方处理的用户的还款卡号相同；预设数量的经由同一代理方处理的用户的还款时间均集中在预设时长内中的一种或多种。
  15. 如权利要求11所述的计算机设备，其中，所述根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果之后，还包括：
    检测经由同一代理方处理的存在异常的所述异常方的人数是否大 于预设的异常阈值；
    当经由同一代理方处理的存在异常的所述异常方的人数大于所述异常阈值时，确认所述代理方存在异常。
  16. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，其中，所述计算机程序被处理器执行时实现一种异常信息识别方法，其中，所述异常信息识别方法包括：获取用户的特征信息，根据所述特征信息构建信息表；
    通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更；
    当同一用户的所述特征信息中的所述预设关键信息发生过变更时，标记所述用户为异常方；
    调用分布式计算引擎遍历所述信息表，并在对将所述信息表中的所有所述异常方的特征信息进行分布式分配之后，将分配之后的每一组所述异常方的特征信息转换成一个信息对象；
    获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则；
    根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果；所述处理结果包括存在异常；
    将所述处理结果为存在异常的所述异常方的特征信息发送给预设的管理方。
  17. 如权利要求16所述的计算机可读存储介质，其中，所述获取用户的特征信息，根据所述特征信息构建信息表，包括：
    获取用户的特征信息，以及所述特征信息生成或更新的时间，将所述特征信息中具有相同含义的字段进行归一化；
    根据归一化后的所述特征信息，以所述特征信息生成或更新的时间先后为序构建信息表。
  18. 如权利要求16所述的计算机可读存储介质，其中，所述获取预设的异常规则集，确定所述异常规则集中与所述信息对象中的特征信息匹配的异常规则，包括：
    检测所述异常规则集中与所述信息对象的所述特征信息匹配的所述异常规则是否为零个；
    当所述异常规则集中与所述信息对象的所述特征信息匹配的所述异常规则为零个时，获取所述异常规则集中的代替异常规则，并获取所述代替异常规则所需的待输入特征信息；
    根据所述信息对象中的所述特征信息与所述代替异常规则所需的所述待输入特征信息之间的转换关系调取预设的自定义函数和拦截器，并通过所述自定义函数和所述拦截器将所述信息对象中的特征信息转换为所述待输入特征信息，同时确认所述代替异常规则与所述信息对象中的所述待输入特征信息匹配。
  19. 如权利要求16所述的计算机可读存储介质，其中，所述通过所述信息表，检测同一用户的所述特征信息中的预设关键信息是否发生过变更之后，还包括：
    获取所述信息表中经由同一代理方处理的所有用户的特征信息；
    在经由同一代理处理的用户的特征信息满足预设异常情景时，评估所述代理方存在异常；所述预设异常情景包括：两个或两个以上的经由同一代理方处理的用户的还款卡号相同；预设数量的经由同一代理方处理的用户的还款时间均集中在预设时长内中的一种或多种。
  20. 如权利要求16所述的计算机可读存储介质，其中，所述根据与所述特征信息匹配的所述异常规则选取规则引擎，通过选取的所述规则引擎调用与所述特征信息匹配的所述异常规则，并通过调用的所述异常规则处理与所述特征信息对应的所述信息对象，并获取输出的处理结果之后，还包括：
    检测经由同一代理方处理的存在异常的所述异常方的人数是否大 于预设的异常阈值；
    当经由同一代理方处理的存在异常的所述异常方的人数大于所述异常阈值时，确认所述代理方存在异常。
PCT/CN2020/085569 2019-06-17 2020-04-20 异常信息识别方法、装置、计算机设备及存储介质 Ceased WO2020253348A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910522395.4 2019-06-17
CN201910522395.4A CN110363644A (zh) 2019-06-17 2019-06-17 异常信息识别方法、装置、计算机设备及存储介质

Publications (1)

Publication Number Publication Date
WO2020253348A1 true WO2020253348A1 (zh) 2020-12-24

Family

ID=68217278

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/085569 Ceased WO2020253348A1 (zh) 2019-06-17 2020-04-20 异常信息识别方法、装置、计算机设备及存储介质

Country Status (2)

Country Link
CN (1) CN110363644A (zh)
WO (1) WO2020253348A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113076353A (zh) * 2021-03-24 2021-07-06 深圳供电局有限公司 一种电力核算异常分析方法及系统
CN114022297A (zh) * 2021-11-10 2022-02-08 工银科技有限公司 确定异常参保人员的方法、装置、设备及介质
CN115510108A (zh) * 2022-10-12 2022-12-23 中国银行股份有限公司 交易信息拼接方法及装置
CN113723522B (zh) * 2021-08-31 2023-06-16 平安科技（深圳）有限公司 异常用户的识别方法、装置、电子设备以及存储介质
CN117171226A (zh) * 2023-04-04 2023-12-05 国网河北省电力有限公司邯郸供电分公司 一种传递线损异常信息的方法及装置
WO2024124706A1 (zh) * 2022-12-15 2024-06-20 上海观安信息技术股份有限公司 数据库的流量识别方法、装置、存储介质及计算机设备

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110363644A (zh) * 2019-06-17 2019-10-22 深圳壹账通智能科技有限公司 异常信息识别方法、装置、计算机设备及存储介质
CN111369346B (zh) * 2020-03-17 2024-05-03 深圳市铭数信息有限公司 用户信用的评估方法、装置、服务器和存储介质
CN112634028A (zh) * 2020-12-30 2021-04-09 四川新网银行股份有限公司 一种识别人行征信报告代偿回购行为的方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107330785A (zh) * 2017-07-10 2017-11-07 广州市触通软件科技股份有限公司 一种基于大数据智能风控的小额贷款系统及方法
CN108596759A (zh) * 2018-05-09 2018-09-28 平安普惠企业管理有限公司 贷款申请信息检测方法及服务器
CN108694657A (zh) * 2018-07-13 2018-10-23 平安科技（深圳）有限公司 客户识别装置、方法及计算机可读存储介质
US20190180032A1 (en) * 2016-10-03 2019-06-13 Nippon Telegraph And Telephone Corporation Classification apparatus, classification method, and classification program
CN110363644A (zh) * 2019-06-17 2019-10-22 深圳壹账通智能科技有限公司 异常信息识别方法、装置、计算机设备及存储介质

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10284724B2 (en) * 2017-04-05 2019-05-07 Teleperformance Se Context sensitive rule-based alerts for fraud monitoring
CN111126622B (zh) * 2019-12-19 2023-11-03 中国银联股份有限公司 一种数据异常检测方法与装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190180032A1 (en) * 2016-10-03 2019-06-13 Nippon Telegraph And Telephone Corporation Classification apparatus, classification method, and classification program
CN107330785A (zh) * 2017-07-10 2017-11-07 广州市触通软件科技股份有限公司 一种基于大数据智能风控的小额贷款系统及方法
CN108596759A (zh) * 2018-05-09 2018-09-28 平安普惠企业管理有限公司 贷款申请信息检测方法及服务器
CN108694657A (zh) * 2018-07-13 2018-10-23 平安科技（深圳）有限公司 客户识别装置、方法及计算机可读存储介质
CN110363644A (zh) * 2019-06-17 2019-10-22 深圳壹账通智能科技有限公司 异常信息识别方法、装置、计算机设备及存储介质

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113076353A (zh) * 2021-03-24 2021-07-06 深圳供电局有限公司 一种电力核算异常分析方法及系统
CN113723522B (zh) * 2021-08-31 2023-06-16 平安科技（深圳）有限公司 异常用户的识别方法、装置、电子设备以及存储介质
CN114022297A (zh) * 2021-11-10 2022-02-08 工银科技有限公司 确定异常参保人员的方法、装置、设备及介质
CN115510108A (zh) * 2022-10-12 2022-12-23 中国银行股份有限公司 交易信息拼接方法及装置
WO2024124706A1 (zh) * 2022-12-15 2024-06-20 上海观安信息技术股份有限公司 数据库的流量识别方法、装置、存储介质及计算机设备
CN117171226A (zh) * 2023-04-04 2023-12-05 国网河北省电力有限公司邯郸供电分公司 一种传递线损异常信息的方法及装置

Also Published As

Publication number Publication date
CN110363644A (zh) 2019-10-22

Similar Documents

Publication Publication Date Title
WO2020253348A1 (zh) 异常信息识别方法、装置、计算机设备及存储介质
US11062026B2 (en) Counter-fraud operation management
US12045879B2 (en) Systems and methods for securing risk in blockchain networks
US10069891B2 (en) Channel accessible single function micro service data collection process for light analytics
US20160071108A1 (en) Enhanced automated anti-fraud and anti-money-laundering payment system
US8825798B1 (en) Business event tracking system
CN109767226B (zh) 基于大数据的可疑交易统计视图生成方法和装置
US20120116984A1 (en) Automated evaluation of compliance data from heterogeneous it systems
CN105187674B (zh) 服务录音的合规检查方法及装置
CN112184238A (zh) 金融租赁行业的反洗钱监控方法、装置、电子设备及介质
CN109492856B (zh) 业务请求处理方法、装置、计算机设备以及存储介质
CN110246033A (zh) 信贷风险监测方法、装置、设备及存储介质
CN116662987A (zh) 业务系统监控方法、装置、计算机设备及存储介质
US20220028008A1 (en) Signals-based data syndication and collaboration
US11810118B2 (en) Sandbox based testing and updating of money laundering detection platform
US10764253B2 (en) System for using metadata to identify and extract specific upstream data, provisioning data batches, and providing dynamic downstream data access
CN111861730A (zh) 风险报表预警系统及方法
CN117575777A (zh) 贷款决策方法、装置、设备及计算机可读存储介质
CN113177002B (zh) 基于测试点的测试设计方法、装置、电子设备和介质
US20230091063A1 (en) Systems and methods for real-time processing of resource requests
CN116150225A (zh) 数据字段处理方法、装置、设备、介质和程序产品
CN114881770A (zh) 基于区块链的交易数据处理方法、装置和服务器
US20230085144A1 (en) System and method for real-time management of data records
CN112446613A (zh) 外部接入客户端风控方法、装置、设备和存储介质
KR20220041395A (ko) Cltv를 활용한 부동산 리스크 관리를 수행하는 서버 및 이의 동작 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20827653

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20827653

Country of ref document: EP

Kind code of ref document: A1