WO2021174966A1

WO2021174966A1 - Risk identification model training method and apparatus

Info

Publication number: WO2021174966A1
Application number: PCT/CN2020/138205
Authority: WO
Inventors: 平野
Original assignee: 支付宝(杭州)信息技术有限公司
Priority date: 2020-03-05
Filing date: 2020-12-22
Publication date: 2021-09-10
Also published as: CN111291900A

Abstract

Disclosed are a risk identification model training method and apparatus. The risk identification model comprises a main body model (11) and a plurality of scenario models (12-1, 12-2, ..., 12-N) corresponding to a plurality of transaction scenarios, and a plurality of classifiers (13-1, 13-2, ..., 13-N). The training method comprises: determining a first transaction scenario corresponding to a first transaction event in a training sample set, and extracting event features of the first transaction event (22); then, dividing the event features into a common feature portion and a first scenario feature portion according to a predetermined common feature set and a first scenario feature set (23); next, inputting the common feature portion into a main body model (11), inputting the first scenario feature portion into a first scenario model in the plurality of scenario models (12-1, 12-2, ..., 12-N) that corresponds to the first scenario, and obtaining a first predicted risk by means of a corresponding first classifier (24); according to the first prediction risk and a first risk label corresponding to the first transaction event, obtaining a first predicted loss corresponding to the first transaction event (25); and training a risk identification model according to the synthesis of predicted losses respectively corresponding to a plurality of sample transaction events (26).

Description

Method and device for training risk identification model

Technical field

One or more embodiments of this specification relate to the field of machine learning, and more particularly to methods and devices for training risk identification models.

Background technique

With the development of computer technology, machine learning has been applied to various technical fields for analyzing and predicting various business data. When electronic transactions and electronic payments have been widely used, the application of artificial intelligence to electronic payment analysis and identification of security risks has become an important goal.

The security risks of electronic payment mainly include the risk of embezzlement and fraud. The risk of embezzlement involves the use of account numbers, cards, and payment codes. Fraud risks include cash out and money laundering. Once an unsafe transaction event occurs, it will bring losses to users' funds, and also greatly threaten the security, stability and user experience of electronic transactions and payment platforms. Therefore, the identification of security risks in electronic payment is very important.

However, as electronic payment platforms provide more and more service content, electronic payment scenarios are becoming more and more complicated, and there are more and more types of unsafe transaction events in various scenarios. This is a variety of unsafe transactions. The identification of the event brings great difficulties. On the other hand, electronic transaction events have a strong timeliness and offensive and defensive nature, which further increases the difficulty of accurately identifying the security risks of transaction events.

Therefore, it is hoped that there will be an improved scheme to evaluate the security of transaction events more accurately and effectively and identify unsafe transaction events.

Summary of the invention

One or more embodiments of this specification describe a method and device for training a risk identification model. Through multi-task learning, a risk identification model suitable for multiple scenarios can be trained to accurately and effectively deal with transactions in various scenarios. The security of the event is evaluated and unsafe transaction events are identified.

According to the first aspect, a method for training a risk identification model is provided. The risk identification model is used to identify the security risk of a transaction event, and includes a subject model, a plurality of scene models, and a plurality of corresponding classifiers. Each scenario model corresponds to multiple transaction scenarios; the method includes: obtaining a training sample set, which includes multiple sample transaction events and their respective corresponding risk labels, wherein the multiple sample transaction events come from different transaction scenarios; For any first transaction event among the plurality of sample transaction events, determine its corresponding first transaction scenario, and extract the event characteristics of the first transaction event; corresponding to the first transaction scenario according to a predetermined set of common features The first scene feature set of the event feature is divided into a common feature part and a first scene feature part, wherein the common feature set includes features that the multiple transaction scenarios have; and the common feature part is input to the office In the subject model, the first scene feature part is input into the first scene model corresponding to the first scene among the plurality of scene models, and the first scene model for the first transaction event is obtained through the corresponding first classifier 1. Predicted risk; obtain the first predicted loss corresponding to the first transaction event according to the first predicted risk and the first risk label corresponding to the first transaction event; according to each of the multiple sample transaction events corresponding The synthesis of the predicted loss, and the training of the risk identification model.

In different embodiments, the multiple transaction scenarios described above include at least a part of the following scenarios: transfer to account, transfer to card, credit card repayment, recharge scenario, withdrawal scene, red envelope scenario, external merchant call, intimate payment, life payment, Virtual commodity trading.

In different implementations, the above-mentioned shared feature set may include one or more of the following: identity features, transaction behavior features, transaction environment features, equipment features, and relationship features.

According to one embodiment, the agent model includes several agent decision trees, and the first scenario model includes several first decision trees; in this case, the first predicted risk for the first transaction event is obtained in the following manner : Obtain the subject score corresponding to the subject leaf node where the first transaction event falls in the plurality of subject decision trees, and the subject leaf node is determined according to the common feature part; The first score corresponding to the first leaf node that falls in the plurality of first decision trees, the first leaf node is determined according to the first scene feature part; the subject is evaluated by the first classifier The score and the first score are integrated to obtain a comprehensive score, and the first predicted risk is obtained according to the comprehensive score.

According to one embodiment, the risk identification model is implemented by a neural network, the subject model corresponds to the subject network, and the first scene model corresponds to the first network part; The first predicted risk of the first transaction event: Obtain the first vector obtained by processing the common feature part by the main network; Obtain the second vector obtained by processing the first scene feature part by the first network part Vector; the first vector and the second vector are synthesized by the first classifier to obtain a synthesized result, and the first predicted risk is obtained according to the synthesized result.

According to an embodiment, the above method further includes: acquiring a plurality of newly added candidate features; screening the plurality of newly added candidate features to obtain a number of newly added features; using the newly added features to update the common Feature sets, and/or scene feature sets respectively corresponding to the multiple transaction scenarios; using the updated common feature set and scene feature set to retrain the risk identification model.

Further, in an example of the above-mentioned implementation manner, the screening is performed in the following manner: a first screening is performed based on the information value IV of each of the multiple newly added candidate features; The second screening is performed on the correlation coefficient of, and the several new features are obtained.

In one embodiment, every predetermined time period, the newly-added candidate features in the time period are acquired as the aforementioned multiple newly-added candidate features.

According to a second aspect, a device for training a risk identification model is provided, the risk identification model is used to identify the security risk of a transaction event, and includes a subject model, a plurality of scene models, and a plurality of corresponding classifiers. Each scenario model corresponds to multiple transaction scenarios; the device includes: a sample set obtaining unit configured to obtain a training sample set, which includes a plurality of sample transaction events and their respective corresponding risk labels, the plurality of sample transaction events are from In different transaction scenarios; the feature extraction unit is configured to determine the corresponding first transaction scenario for any first transaction event among the plurality of sample transaction events, and extract the event characteristics of the first transaction event; feature division Unit, configured to divide the event feature into a common feature part and a first scene feature part according to a predetermined common feature set and a first scene feature set corresponding to the first transaction scenario, wherein the common feature set includes all The features of the multiple transaction scenarios; a prediction unit configured to input the common feature part into the main body model, and input the first scene feature part into the multiple scene models corresponding to the first scene According to the first scenario model, the first predicted risk for the first transaction event is obtained through the corresponding first classifier; the loss determination unit is configured to be based on the first predicted risk and the corresponding first transaction event The first risk label obtains the first predicted loss corresponding to the first transaction event; the training unit is configured to train the risk identification model according to the synthesis of the predicted losses corresponding to each of the multiple sample transaction events.

According to a third aspect, there is provided a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method of the first aspect.

According to a fourth aspect, there is provided a computing device, including a memory and a processor, characterized in that executable code is stored in the memory, and when the processor executes the executable code, the method of the first aspect is implemented .

According to the description of the embodiments of this specification, a multi-scenario and multi-task risk identification model is trained through sample transaction events in different scenarios. The risk identification model includes a main model part common to each scene and a scene model part dedicated to each scene. Since each scene shares the main model part, it is possible to transfer learning between each scene, share the processing results of some features, and achieve better prediction effects for multiple tasks in multiple scenarios. Further, based on offensive and defensive considerations, the above-mentioned risk identification model can be updated and automatically managed.

Description of the drawings

In order to explain the technical solutions of the embodiments of the present application more clearly, the following will briefly introduce the drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. A person of ordinary skill in the art can obtain other drawings based on these drawings without creative work.

Fig. 1 shows a schematic structural diagram of a risk identification model according to an embodiment;

Figure 2 shows a method of training a risk identification model according to an embodiment;

Fig. 3 shows a schematic diagram of the relationship between features and scenes according to an embodiment;

Fig. 4 shows a schematic diagram of training a risk identification model according to an embodiment;

Figure 5 shows a method of updating a risk identification model in one embodiment;

Fig. 6 shows a schematic block diagram of an apparatus for training a risk recognition model according to an embodiment.

Detailed ways

The following describes the solutions provided in this specification with reference to the accompanying drawings.

As mentioned above, in order to ensure the user's payment security and the service stability of the electronic payment platform, it is necessary to identify the security risks in electronic transactions. However, for the sake of improving user experience, electronic payment platforms provide more and more service content, and electronic payment scenarios are becoming more and more abundant. For example, in Alipay, multiple payment scenarios are provided, such as transfer to account, transfer to card, credit card repayment, recharge, cash withdrawal, red envelope, life payment, external merchant call, intimate payment, and so on. Research has found that each scenario has its own unique scenario characteristics, but if a model is established for each scenario to identify transaction risks, on the one hand, training and managing a large number of models requires considerable costs, on the other hand, some The number of samples in niche scenes is small, so it is difficult to separately train a model with high prediction accuracy for such scenes. However, if a universal model is established uniformly for various scenes, the unique scene characteristics of each scene cannot be used, making the accuracy of the universal model unsatisfactory.

Based on the above considerations, the inventor proposes to train a risk identification model suitable for each scenario by adopting a multi-task learning method, with a main body model plus a sub-scenario model of each scenario as the framework. The risk identification model can be designed to identify specific types of risks in transaction events, such as the risk of embezzlement.

Fig. 1 shows a schematic structural diagram of a risk identification model according to an embodiment. As shown in Figure 1, the risk identification model includes a main body model 11, N scene models 12-1, 12-2,..., 12-N, and corresponding N multiple classifiers 13-1, 13-2,... ,13-N, where N scene models correspond to N transaction scenes respectively.

The main body model 11 is used to process the characteristics common to each transaction scenario. By analyzing each transaction scenario in advance, and combining with risk identification targets (such as identifying the risk of embezzlement or fraud) for feature screening, a set of common features can be determined, which includes the common features of each transaction scenario and the risk identification. Multiple characteristics of information value.

Specifically, in different embodiments, the shared feature set may include one or more of the following features: identity features, transaction behavior features, transaction environment features, equipment features, relationship features, and so on.

More specifically, the identity features may include the basic attributes of the payment user, such as gender, age, occupation, income, registration time, education level, and so on. In an example, the identity characteristics may also include the characteristics of the financial assets of the payment user, such as the balance of Yu'ebao, the number of recent consumptions, the consumption amount, and so on.

Transaction behavior characteristics may include, for example, transaction amount, transaction duration, and transaction behavior trajectory, such as the entrance to the transaction interface, the operation trajectory during the transaction, and so on. In an example, the characteristics of the transaction behavior may also include the type of the most recent operation before the target transaction behavior, the page operated, the stay time, and so on.

The characteristics of the transaction environment may include the characteristics of the geographic environment and/or the network environment through which the transaction is used, for example, geographic location information, IP address, wifi identification, and so on.

Device characteristics can include hardware and software information of the device used for the transaction, such as device MAC address, smartphone SIM card serial number, UMID, APDID, and other hardware identification information, and/or operating system, system version, APP version, etc. Software information.

The relationship characteristics may include the information of the payment user in the pre-established crowd relationship network, such as the number of friends, the frequency of communication with friends, the type of communication, and so on. In an embodiment, the crowd relationship network may be constructed as a relationship graph. At this time, the relationship feature can include the graph feature of the payment user in the relationship graph. The graph feature can include low-level graph features such as the degree of a node, or can include high-level graph features based on graph embedding processing. Graph features, such as high-level features generated by the aggregation of neighbor nodes.

The common feature set may also include features common to other transaction scenarios, and we will not enumerate them one by one here.

The N scene models 12-1, 12-2,..., 12-N respectively correspond to N transaction scenes, and are used to process differentiated scene features that are not included in the above-mentioned common feature set in each transaction scene. Specifically, the aforementioned N transaction scenarios may include multiple scenarios in the following scenarios: transfer to account, transfer to card, credit card repayment, recharge scenario, withdrawal scene, red envelope scenario, external merchant call, intimate payment, virtual commodity transaction, etc. Wait. In different scenes, the content of differentiated scene features is different.

Specifically, for the scenario of transferring money to an account, the differentiated scenario features handled by the corresponding scenario model may include the identity features of the user corresponding to the receiving account, such as the gender, age, occupation, income, registration time, and duration of the receiving user. Basic attributes such as education level, the relationship between the payment account and the collection account, the receipt and payment records of the two, and so on.

For the credit card repayment scenario, the corresponding differentiated scenario features may include the characteristics of the credit history of the paying user, such as sesame points, loan records, repayment records, and so on.

For the recharge scenario, the corresponding differentiated scenario feature may include the recharge object identifier, such as mobile phone number, recharge record, total recharge amount in the most recent month, and so on.

It can be understood that different scenes have different differentiated scene characteristics, and we will not enumerate them one by one here.

As shown in Figure 1, N scene models 12-1, 12-2,..., 12-N correspond to N classifiers 13-1, 13-2,..., 13-N, respectively. The i-th classifier is used to The subject model obtains the processing results for the common features, and obtains the processing results for the scene features in the i-th scene from the corresponding i-th scene model, and combines the two results to identify the risk of the transaction event in the i-th scene, for example Output its risk level category.

In different embodiments, the main body model and each scene model can be implemented by various specific models. For example, in one example, the risk identification model is implemented as a whole through a tree model, such as a gradient boosting decision tree GBDT model; correspondingly, the subject model and each scene model can be implemented as several decision trees. In another example, the risk recognition model is implemented as a whole through a neural network, such as a deep neural network DNN; correspondingly, the subject model and each scene model can each be implemented as a multi-layer perceptron composed of several layers of neurons. Depending on the number of features processed by each, the subject model and each scene model may have the same or different network widths and/or network depths.

In the above model architecture, risk identification of transaction events in multiple scenarios can be regarded as multiple different tasks. However, these multiple tasks are not independent of each other. When the corresponding multiple classifiers classify different tasks, It depends not only on the processing of the scene model, but also on the processing results of the main model common to each scene. Therefore, multiple tasks use a common subject model to achieve joint learning and training, so that tasks in various scenarios can perform migration learning with each other and share the processing results of common features, thereby realizing risk identification in each scenario.

The training process of the above risk identification model is described below.

Fig. 2 shows a method of training a risk recognition model according to an embodiment. It can be understood that the method can be executed by any device, device, platform, or device cluster with computing and processing capabilities, and the risk identification model has the structure described above in conjunction with FIG. 1. As shown in Figure 2, the method of training a risk recognition model includes at least the following steps.

In step 21, a training sample set is obtained, which includes a plurality of sample transaction events and their respective corresponding risk labels, wherein the plurality of sample transaction events come from different transaction scenarios.

As mentioned above, different transaction scenarios can include transfer to account, transfer to card, credit card repayment, recharge, cash withdrawal, red envelope, life payment, external merchant call, intimate payment, and so on. Depending on the usage status of different transaction scenarios, the number of sample transaction events from each transaction scenario is generally different. For scenarios where users use more frequently, a larger number of sample transaction events can be obtained; for niche scenarios where users use less frequently, the number of sample transaction events may be very small. For example, suppose that a sample set composed of a batch of training samples includes 1000 sample transaction events. Under normal circumstances, there are hundreds of sample transaction events in some scenarios, while there are only dozens or even dozens of sample transaction events in some scenarios. less. This is exactly one reason why building a model for each scene alone cannot achieve good results.

Generally, the risk label of a sample transaction event is used to show the true risk status of the sample transaction event. In different embodiments, the risk label may be a binary label, for example, 0 means no risk, 1 means risk, or a multi-value label, and different label values indicate different risk levels.

Then, the risk identification model to be trained is used to predict each sample transaction event in the above training sample set one by one. For clarity and simplicity of description, any sample transaction event in the training sample set is referred to as the first transaction event, and the first transaction event is described in combination.

As shown in FIG. 2, in step 22, the first transaction scenario corresponding to any first transaction event is determined, and the event characteristics of the first transaction event are extracted.

It can be understood that when collecting a sample of a transaction event as a training sample, it is possible to add a scene label to it according to the scene from which the transaction event originated. Correspondingly, according to the scene label of the above-mentioned first transaction event, the corresponding scene can be determined, which is called the first transaction scene. In addition, for the first transaction event, the event feature can be extracted based on the feature item determined through feature screening in advance.

Then, in step 23, according to the predetermined common feature set and the first scene feature set corresponding to the first transaction scenario, the above-mentioned event feature is divided into a common feature part and a first scene feature part. As mentioned earlier, the common feature set includes features that are shared by multiple transaction scenarios. The first scene feature set includes the features in the first scene that are not included in the common feature set.

Fig. 3 shows a schematic diagram of the relationship between features and scenes according to an embodiment. As shown in Figure 3, the horizontal representation of the table in the schematic diagram represents the scene to which a feature applies, and the vertical representation of the table represents the features required by a scene. Only when a feature is applicable to all scenes, that is, all entries in the row corresponding to the feature are selected (shown shaded), the feature is included in the common feature set. For each scene, remove the features belonging to the common feature set from all the features it needs, and then the scene feature set corresponding to the scene can be obtained. Generally speaking, before the model training starts, the relationship diagram shown in FIG. 3 can be obtained by analyzing in advance, and based on the relationship diagram, the common feature set and the scene feature set of each scene can be obtained.

For the above-mentioned first transaction event, on the basis of determining its corresponding first scene, the first scene feature set can be obtained. According to the aforementioned predetermined common feature set and the first scene feature set, the event feature of the first transaction event can be divided into a common feature part and a first scene feature part.

Then, next, in step 24, the above-mentioned common feature part is input into the main body model in the risk identification model, and the first scene feature part is input into the first scene model corresponding to the first scene among the plurality of scene models, and pass the corresponding first scene model. A classifier obtains the first predicted risk for the first transaction event.

Fig. 4 shows a schematic diagram of training a risk identification model according to an embodiment. In Fig. 4, a thick solid line schematically shows the process of processing the first transaction event by the risk identification model. It can be seen that for the first transaction event, it is assumed that the corresponding first scene model is scene model 2. In step 24, the common feature part is input to the main model, and the main model processes it to obtain the first processing result; the first scene feature part is input to the scene model 2, and the scene model 2 processes this part of the feature to obtain the second process result. The corresponding classifier 2 synthesizes the first processing result and the second processing result, and outputs the predicted risk for the first transaction event.

In one embodiment, the risk identification model is implemented as a tree model such as GBDT. In this case, the agent model may include several agent decision trees, and the first scene model includes several first decision trees. Correspondingly, the main body model's processing of the shared feature part may include, according to the feature value of each feature in the shared feature part, traversing along the above-mentioned several main body decision trees, and determining that the first transaction event falls into the above-mentioned several main body decision trees. And obtain the subject score corresponding to the first transaction event according to the score corresponding to each subject leaf node.

The processing of the first scene feature part by the first scene model may include, according to the feature value of each feature in the first scene feature part, traversing along the above-mentioned several first decision trees, and determining that the first transaction event is in the above-mentioned several first decision trees. The leaf nodes that fall in the decision tree are determined, and the first score corresponding to the first transaction event is obtained according to the score corresponding to each leaf node.

Therefore, the first classifier, such as the classifier 2 in FIG. 4, can synthesize the subject score output by the subject model and the first score output by the first scene model to obtain a comprehensive score. In different embodiments, the first classifier can synthesize the subject score and the first score through various methods such as summation, weighted summation, and average value, to obtain a comprehensive score. Finally, the first classifier can determine the predicted risk of the first transaction event based on the comprehensive score.

In another embodiment, the aforementioned risk identification model is implemented by a neural network, for example, a DNN deep neural network. In this case, the agent model corresponds to the agent network, and the first scene model corresponds to the first network part. Correspondingly, the processing of the common feature part by the main body model may include calculating the characteristic value of each common feature through the neurons of each layer in the main network to obtain the first processing result. The first processing result may be a processing value, but more typically, the first processing result output by the main body network is embodied as a vector, which is called the first vector.

The processing of the first scene feature part by the first scene model may include calculating the feature value of each feature in the first scene feature through neurons in each layer in the first network part to obtain the second processing result. The second processing result is usually embodied as a second vector.

In this case, the first classifier corresponding to the first scene can also be implemented using a neural network layer, for example, it can be embodied in several fully connected layers. The fully connected layer receives the above-mentioned first processing result output by the main network and the second processing result output by the first network part, and performs fusion processing on them. In the case where the first processing result and the second processing result are embodied as vectors, the fusion processing may include operations such as vector splicing, addition, weighted summation, and bitwise multiplication, and a combination of these operations. Then, the fully connected layer determines and outputs the first predicted risk for the first transaction event by applying a softmax function, for example, according to the fusion result.

In the case that the risk identification model is implemented in other specific model forms, the first classifier similarly synthesizes the first processing result output by the subject model and the second processing result output by the first scene model. The first predicted risk of a trading event.

Then, in step 25, according to the first predicted risk output by the first classifier and the first risk label corresponding to the first transaction event, the first predicted loss corresponding to the first transaction event is obtained. The first predicted loss is used to measure the difference between the predicted result of the first transaction event by the risk identification model and its true risk.

As above, the risk identification model is used to predict the risk of the first transaction event, and the predicted loss is obtained. It can be understood that the above-mentioned first transaction event is any sample transaction event in the training sample set. For other sample transaction events, similar predictions can be made and the corresponding predicted losses can be obtained.

For example, FIG. 4 also schematically shows another sample transaction event, for example, a prediction process called a second transaction event, as shown by the thick dashed line in the figure. It can be seen that the second transaction event corresponds to the second scenario, which is exemplarily represented as scenario N in FIG. 4, which is different from the scenario of the first transaction event. Correspondingly, for the second transaction event, input the common feature part of its event characteristics into the main body model, input the second scene feature part corresponding to the second scene into the second scene model (model N), and use the corresponding first The second classifier (classifier N) outputs the predicted risk of the second transaction event, and then obtains its corresponding predicted loss.

Through the above method, the predicted loss corresponding to each sample transaction event in the training sample set can be obtained. By integrating each prediction loss, the total prediction loss corresponding to the training sample set can be obtained.

Therefore, in step 26, the risk identification model is trained based on the synthesis of the predicted loss corresponding to each sample transaction event in the training sample set, that is, the above-mentioned total predicted loss. Specifically, the parameters of the risk identification model can be adjusted in the direction in which the total predicted loss is reduced, and the parameters of the risk identification model can be optimized and trained.

In this way, through sample transaction events from different scenarios, a risk identification model that can predict multiple tasks in multiple scenarios can be trained. It can be seen that since each scene shares the main model part, it is possible to transfer learning between each scene and share the processing results of some features. For example, the use of sample transaction events in a high-frequency scene with relatively abundant samples can enable the subject model to be well trained. For scenes with a small sample size, you can focus on the prediction based on the processing results of the main model part to achieve a better prediction effect.

Furthermore, the inventor also found that electronic transaction events have strong timeliness and offensive and defensive nature. This is reflected in the fact that on the one hand, new types of unsafe incidents emerge in an endless stream, and the form of security risks changes very rapidly; on the other hand, bad users who intentionally initiate unsafe incidents may be identified based on the evaluation results of the existing safety evaluation system. Develop some evaluation rules, and then deliberately bypass these evaluation rules to implement new unsafe incidents. The above-mentioned timeliness and offensive and defensive nature often make the safety assessment system unable to deal with new types of unsafe events, resulting in a decrease in recognition performance.

For this reason, on the basis of the risk identification model trained above, according to an embodiment of this specification, the risk identification model is further updated. Figure 5 shows a method of updating the risk identification model in one embodiment.

As shown in Fig. 5, first in step 51, a number of newly added candidate features are obtained. In an example, the above-mentioned new candidate feature may be a feature that is discovered, precipitated, and added to the feature pool by analyzing the types of newly emerging risk events. In another example, the aforementioned newly added candidate feature may also be a newly added derivative feature obtained through a feature combination tool based on an existing feature. In one embodiment, every predetermined time period, the newly added candidate features in the time period are acquired.

Then in step 52, the above-mentioned multiple new candidate features are screened to obtain several new features. Feature screening can be performed based on multiple indicators for evaluating feature availability, such as feature information value IV, information gain ratio, correlation coefficient, Gini coefficient, and so on.

In a specific example, the candidate features can be screened based on the combination of the feature IV value and the correlation coefficient. Specifically, the first screening may be performed based on the information value IV of each of the aforementioned multiple newly added candidate features. The first screening may include removing features with IV values below a certain threshold, and retaining features with IV values above the threshold. Then, based on the correlation coefficients between each new candidate feature, a second screening is performed to obtain several new features. The second screening may include, if the correlation coefficient between a feature and any other feature is greater than a predetermined correlation threshold, then removing the feature. Alternatively, the second screening may also include, if the correlation coefficient between the two features is greater than a predetermined correlation threshold, then the two features with a lower IV value are eliminated. It is also possible to perform feature screening based on other principles to obtain several new features.

Then, in step 53, the above-mentioned newly added features are used to update the common feature set and/or the scene feature sets corresponding to multiple transaction scenarios. In this step, the newly-added features can be added to the feature-scene relationship chart as shown in FIG. 3, so as to determine that each newly-added feature belongs to a common feature set or a certain scene feature set. In this way, the common feature set and/or the scene feature set on which the risk identification model is based are updated.

Then, in step 54, use the updated common feature set and scene feature set to retrain the risk identification model. In this way, the latest feature set can be used to update the risk identification model so that it can adapt to new types of risk events.

Further, for the updated risk identification model, its performance can be evaluated, the evaluation result can be automatically output, and the evaluation result can be compared with the model before the update. If the performance is improved, the updated risk identification model will be automatically launched; if there is no significant improvement, the original model will remain unchanged. This can greatly reduce the cost of manpower management while improving the performance and effect of the model.

Recalling the above process, in the embodiments of this specification, a multi-scenario and multi-task risk identification model is trained through sample transaction events in different scenarios. Scene model part. Since each scene shares the main model part, it is possible to transfer learning between each scene, share the processing results of some features, and achieve better prediction effects for multiple tasks in multiple scenarios. Further, based on offensive and defensive considerations, the above-mentioned risk identification model can be updated and automatically managed.

According to another embodiment, a device for training a risk identification model is provided, wherein the risk identification model is used to identify the security risk of a transaction event, and includes a subject model, a plurality of scene models, and a plurality of corresponding classifiers The multiple scenario models correspond to multiple transaction scenarios; the training device for training the risk identification model can be deployed in any device, platform or device cluster with computing and processing capabilities. Fig. 6 shows a schematic block diagram of an apparatus for training a risk recognition model according to an embodiment. As shown in FIG. 6, the device 600 includes the following units.

The sample set obtaining unit 61 is configured to obtain a training sample set, which includes a plurality of sample transaction events and their respective corresponding risk labels, and the plurality of sample transaction events come from different transaction scenarios;

The feature extraction unit 62 is configured to determine the corresponding first transaction scenario for any first transaction event among the plurality of sample transaction events, and extract the event feature of the first transaction event;

The feature dividing unit 63 is configured to divide the event feature into a common feature part and a first scene feature part according to a predetermined common feature set and a first scene feature set corresponding to the first transaction scenario, wherein the common feature The set includes the characteristics of the multiple transaction scenarios;

The prediction unit 64 is configured to input the common feature part into the main body model, input the first scene feature part into a first scene model corresponding to the first scene among the plurality of scene models, and pass the corresponding The first classifier obtains the first predicted risk for the first transaction event;

The loss determining unit 65 is configured to obtain the first predicted loss corresponding to the first transaction event according to the first predicted risk and the first risk label corresponding to the first transaction event;

The training unit 66 is configured to train the risk identification model according to the synthesis of the predicted loss corresponding to each of the multiple sample transaction events.

In different embodiments, the multiple transaction scenarios include at least a part of the following scenarios: transfer to account, transfer to card, credit card repayment, recharge scenario, withdrawal scene, red envelope scenario, external merchant call, intimate payment, and life payment , Virtual commodity trading.

In various embodiments, the shared feature set may include one or more of the following: identity feature, transaction behavior feature, transaction environment feature, equipment feature, relationship feature.

According to one embodiment, the above-mentioned subject model includes several subject decision trees, and the first scene model includes several first decision trees; in this case, the prediction unit 64 is specifically configured to:

Acquiring the subject scores corresponding to the subject leaf nodes that the first transaction event falls in the plurality of subject decision trees, the subject leaf nodes being determined according to the common feature part;

Acquiring a first score corresponding to a first leaf node in which the first transaction event falls in the plurality of first decision trees, the first leaf node being determined according to the first scene feature part;

The subject score and the first score are synthesized by the first classifier to obtain a comprehensive score, and the first predicted risk is obtained according to the comprehensive score.

In another embodiment, the risk identification model is implemented by a neural network, the subject model corresponds to the subject network, and the first scene model corresponds to the first network part; in this case, the prediction unit 64 is specifically configured for:

Acquiring the first vector obtained by the main network processing the common feature part;

Acquiring a second vector obtained by processing the first scene feature part by the first network part;

The first vector and the second vector are synthesized by the first classifier to obtain a synthesized result, and the first predicted risk is obtained according to the synthesized result.

According to an embodiment, the device 600 further includes an update unit 67, the update unit further includes (not shown): a feature acquisition module configured to acquire multiple new candidate features; a feature screening module configured to A number of new candidate features are screened to obtain several new features; the feature update module is configured to use the new features to update the set of common features, and/or the scene features corresponding to the multiple transaction scenarios. The model update module is configured to use the updated common feature set and scene feature set to retrain the risk identification model.

In one embodiment, the above-mentioned feature screening module is configured to: perform a first screening based on the information value IV of each of the multiple newly added candidate features; and perform the first screening based on the correlation coefficient between each newly added candidate feature Second, screening to obtain the several new features.

In one embodiment, the feature acquisition module is configured to acquire newly added candidate features in the time period every predetermined time period.

Through the above devices, through multi-task learning, a risk identification model suitable for various trading scenarios can be trained, and the model can be updated.

According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method described in conjunction with FIG. 2.

According to an embodiment of still another aspect, there is also provided a computing device, including a memory and a processor, the memory is stored with executable code, and when the processor executes the executable code, it implements the method described in conjunction with FIG. 2 method.

Those skilled in the art should be aware that, in one or more of the foregoing examples, the functions described in this application can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on the computer-readable medium.

The specific implementations described above further describe the purpose, technical solutions and beneficial effects of this application in detail. It should be understood that the above are only specific implementations of this application and are not intended to limit the scope of this application. The scope of protection, any modification, equivalent replacement, improvement, etc. made on the basis of the technical solution of this application shall be included in the scope of protection of this application.

Claims

A method for training a risk identification model. The risk identification model is used to identify the security risk of a transaction event, and includes a subject model, a plurality of scene models and a plurality of corresponding classifiers, the plurality of scene models corresponding to a plurality of Transaction scenario; the method includes:

Obtaining a training sample set, which includes a plurality of sample transaction events and their respective corresponding risk labels, wherein the plurality of sample transaction events are from different transaction scenarios;

For any first transaction event among the plurality of sample transaction events, determine its corresponding first transaction scenario, and extract the event characteristics of the first transaction event;

According to a predetermined common feature set and a first scene feature set corresponding to the first transaction scenario, the event feature is divided into a common feature part and a first scene feature part, wherein the common feature set includes the multiple transactions The characteristics of the scene;

The common feature part is input into the main body model, the first scene feature part is input into a first scene model corresponding to the first scene among the plurality of scene models, and the corresponding first classifier is used to obtain the target The first predicted risk of the first transaction event;

Obtaining a first predicted loss corresponding to the first transaction event according to the first predicted risk and the first risk label corresponding to the first transaction event;

Training the risk identification model according to the synthesis of the predicted losses corresponding to each of the multiple sample transaction events.
The method according to claim 1, wherein the multiple transaction scenarios include at least a part of the following scenarios: transfer to account, transfer to card, credit card repayment, recharge scenario, withdrawal scene, red envelope scenario, external merchant call, Intimate payment, life payment, virtual commodity trading.
The method according to claim 1, wherein the set of common features includes one or more of the following: identity features, transaction behavior features, transaction environment features, equipment features, and relationship features.
The method according to claim 1, wherein the subject model includes a plurality of subject decision trees, and the first scene model includes a plurality of first decision trees;

The obtaining the first predicted risk for the first transaction event through the corresponding first classifier includes:

Acquiring the subject scores corresponding to the subject leaf nodes that the first transaction event falls in the plurality of subject decision trees, the subject leaf nodes being determined according to the common feature part;

Acquiring a first score corresponding to a first leaf node in which the first transaction event falls in the plurality of first decision trees, the first leaf node being determined according to the first scene feature part;

The subject score and the first score are synthesized by the first classifier to obtain a comprehensive score, and the first predicted risk is obtained according to the comprehensive score.
The method according to claim 1, wherein the risk identification model is implemented by a neural network, the subject model corresponds to the subject network, and the first scene model corresponds to the first network part;

The obtaining the first predicted risk for the first transaction event through the corresponding first classifier includes:

Acquiring the first vector obtained by the main network processing the common feature part;

Acquiring a second vector obtained by processing the first scene feature part by the first network part;

The first vector and the second vector are synthesized by the first classifier to obtain a synthesized result, and the first predicted risk is obtained according to the synthesized result.
The method according to claim 1, further comprising:

Obtain multiple new candidate features;

Screen the multiple newly added candidate features to obtain a number of newly added features;

Update the common feature set and/or the scene feature set corresponding to the multiple transaction scenes by using the newly added feature;

Using the updated common feature set and scene feature set, the risk identification model is retrained.
The method according to claim 6, wherein the multiple newly-added candidate features are screened to obtain several newly-added features, including:

Perform the first screening based on the respective information value IV of the multiple newly added candidate features;

Based on the correlation coefficients between the various newly added candidate features, a second screening is performed to obtain the several newly added features.
The method according to claim 6, wherein obtaining a plurality of newly added candidate features comprises:

Every predetermined time period, the newly added candidate features in the time period are acquired.
A device for training a risk identification model, the risk identification model is used to identify the security risks of a transaction event, and includes a main body model, a plurality of scene models and a plurality of corresponding classifiers, the plurality of scene models corresponding to a plurality of Transaction scenario; the device includes:

The sample set obtaining unit is configured to obtain a training sample set, which includes a plurality of sample transaction events and their respective corresponding risk labels, and the plurality of sample transaction events come from different transaction scenarios;

The feature extraction unit is configured to determine the corresponding first transaction scenario for any first transaction event among the plurality of sample transaction events, and extract the event feature of the first transaction event;

The feature dividing unit is configured to divide the event feature into a common feature part and a first scene feature part according to a predetermined common feature set and a first scene feature set corresponding to the first transaction scenario, wherein the common feature set Including the characteristics of the multiple transaction scenarios;

The prediction unit is configured to input the common feature part into the main body model, input the first scene feature part into a first scene model corresponding to the first scene among the plurality of scene models, and pass the corresponding first scene model A classifier obtains the first predicted risk for the first transaction event;

A loss determining unit configured to obtain a first predicted loss corresponding to the first transaction event according to the first predicted risk and a first risk label corresponding to the first transaction event;

The training unit is configured to train the risk identification model according to the synthesis of the predicted losses corresponding to each of the multiple sample transaction events.
The device according to claim 9, wherein the multiple transaction scenarios include at least part of the following scenarios: transfer to account, transfer to card, credit card repayment, recharge scenario, withdrawal scene, red envelope scenario, external merchant call, Intimate payment, life payment, virtual commodity trading.
The device according to claim 9, wherein the set of common features includes one or more of the following: identity features, transaction behavior features, transaction environment features, equipment features, and relationship features.
The device according to claim 9, wherein the agent model includes a plurality of agent decision trees, and the first scene model includes a plurality of first decision trees;

The prediction unit is specifically configured as:

Acquiring the subject scores corresponding to the subject leaf nodes that the first transaction event falls in the plurality of subject decision trees, the subject leaf nodes being determined according to the common feature part;

Acquiring a first score corresponding to a first leaf node in which the first transaction event falls in the plurality of first decision trees, the first leaf node being determined according to the first scene feature part;

The subject score and the first score are synthesized by the first classifier to obtain a comprehensive score, and the first predicted risk is obtained according to the comprehensive score.
The device according to claim 9, wherein the risk identification model is implemented by a neural network, the subject model corresponds to the subject network, and the first scene model corresponds to the first network part;

The prediction unit is specifically configured as:

Acquiring the first vector obtained by the main network processing the common feature part;

Acquiring a second vector obtained by processing the first scene feature part by the first network part;

The first vector and the second vector are synthesized by the first classifier to obtain a synthesized result, and the first predicted risk is obtained according to the synthesized result.
The apparatus according to claim 9, further comprising an update unit, the update unit comprising:

The feature acquisition module is configured to acquire multiple new candidate features;

The feature screening module is configured to screen the multiple newly-added candidate features to obtain several newly-added features;

A feature update module configured to use the newly added feature to update the common feature set, and/or the scene feature set corresponding to each of the multiple transaction scenarios;

The model update module is configured to use the updated common feature set and scene feature set to retrain the risk identification model.
The device according to claim 14, wherein the feature screening module is configured to:

Perform the first screening based on the respective information value IV of the multiple newly added candidate features;

Based on the correlation coefficients between the various newly added candidate features, a second screening is performed to obtain the several newly added features.
The method according to claim 14, wherein the feature acquisition module is configured to:

Every predetermined time period, the newly added candidate features in the time period are acquired.
A computer-readable storage medium having a computer program stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method of any one of claims 1-8.
A computing device, comprising a memory and a processor, characterized in that executable code is stored in the memory, and when the processor executes the executable code, the method described in any one of claims 1-8 is implemented. method.