Search

CN-122022816-A - Transaction risk user identification method, device, equipment and medium

CN122022816ACN 122022816 ACN122022816 ACN 122022816ACN-122022816-A

Abstract

The invention discloses a method, a device, equipment and a medium for identifying transaction risk users, which relate to the application in the fields of financial science and technology, information security and artificial intelligence, and comprise the steps of obtaining transaction behavior data respectively corresponding to a plurality of users to be identified, and constructing static feature vectors and dynamic feature sequences respectively corresponding to the transaction behavior data; summarizing all the static feature vectors into a static feature vector set, clustering the static feature vector set by using a preset clustering algorithm, identifying potential risk users in a clustering result, inputting dynamic feature sequences of the potential risk users into a pre-constructed long-period memory network model to obtain risk probabilities respectively corresponding to the potential risk users, identifying target risk users according to the risk probabilities, and carrying out risk early warning on the target risk users. The invention improves the accuracy of bank risk user identification and the real-time performance of early warning, and realizes the targets of active early warning and intelligent prevention and control of a bank wind control system.

Inventors

  • LU ZHENG

Assignees

  • 中国工商银行股份有限公司

Dates

Publication Date
20260512
Application Date
20260126

Claims (10)

  1. 1. A method for identifying a transaction risk user, comprising: acquiring transaction behavior data respectively corresponding to a plurality of users to be identified, and constructing static feature vectors and dynamic feature sequences respectively corresponding to the transaction behavior data; Summarizing all static feature vectors of users to be identified into a static feature vector set, clustering the static feature vector set by using a preset clustering algorithm, and identifying potential risk users in a clustering result; Respectively inputting dynamic characteristic sequences of all potential risk users into a pre-constructed long-short-period memory network model to obtain risk probabilities respectively corresponding to all the potential risk users; and identifying target risk users according to the risk probability of each potential risk user, and carrying out risk early warning on the target risk users.
  2. 2. The method of claim 1, wherein obtaining transaction behavior data corresponding to a plurality of users to be identified, respectively, and constructing a static feature vector and a dynamic feature sequence corresponding to each transaction behavior data, respectively, comprises: acquiring target transaction behavior data of a user to be identified with a target in a preset historical time interval; According to the target transaction behavior data statistics, obtaining a plurality of behavior statistics indexes of a target user to be identified in a preset historical time interval, and combining the behavior statistics indexes into a static feature vector, wherein the behavior statistics indexes comprise historical transaction total amount, average transaction frequency in a preset time unit, the number of used independent devices and transaction success rate; Extracting continuous transaction events of the target user to be identified in the preset historical time interval according to time sequence from target transaction behavior data; And respectively extracting event characteristics from each transaction event, and organizing each event characteristic into the dynamic characteristic sequence according to time sequence, wherein the event characteristics comprise a transaction time stamp, a single transaction amount and a transaction type code.
  3. 3. The method of claim 1, wherein the step of identifying potential risk users in the clustering result after clustering the set of static feature vectors using a preset clustering algorithm comprises: determining the clustering quantity through an elbow rule based on the static feature vector set; performing clustering processing on the static feature vector set by using the clustering quantity to obtain clusters with the quantity corresponding to the clustering quantity and cluster center vectors of each cluster; Calculating the matching degree of the clustering center vector of each cluster and the historical risk feature library, sequencing all clusters according to the sequence from high to low of the matching degree, and acquiring a preset number of target clusters with the front sequencing; The users to be identified, which correspond to the static feature vectors in the target cluster, are determined to be potential risk users; The historical risk feature library is obtained by statistical induction of static feature vectors based on historical high-risk user groups, and the preset number is an integer greater than or equal to 1.
  4. 4. The method of claim 1, wherein inputting the dynamic feature sequences of each potentially-risky user into the pre-built long-short-term memory network model, respectively, to obtain risk probabilities corresponding to each potentially-risky user, respectively, comprises: carrying out standardization processing on a target dynamic time sequence corresponding to a target potential risk user to obtain a standardized dynamic time sequence; inputting the standardized dynamic time sequence into a long-period memory network model, and extracting sequence high-level features containing long-period dependency; and inputting the sequence high-level feature vector to the long-short-term memory network model again, and calculating the risk probability of the target potential risk user through an activation function, wherein the value range of the risk probability is a continuous value between 0 and 1.
  5. 5. The method of any one of claims 1-4, wherein identifying a target risk user based on risk probabilities for each potentially risk user comprises: Comparing the risk probability of the target potential risk user with a preset dynamic threshold value; and determining the target potential risk user as a target risk user in the condition that the risk probability is larger than the dynamic threshold value.
  6. 6. The method of any one of claims 5, wherein risk pre-warning the target risk user comprises: Creating a structured risk early warning signal, wherein the risk early warning signal at least comprises a unique identifier of the target risk user, a risk triggering time stamp and a level that the risk probability of the target risk user exceeds a preset dynamic threshold; And pushing the assembled risk early warning signal to a preset risk disposal interface to perform risk auditing.
  7. 7. The method of claim 6, wherein the method further comprises: Calculating the current early warning accuracy index based on risk auditing results of all the completed risk early warning signals in a preset time window; And adaptively adjusting the dynamic threshold according to the deviation degree of the current early warning accuracy index and the target accuracy index.
  8. 8. An apparatus for identifying a transaction risk user, the apparatus comprising: the feature construction module is used for acquiring transaction behavior data respectively corresponding to a plurality of users to be identified and constructing static feature vectors and dynamic feature sequences respectively corresponding to the transaction behavior data; The potential risk user identification module is used for summarizing the static feature vectors of all users to be identified into a static feature vector set, carrying out clustering processing on the static feature vector set by using a preset clustering algorithm, and identifying potential risk users in a clustering result; The risk probability calculation module is used for respectively inputting dynamic feature sequences of all potential risk users into a pre-constructed long-short-period memory network model to obtain risk probabilities respectively corresponding to all the potential risk users; And the risk user identification module is used for identifying target risk users according to the risk probability of each potential risk user and carrying out risk early warning on the target risk users.
  9. 9. An electronic device, the electronic device comprising: And a memory communicatively coupled to the at least one processor, wherein the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform a transaction risk user identification method of any one of claims 1-7.
  10. 10. A computer readable storage medium storing computer instructions for causing a processor to perform the method of identifying a transaction risk user according to any one of claims 1-7.

Description

Transaction risk user identification method, device, equipment and medium Technical Field The invention relates to the technical field of machine learning, is suitable for application in the fields of financial science and technology, information security and artificial intelligence, in particular to a method, a device, equipment and a medium for identifying transaction risk users. Background In the digital economic age, user behavior data has become a core element for driving intelligent transformation of a financial risk control system. With the comprehensive online banking business, real-time transaction flow and continuous complexity of fraud, risk identification tasks face massive, high-dimensional and fast-evolving time sequence data challenges. Particularly in high-value business scenes such as high-frequency transaction, cross-border payment and the like, how to realize high-precision and high-interpretability risk detection on the premise of ensuring real-time response becomes a key technical problem to be overcome in the current intelligent wind control field. At present, the mainstream risk identification method mainly has three types of technical bottlenecks, namely ① model method based on rules and static characteristics relies on expert experience to manually define rules and characteristics, the model is solidified, and the dynamic evolution of a quick self-adaptive fraud strategy is difficult. ② An unsupervised cluster analysis method, which analyzes transient or statistical feature images based on user behaviors, lacks modeling capability for inherent time-series dependency relationships in a user behavior sequence. ③ The supervised deep learning model is used for solving the problems that when facing to a long-period multi-dimensional user behavior sequence in a financial scene, the long-term dependence capturing capability is insufficient and gradient disappearance or explosion is easy to occur. Meanwhile, the decision process of the deep learning model is usually used as a 'black box', the internal reasoning logic of the deep learning model is difficult to explain, and the strong supervision requirements of the interpretability and audit compliance of the financial industry wind control model decision cannot be met. Disclosure of Invention Based on the method, the device, the equipment and the medium for identifying the transaction risk user are provided by the invention, so that the problems that the conventional financial wind control scheme cannot effectively cope with the rapid dynamic evolution of the fraudulent behavior, lacks the deep analysis capability of the time sequence mode of the user behavior and is difficult to meet the requirement of supervision on the interpretation of the model are solved. In a first aspect, an embodiment of the present invention provides a method for identifying a transaction risk user, including: acquiring transaction behavior data respectively corresponding to a plurality of users to be identified, and constructing static feature vectors and dynamic feature sequences respectively corresponding to the transaction behavior data; Summarizing all static feature vectors of users to be identified into a static feature vector set, clustering the static feature vector set by using a preset clustering algorithm, and identifying potential risk users in a clustering result; Respectively inputting dynamic characteristic sequences of all potential risk users into a pre-constructed long-short-period memory network model to obtain risk probabilities respectively corresponding to all the potential risk users; and identifying target risk users according to the risk probability of each potential risk user, and carrying out risk early warning on the target risk users. In a second aspect, an embodiment of the present invention further provides an apparatus for identifying a transaction risk user, including: the feature construction module is used for acquiring transaction behavior data respectively corresponding to a plurality of users to be identified and constructing static feature vectors and dynamic feature sequences respectively corresponding to the transaction behavior data; The potential risk user identification module is used for summarizing the static feature vectors of all users to be identified into a static feature vector set, carrying out clustering processing on the static feature vector set by using a preset clustering algorithm, and identifying potential risk users in a clustering result; The risk probability calculation module is used for respectively inputting dynamic feature sequences of all potential risk users into a pre-constructed long-short-period memory network model to obtain risk probabilities respectively corresponding to all the potential risk users; And the risk user identification module is used for identifying target risk users according to the risk probability of each potential risk user and carrying out risk early warning on the target