CN113487407A

CN113487407A - Data processing method and device and electronic equipment

Info

Publication number: CN113487407A
Application number: CN202110746538.7A
Authority: CN
Inventors: 韩锐吉; 曹羽; 章文辉; 陈家隆
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2021-07-01
Filing date: 2021-07-01
Publication date: 2021-10-08

Abstract

The embodiment of the application discloses a data processing method, a data processing device and electronic equipment, and relates to the field of financial science and technology, wherein the method comprises the following steps: acquiring a target file, wherein the target file carries a plurality of transaction records and predetermined marks; the predetermined indicia is generated by a computer model and is used for representing the relevance of the target file and the non-compliant transaction behavior; acquiring an abnormal index set, wherein the abnormal index set comprises a plurality of abnormal index items; determining abnormal values of all abnormal index items of the target file according to a preset index calculation function and a plurality of transaction records; calling a preset threshold table, and acquiring a preset threshold corresponding to each abnormal index item from the threshold table; and taking the abnormal index item of which the abnormal value of the target file exceeds the preset threshold value as the abnormal index item hit by the target file. According to the scheme, the workload during final compliance judgment can be effectively reduced, and the problems of large data processing capacity and low judgment efficiency in the process of carrying out wrong judgment on the non-compliance file are solved.

Description

Data processing method and device and electronic equipment

Technical Field

The present application relates to the field of financial technology, and in particular, to a data processing method and apparatus, and an electronic device.

Background

In order to perform risk control on bank transactions, a suspicious transaction report is generally adopted, and the suspicious transaction report is generally a mode that a financial institution needs to report to a control center according to preset relevant indexes or under the condition that the financial institution judges that the money of a client performing transaction with the financial institution may have a control risk.

This results in a large number of suspect reports being reported each day because the number of transactions that the bank needs to process is large, but because these reports are themselves only suspect reports, further screening and reconciliation is required, and if the number is large, the identification increases the processing pressure of the screening and reconciliation.

How to improve the efficiency of checking the suspicious report has not been proposed yet.

Disclosure of Invention

The embodiment of the application aims to provide a data processing method, a data processing device and electronic equipment, so as to solve the problems of large workload and low efficiency of report discrimination.

To solve the above technical problem, an embodiment of the present specification provides a data processing method, including: acquiring a target file, wherein the target file carries a plurality of transaction records and predetermined marks; the predetermined indicia is generated by a computer model to characterize the target document as having an association with non-compliant transaction behavior; acquiring an abnormal index set, wherein the abnormal index set comprises a plurality of abnormal index items; determining abnormal values of abnormal index items of the target file according to a preset index calculation function and the transaction records; calling a preset threshold table, and acquiring preset thresholds corresponding to the abnormal index items from the threshold table; taking the abnormal index item of which the abnormal value of the target file exceeds a preset threshold value as the abnormal index item hit by the target file; and returning the hit abnormal index item of the target file, wherein the hit abnormal index item is used for determining whether the target file is in compliance.

An embodiment of the present specification further provides a data processing apparatus, including: the system comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring a target file, and the target file carries a plurality of transaction records and preset marks; the predetermined indicia is generated by a computer model to characterize the target document as having an association with non-compliant transaction behavior; the second acquisition module is used for acquiring an abnormal index set, wherein the abnormal index set comprises a plurality of abnormal index items; the first determining module is used for determining abnormal values of all abnormal index items of the target file according to a preset index calculation function and the transaction records; the third acquisition module is used for calling a preset threshold table and acquiring preset thresholds corresponding to all abnormal index items from the threshold table; the second determination module is used for taking the abnormal index item of which the abnormal value of the target file exceeds a preset threshold value as the hit abnormal index item of the target file; and the returning module is used for returning the hit abnormal index item of the target file, wherein the hit abnormal index item is used for determining whether the target file is in compliance.

The data processing method, the data processing device and the electronic device provided by the embodiment of the specification further determine whether the file marked as non-compliant is misjudged, determine whether an abnormal index item exists in the file according to a preset rule under the requirement, and return the abnormal index item of the file under the condition that the abnormal index item exists, that is, perform preprocessing and identification on the abnormal index item on the file marked as non-compliant, so that the workload of a final determination node in performing compliance determination can be effectively reduced.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, it is obvious that the drawings in the following description are only some embodiments described in the present application, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

FIG. 1 shows a schematic diagram of an application scenario of an embodiment of the present invention;

FIG. 2 illustrates a logical block diagram of a second electronic device;

FIG. 3 shows a flow diagram of a method of data processing according to an embodiment of the present description;

FIG. 4 shows a functional block diagram of a data processing apparatus according to an embodiment of the present description;

FIG. 5 illustrates a functional block diagram of an electronic device in accordance with an embodiment of the present description.

Detailed Description

In order to make those skilled in the art better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art without any inventive work based on the embodiments in the present application shall fall within the scope of protection of the present application.

Fig. 1 shows a schematic view of an application scenario of an embodiment of the present invention. In the application scenario, transaction records collected by different business systems (for example, the different business systems may be a personal financial basic business system, a bank card receipt business system, an online banking business system, and a telephone banking center business system) in a financial institution when a user conducts a transaction are collected to a first electronic device in the financial institution, data in the transaction records are input into a computer model (for example, a neural network model, a clustering algorithm model, etc.) to preliminarily determine which transaction records may correspond to non-compliant transaction behaviors, and the transaction records corresponding to the transaction behaviors possibly related to the same control risk or the same interpersonal relationship network are placed in the same file, the file is given a non-compliance mark, and the file is represented to have relevance with the non-compliant transaction behavior and reported to a second electronic device in the financial institution.

In order to prevent some transaction records corresponding to actually non-compliant transaction behaviors from being omitted, the judgment standard of the computer model is relatively strict, so that some transaction records corresponding to actually compliant transaction behaviors may be misjudged as non-compliant. To this end, files with non-compliant tags need to be further screened to determine if they are compliant.

The embodiment of the specification provides a data processing method which can be used for a second electronic device and is used for reducing the workload when non-compliant files are further screened. Fig. 2 shows a logical structure diagram of the second electronic device. The second electronic device comprises a service router, a plurality of calculation engines, an index calculation function file and a parameter table. The service router is responsible for managing the computing engines and distributing computing tasks to the appropriate computing engines for processing; the method comprises the following steps that a plurality of index calculation function files are generally provided, one index corresponds to one index calculation function, the processing of input data from the input data to the index obtaining requirement is defined in the index calculation function through a source program code, only the source code of one index calculation function is generally written in one index calculation function file, and all the index calculation function files are uniformly placed under a specific folder; the calculation engine has calculation capacity and is used for executing specific calculation tasks and calling index calculation functions from the index calculation function file in the process of executing the calculation tasks; the parameter table may include parameters required by the index calculation function during execution.

As shown in fig. 3, the data processing method includes the following steps.

S10: acquiring a target file, wherein the target file carries a plurality of transaction records and predetermined marks; the predetermined indicia is generated by a computer model to characterize the target document as having an association with non-compliant transaction behavior.

The target file in this step is the file given the non-compliance mark by the first electronic device, and the non-compliance mark is the predetermined mark in this step. The predetermined indicia (or non-compliant indicia) is generated by the computer model to merely characterize the target document as having a relationship to non-compliant transaction behavior and not to indicate that the target document has been determined to be a non-compliant document. Whether the target file is in compliance or not needs further discrimination.

Each transaction record carried in the target file corresponds to a sequential transaction behavior, and the value of each field in the transaction record is the original data acquired in the transaction behavior generation process, namely the value of each field is not processed. Because the transaction records of the target file are processed by the computer model, the values of all the fields in the transaction records should meet the format requirements of the fields, and data cleaning operations such as data filling, format conversion and the like do not need to be carried out on the values of the fields.

The computer model can adopt a big data analysis method to extract the transaction records corresponding to the transaction behaviors with possible control risks from the values of all the fields in the massive transaction records. The input of the computer model may be values of fields in a large number of transaction records, the output may be an identifier of the transaction record, and each field and value of the corresponding transaction record may be collected together according to the identifier to form the target file described in step S10.

The target file may be in the form of a table or a data lake. Step S10 may be to obtain a table or data lake when obtaining the target file.

S20: and acquiring an abnormal index set, wherein the abnormal index set comprises a plurality of abnormal index items.

Some of the abnormal indicators are shown in table 1 below, for example. In practical application, the names, the meanings and the corresponding threshold values of the abnormal index items can be formulated according to actual service scenes, and the detailed description is omitted.

TABLE 1

The abnormal index set may be a table stored in the second electronic device, and the obtaining of the abnormal index set is to read the table and copy contents in the table, and the table may also be opened and contents in the table modified by a file manager of the electronic device. Alternatively, the abnormal index set may be a set of fixed data written in the program code, each array member being an abnormal index entry.

S30: and determining abnormal values of all abnormal index items of the target file according to a preset index calculation function and a plurality of transaction records.

In step S30, the calculation engine calls a preset index calculation function to calculate each abnormal index item, so as to obtain an abnormal value.

Because the abnormal index items customized by different financial institutions for further screening the transaction records are different, the abnormal index set may only include all the abnormal index items customized by one financial institution, or may be all the abnormal index items customized by a plurality of financial institutions, so as to improve the application range of the method provided in the embodiment of the present specification.

S40: and calling a preset threshold table, and acquiring preset thresholds corresponding to the abnormal index items from the threshold table.

The threshold corresponding to one abnormal index item may be one (as shown in table 2), or two or more. For example, there may be two anomaly index terms that mean "the number of transfers in threshold 2 days exceeds threshold 1", where threshold 2 is 7 and threshold 1 is 20. Therefore, the number of the preset threshold values corresponding to one abnormal index item is determined by the meaning of the abnormal index item.

In some embodiments, the preset threshold may be embedded in the source program code and may not be modifiable by the screening person.

In some embodiments, the screening person may still be unable to determine whether the target file is compliant through the threshold corresponding to the abnormal index item, and may gradually increase or decrease the threshold and check the hit trend of the abnormal index item according to experience, or adjust the threshold to some determined threshold and check the hit trend of the abnormal index item, so that it is possible to determine whether the target file is compliant.

To this end, a user interaction interface may be provided to alter the threshold table. Specifically, the second electronic device receives an adjustment instruction uploaded through a user interaction interface, wherein the adjustment instruction carries an abnormal index item to be adjusted and a target value; and modifying the preset threshold of the abnormal index item to be adjusted in the threshold table into a target value according to the adjustment instruction.

S50: and taking the abnormal index item of which the abnormal value of the target file exceeds the preset threshold value as the abnormal index item hit by the target file.

S60: and returning the hit abnormal index item of the target file, wherein the hit abnormal index item is used for determining whether the target file is in compliance.

The returned results can be displayed on the WEB front end in an asynchronous query mode. Specifically, the invocation of a database instruction can be triggered through an Ajax (WEB data interaction mode) request in a source program code to query an abnormal index item stored in a database and a calculated abnormal value, and then a returned result is displayed on a WEB page.

In some embodiments, only the hit abnormal index entry of the target file may be returned without specially marking the hit abnormal index entry.

In some embodiments, all the abnormal index items may be returned, and the abnormal index items hit in the target file are specially marked, where the special mark may be a special color, for example, the name of the hit abnormal index item is displayed in a red font, or the text ground color of the hit abnormal index item is presented as a red color or a preset ground pattern, or may be in the form of an identifier mark, for example, a small red flag is placed beside the text of the hit abnormal index item, or is identified by the "hit" text, as shown in table 2 below.

In some embodiments, when returning the hit abnormal index item of the target file, a management and control risk item corresponding to the hit abnormal index item may also be returned. By introducing the abnormal indexes, the risk control items and the corresponding relations between the abnormal indexes and the risk control items, the fund transaction condition can be reflected from multiple angles, the abnormal points of the fund transaction can be accurately reflected, the accuracy and the effectiveness of processing are further improved, and the working efficiency is improved.

The corresponding relationship between the abnormal index items and the control risk items can be presented in a form of a table as shown in the following table 2, or in a form of a mind map, and the presentation mode can be diversified.

Table 2 below shows one way of presenting the returned target file hit anomaly indicators.

TABLE 2

In some embodiments, the abnormal index item, the control risk item and the corresponding relationship between the abnormal index item and the control risk item may be embedded and written in the source program code, and cannot be changed by a discriminator.

In some embodiments, different financial institutions pass different anomaly index terms; or judging the same management and control risk item through the combination of different abnormal index items; or the screening person still cannot determine whether the target file is in compliance through one corresponding relationship between the abnormal index item and the control risk item, and may need to adjust multiple corresponding relationships between the abnormal index item and the control risk item according to experience, observe the change of the corresponding relationships and hit the change condition of the control risk item corresponding to the index, and then determine whether the target file is in compliance.

Therefore, a parameter table can be set to store the corresponding relation between the management and control risk item and the abnormal index item, and a user interaction interface is set to change the parameter table. Specifically, the second electronic device receives an adjustment instruction uploaded through a user interaction interface, wherein the adjustment instruction carries an abnormal index item to be adjusted and a target management and control risk item corresponding to the abnormal index item; and modifying the control risk item corresponding to the abnormal index item to be adjusted in the parameter table into a target control risk item according to the adjustment instruction.

The data processing method provided by the embodiment of the specification is used for further judging whether the file marked as non-compliant is misjudged, under the requirement, whether an abnormal index item exists in the file is determined according to a preset rule, and the abnormal index item of the file is returned under the condition that the abnormal index item exists, namely, the file marked as non-compliant is subjected to preprocessing and identification of the abnormal index item, so that the workload of final judgment nodes in compliance judgment is effectively reduced.

In some embodiments, the respective anomaly index entries may be calculated directly from the raw fields in the transaction record. Because the transaction records in the target folder are from different business systems (for example, the different business systems can be a personal finance basic business system, a bank card receipt business system, an online banking business system and a telephone banking center business system), the transaction fields collected by the systems are different, therefore, public fields of the transaction records collected by the different business systems can be extracted first, and each abnormal index item is calculated according to the public fields.

Table 3 below shows some common fields that the transaction record may include, along with the meaning of the field representations, examples. The transaction record may also include other fields, which are not listed one by one here.

TABLE 3

Field(s)	Meaning of field representation	Examples of the invention
			The local client number	The unique identification number of the bank customer.	“123456789123456”
Name of the own client	For displaying the customer name.	'Zhang san'
			Account/card number of the local client	And (4) auxiliary information. For verifying the situation.	“400123456789”
Coin kind	The currency is traded.	"RMB"
			Lending mark	Borrowing: an influx of funds; loan: outflow of funds	Borrowing money
Date of transaction	Date of transaction	20210302
			Transaction time	Transaction time	14:49:23
Amount of transaction	Amount of transaction	5000.00
			Counter account/cardNumber (C)	Account/card number of counterparty of transaction	6222021332013984320
Name of opposite party	Transaction-counterparty account name	Li Si
			Additional words of trade	Additional words of trade	WeChat transfer

However, as the transaction record often does not show the type of customer (i.e. whether the customer belongs to an individual or a company), the industry, which type of third party transaction, which type of cash transaction (e.g. ATM withdrawal, cash deposit, bank card withdrawal, bank card deposit, other types, such as face-punch, withdrawal), which type of card (e.g. debit or credit card). The transaction information cannot be directly obtained from the original field of the transaction record, and if the original field is directly adopted to calculate the abnormal index item, the processing logic of the index calculation function becomes more complex. These extension fields may be a customer type (which may include the customer type of the present customer and/or the opposing customer), an industry affiliated, a type of third party transaction, a type of cash transaction, a type of card.

The transaction record typically includes a comment field, which is typically a piece of text, perhaps two or three words, the form in which the transaction is recorded, etc. In the case that the extension field is the type of the third party transaction, the type extension field of the third party transaction may be extracted by: determining a preset keyword set, wherein each keyword in the keyword set is used for identifying a type of third party transaction; retrieving keywords in a set of keywords in a comment field of a transaction record; in the case that a keyword in the keyword set is retrieved, the retrieved keyword is used as an extension field of the transaction record. The following keywords may be included in the keyword set: WeChat transfer, WeChat change cash withdrawal, WeChat red envelope, merchant settlement, bank entrance, payment service, Payment treasury transfer, Payment treasury withdrawal, Payment treasury consumption, QQ wallet withdrawal and QQ red envelope.

The transaction record typically includes a comment field, the transaction comment is typically a piece of text, perhaps two or three words, the form of the recorded transaction, etc. In the case where the extension field is a type of cash transaction, the type extension field of the cash transaction may be extracted by: acquiring a preset keyword set, wherein each keyword in the keyword set is used for identifying a cash transaction type; retrieving keywords in a set of keywords in a comment field of a transaction record; in the case that a keyword in the keyword set is retrieved, the retrieved keyword is used as an extension field of the transaction record. The following keywords may be included in the keyword set: ATM withdrawal, cash deposit, bank card withdrawal, face-brushing deposit and face-brushing withdrawal.

The transaction record usually includes the field of the opposite card number and the local card number, and the card numbers are all corresponding to the bin rule, and the bin rule refers to the corresponding relation between the value of the preset position in the card number and the area to which the card belongs, and the corresponding relation between the value of the preset position and the type of the card. For example, the bank card with 621645 in the first 6 bits is a debit card of pakistan, the bank card with 621647 in the first 6 bits is a credit card of russia, the bank card with 62165 in the first 5 bits is a debit card of X city, and the bank cards with 6216501, 6216502 and 6216503 in the first 7 bits are debit cards of three regions under the jurisdiction of X city respectively.

In the case where the extension field is a type of the card, the type extension field of the card may be extracted by: and acquiring a preset card bin rule, and matching the card number in the transaction record with the preset card bin rule to determine the type of the card corresponding to the card number in the transaction record.

Specifically, when the card number is the own card number, the card bin rule of the own account number is determined, and the own card number can be directly matched with the card bin rule, so that the type of the card corresponding to the own card number is determined. When the card number is the opposite card number, because the bin rules of different banks are different, the bank needs to call the corresponding bin rule according to the opposite card number, and then the opposite card number is matched with the bin rule, so as to determine the type of the card corresponding to the opposite card number.

In addition, extension fields such as a bank name and a bank card account opening province branch can be extracted according to the bin rule, the bank name extension field can be used for calculating cross-bank related indexes, and the bank card account opening province branch extension field can be used for calculating cross-regional related indexes.

Besides the above extension fields, the extension fields extracted from the transaction record can also be used for extracting extension fields such as the type of the client, the industry to which the client belongs and the like.

Specifically, keyword matching can be performed on the name of the client through a regular expression according to the characteristics of the name field of the client in the transaction record, and whether the client belongs to an individual client or a public client is marked according to the matched keyword. In the embodiment of the present specification, the public client is also referred to as a company client, and refers to a legal client having a business relationship with a bank.

In practical application, the client name may have various features, and the extraction rule and the related regular expression can be formulated according to the specific features of the client name. For example, table 4 below shows a partial example of correspondence of the features of the partial customer name field to the extracted customer type.

TABLE 4

Characteristics of the customer name field	Type of client
		The client name contains "·", for example, a Xinjiang home client: gulinazae baihe	Personal client
The length of the client name is less than 4	Personal client
		The client name includes: LTD, COMPANY, CO.	To public client

Specifically, the client name can be subjected to keyword matching through the regular expression according to keywords contained in the client name field in the transaction record, and the industry to which the client belongs can be marked according to the matched keywords. In the embodiment of the present specification, the public client is also referred to as a company client, and refers to a legal client having a business relationship with a bank.

In practical application, the corresponding relation between the keywords contained in the client name and the industry can be set by self. Table 5 below shows some examples of keywords contained in the client name and the industry to which the client belongs.

TABLE 5

Keywords contained in the client name	Business to which the client belongs
		Gold, metallurgy, mining, jewelry, nonferrous metals, mineral products	Gold or mining industry
Waste, recovered and regenerated resource	Waste article
		Medicine and drug	Medicine and food additive

For third-party payment companies such as Payment treasure (China) network technology limited company, Payment science and technology limited company and the like, as the names of the third-party payment companies are fixed and can be found through network resources, the names of the third-party payment companies can be downloaded from the network to form a parameter table and are updated periodically, and when the name of a customer is the same as one of the parameter table, the industry to which the customer belongs is determined to be the third-party payment company.

The above content shows the specific extraction methods of five extension fields, and table 6 below collectively shows these extension fields and their descriptions and the value examples of the extracted extension fields.

TABLE 6

Extension field	Description of extension field	Extended field examples
			Type of client	Indicating whether a transactor is a public client or an individual client	Personal
The related industries	Trade for marking trade opponents	Science and technology company "
			Third party transaction type	Indicating specific types of third party transactions	WeChat transfer
Type of cash transaction	Indicating specific types of cash transactions	ATM withdrawal
			Counterparty card type	Indicating the type of transaction-counterpart card	Credit card

The embodiment of the present specification provides a data processing apparatus, which can be used to implement the data processing method described in fig. 3. As shown in fig. 4, the apparatus includes a first obtaining module 10, a second obtaining module 20, a first determining module 30, a third obtaining module 40, a second determining module 50, and a returning module 60.

The first obtaining module 10 is configured to obtain a target file, where the target file carries a plurality of transaction records and predetermined marks; the predetermined indicia is generated by a computer model to characterize the target document as having an association with the non-compliant transaction activity. The second obtaining module 20 is configured to obtain an abnormal index set, where the abnormal index set includes a plurality of abnormal index items. The first determining module 30 is configured to determine abnormal values of abnormal index items of the target file according to a preset index calculation function and a plurality of transaction records. The third obtaining module 40 is configured to call a preset threshold table, and obtain a preset threshold corresponding to each abnormal index item from the threshold table. The second determining module 50 is configured to use the abnormal index item of which the abnormal value of the target file exceeds the preset threshold as the abnormal index item hit by the target file. The returning module 60 is used for returning the hit abnormal index item of the target file, wherein the hit abnormal index item is used for determining whether the target file is in compliance.

In some embodiments, the data processing apparatus further comprises a receiving module and a modifying module. The receiving module is used for receiving an adjusting instruction uploaded through a user interaction interface, wherein the adjusting instruction carries an abnormal index item to be adjusted and a target value. The modification module is used for modifying the preset threshold of the abnormal index item to be adjusted in the threshold table into the target value according to the adjustment instruction.

The related description and effects of the data processing apparatus can be understood by referring to the data processing method, and are not described in detail.

An embodiment of the present invention further provides an electronic device, as shown in fig. 5, the electronic device may include a processor 51 and a memory 52, where the processor 51 and the memory 52 may be connected by a bus or in another manner, and fig. 5 takes the connection by the bus as an example.

The processor 51 may be a Central Processing Unit (CPU). The Processor 51 may also be other general purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components, or combinations thereof.

The memory 52, which is a non-transitory computer readable storage medium, may be used for storing non-transitory software programs, non-transitory computer executable programs, and modules, such as program instructions/modules corresponding to the data processing method in the embodiment of the present invention (for example, the first obtaining module 10, the second obtaining module 20, the first determining module 30, the third obtaining module 40, the second determining module 50, and the returning module 60 shown in fig. 4). The processor 51 executes various functional applications and data processing of the processor by executing non-transitory software programs, instructions and modules stored in the memory 52, that is, implements the data processing method in the above method embodiment.

The memory 52 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function; the storage data area may store data created by the processor 51, and the like. Further, the memory 52 may include high speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid state storage device. In some embodiments, the memory 52 may optionally include memory located remotely from the processor 51, and these remote memories may be connected to the processor 51 via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The one or more modules are stored in the memory 52 and, when executed by the processor 51, perform the data processing method in the embodiment shown in fig. 3.

The details of the electronic device may be understood with reference to the corresponding related description and effects in the embodiment of fig. 3, and are not described herein again.

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by a computer program, which can be stored in a computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. The storage medium may be a magnetic Disk, an optical Disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a Flash Memory (Flash Memory), a Hard Disk (Hard Disk Drive, abbreviated as HDD), a Solid State Drive (SSD), or the like; the storage medium may also comprise a combination of memories of the kind described above.

In the 50 s of the 20 th century, improvements in a technology could clearly be distinguished between improvements in hardware (e.g., improvements in circuit structures such as diodes, transistors, switches, etc.) and improvements in software (improvements in process flow). However, as technology advances, many of today's process flow improvements have been seen as direct improvements in hardware circuit architecture. Designers almost always obtain the corresponding hardware circuit structure by programming an improved method flow into the hardware circuit. Thus, it cannot be said that an improvement in the process flow cannot be realized by hardware physical modules. For example, a Programmable Logic Device (PLD), such as a Field Programmable Gate Array (FPGA), is an integrated circuit whose Logic functions are determined by programming the Device by a user. A digital system is "integrated" on a PLD by the designer's own programming without requiring the chip manufacturer to design and fabricate a dedicated integrated circuit chip 2. Furthermore, nowadays, instead of manually making an Integrated Circuit chip, such Programming is often implemented by "logic compiler" software, which is similar to a software compiler used in program development and writing, but the original code before compiling is also written by a specific Programming Language, which is called Hardware Description Language (HDL), and HDL is not only one but many, such as abel (advanced Boolean Expression Language), ahdl (alternate Language Description Language), traffic, pl (core unified Programming Language), HDCal, JHDL (Java Hardware Description Language), langue, Lola, HDL, laspam, hardbyscript Description Language (vhr Description Language), and the like, which are currently used by Hardware compiler-software (Hardware Description Language-software). It will also be apparent to those skilled in the art that hardware circuitry that implements the logical method flows can be readily obtained by merely slightly programming the method flows into an integrated circuit using the hardware description languages described above.

The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments can be referred to each other, and each embodiment focuses on the differences from the other embodiments.

The systems, devices, modules or units described in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions.

For convenience of description, the above devices are described as being divided into various units by function, and are described separately. Of course, the functionality of the units may be implemented in one or more software and/or hardware when implementing the present application.

From the above description of the embodiments, it is clear to those skilled in the art that the present application can be implemented by software plus necessary general hardware platform. Based on such understanding, the technical solutions of the present application may be essentially or partially implemented in the form of software products, which may be stored in a storage medium, such as ROM/RAM, magnetic disk, optical disk, etc., and include instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods of some parts of the embodiments of the present application.

The application is operational with numerous general purpose or special purpose computing system environments or configurations. For example: personal computers, server computers, hand-held or portable devices, tablet-type devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.

The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

Although the present application has been described in terms of embodiments, those of ordinary skill in the art will recognize that there are numerous variations and permutations of the present application without departing from the spirit of the application, and it is intended that the appended claims encompass such variations and permutations without departing from the spirit of the application.

Claims

1. A data processing method, comprising:

acquiring a target file, wherein the target file carries a plurality of transaction records and predetermined marks; the predetermined indicia is generated by a computer model to characterize the target document as having an association with non-compliant transaction behavior;

acquiring an abnormal index set, wherein the abnormal index set comprises a plurality of abnormal index items;

determining abnormal values of abnormal index items of the target file according to a preset index calculation function and the transaction records;

calling a preset threshold table, and acquiring preset thresholds corresponding to the abnormal index items from the threshold table;

taking the abnormal index item of which the abnormal value of the target file exceeds a preset threshold value as the abnormal index item hit by the target file;

and returning the hit abnormal index item of the target file, wherein the hit abnormal index item is used for determining whether the target file is in compliance.

2. The method of claim 1, further comprising:

receiving an adjusting instruction uploaded through a user interaction interface, wherein the adjusting instruction carries an abnormal index item to be adjusted and a target value;

and modifying the preset threshold of the abnormal index item to be adjusted in the threshold table into the target value according to the adjusting instruction.

3. The method according to claim 1, wherein before determining the abnormal value of each abnormal index item of the target file according to a preset index calculation function and the plurality of transaction records, the method further comprises:

extracting an extension field from the transaction record for determining an outlier value of the respective anomaly indicator, wherein the extension field includes at least one of: customer type, industry of the owner, type of third party transaction, type of cash transaction, type of card.

4. The method of claim 3, wherein in the case that the extension field is a type of third party transaction, extracting the extension field from the transaction record comprises:

acquiring a preset keyword set, wherein each keyword in the keyword set is used for identifying a type of a third-party transaction;

retrieving keywords in the set of keywords in a comment field of a transaction record;

and in the case that the keywords in the keyword set are retrieved, taking the retrieved keywords as the extension fields of the transaction records.

5. The method of claim 3, wherein extracting the extended field from the transaction record in the event the extended field is of a type of cash transaction comprises:

acquiring a preset keyword set, wherein each keyword in the keyword set is used for identifying a cash transaction type;

6. The data processing method of claim 3, wherein extracting the extended field from the transaction record in the case that the extended field is a type of card comprises:

calling a preset bin rule;

matching the card number in the transaction record with the preset card bin rule to determine the type of the card corresponding to the transaction record;

and taking the type of the card corresponding to the determined transaction record as an extension field of the transaction record.

7. A data processing apparatus, comprising:

the system comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring a target file, and the target file carries a plurality of transaction records and preset marks; the predetermined indicia is generated by a computer model to characterize the target document as having an association with non-compliant transaction behavior;

the second acquisition module is used for acquiring an abnormal index set, wherein the abnormal index set comprises a plurality of abnormal index items;

the first determining module is used for determining abnormal values of all abnormal index items of the target file according to a preset index calculation function and the transaction records;

the third acquisition module is used for calling a preset threshold table and acquiring preset thresholds corresponding to all abnormal index items from the threshold table;

the second determination module is used for taking the abnormal index item of which the abnormal value of the target file exceeds a preset threshold value as the hit abnormal index item of the target file;

and the returning module is used for returning the hit abnormal index item of the target file, wherein the hit abnormal index item is used for determining whether the target file is in compliance.

8. The apparatus of claim 7, further comprising:

the system comprises a receiving module, a processing module and a processing module, wherein the receiving module is used for receiving an adjusting instruction uploaded through a user interaction interface, and the adjusting instruction carries an abnormal index item to be adjusted and a target value;

and the modification module is used for modifying the preset threshold of the abnormal index item to be adjusted in the threshold table into the target value according to the adjustment instruction.

9. An electronic device, comprising:

a memory and a processor, the processor and the memory being communicatively connected to each other, the memory having stored therein computer instructions, the processor implementing the steps of the method of any one of claims 1 to 6 by executing the computer instructions.

10. A computer storage medium storing computer program instructions which, when executed, implement the steps of the method of any one of claims 1 to 6.