KR102756688B1 - System and method for managing risks based on abnormal signs by determining abnormal signs based on financial data using artificial intelligence - Google Patents

Abstract

The embodiments present a system and method for determining anomalies based on financial data using artificial intelligence and managing risks according to the anomalies. A server for managing risks according to one embodiment may include a data processing unit that generates traffic information for managing overload risks based on order data and generates monitoring index information for managing transaction risks based on transaction data, an overload risk management unit that determines risk information on data traffic volume through a first risk management model using a first neural network based on the traffic information and generates a message related to overload risks based on the risk information, a transaction risk management unit that determines a probability for each of a plurality of abnormal transaction types through a second risk management model using a second neural network based on the monitoring index information and the risk information and generates a message related to transaction risks based on the occurrence probability for each of the plurality of abnormal transaction types, and a risk management message transmission unit that transmits the message related to the overload risk and the message related to the transaction risk to a manager terminal.

Description

{SYSTEM AND METHOD FOR MANAGING RISKS BASED ON ABNORMAL SIGNS BY DETERMINING ABNORMAL SIGNS BASED ON FINANCIAL DATA USING ARTIFICIAL INTELLIGENCE}

Embodiments of the present disclosure relate to a system and method for determining abnormal signs based on financial data using artificial intelligence and managing risks based on the abnormal signs.

Recently, as interest in stock and virtual currency trading has increased, the number of cases where not only experts but also ordinary people are actively participating in stock trading has increased. Cyber trading, which allows online trading of stocks or virtual currency through networks such as the Internet, has become widespread. Accordingly, securities companies and exchanges are providing HTS (Home Trading System) so that users can easily trade through networks, and due to the spread of mobile devices such as smartphones, transactions using MTS (Mobile Trading System) as well as HTS are rapidly increasing. Through these online systems, individual stock trading has become more active than offline trading in the past.

However, as interest in stocks and cryptocurrencies has increased recently, various errors may occur. For example, if the data traffic that the server can handle exceeds the threshold, the server can no longer process data, which may cause a system error. In addition, if the current data traffic volume exceeds the maximum processing capacity of the server, the server may be interrupted, which may result in damage such as users not being able to sell when the price of a specific item falls, or transactions being concluded at a different price than the price set by the user due to a server error.

Meanwhile, as the complexity and volume of recent financial transactions have increased rapidly, the demand for early detection of abnormal signs that may occur in the financial system and risk management systems based on these is increasing. The system that detects abnormal signs of such financial transactions and predicts risks aims to monitor transaction patterns in real time and determine abnormal transactions by utilizing data analysis technology and artificial intelligence models. In particular, in the financial market where high-frequency transactions and large-volume transactions frequently occur, an effective system that can prevent this is necessary because abnormal signs can cause large losses if they are not detected in time.

Existing financial anomaly detection systems are mainly designed to detect abnormal transactions based on fixed criteria based on statistical models. However, this method has limitations in that it lacks the ability to adapt to data changes and cannot sufficiently reflect various transaction patterns that occur in real time. In addition, fixed risk management methods are inefficient and the system lacks flexibility in situations where different responses are required depending on specific types of abnormal transactions. This may result in lower accuracy in risk prediction and insufficient security of the financial system.

Accordingly, a system and method that uses artificial intelligence to determine abnormal signs based on financial data and manage risks based on abnormal signs are needed.

Embodiments of the present disclosure can provide a system and method for determining abnormal signs based on financial data using artificial intelligence and managing risks according to the abnormal signs.

The technical tasks to be achieved in the embodiments are not limited to those mentioned above, and other technical tasks not mentioned can be considered by a person having ordinary skill in the art from the various embodiments described below.

A server for managing risks according to one embodiment may include a data processing unit which generates traffic information for managing overload risk based on order data and generates monitoring index information for managing transaction risk based on transaction data, an overload risk management unit which determines risk information on data traffic volume through a first risk management model using a first neural network based on the traffic information and generates a message related to overload risk based on the risk information, a transaction risk management unit which determines a probability for each of a plurality of abnormal transaction types through a second risk management model using a second neural network based on the monitoring index information and the risk information and generates a message related to transaction risk based on the occurrence probability for each of the plurality of abnormal transaction types, and a risk management message transmission unit which transmits the message related to overload risk and the message related to transaction risk to an administrator terminal.

According to embodiments, the server determines risk information on the amount of data traffic through a first risk management model using a first neural network, and provides a message related to the risk of overload to an administrator terminal according to the risk information, thereby preventing various network risks due to overload of the server.

According to embodiments, the server determines the probability for each of a plurality of abnormal transaction types through a second risk management model using a second neural network based on monitoring indicator information and risk information for managing transaction risk based on transaction data, and provides a message related to transaction risk to the administrator terminal according to the probability for each of a plurality of abnormal transaction types. That is, by determining the probability of occurrence of abnormal transactions in real time through artificial intelligence, the prediction accuracy for abnormal transactions can be improved and the safety of the financial system can be guaranteed.

The effects that can be obtained from the examples are not limited to the effects mentioned above, and other effects that are not mentioned can be clearly derived and understood by a person having ordinary skill in the art based on the detailed description below.

The accompanying drawings, which are included as part of the detailed description to aid in understanding the embodiments, provide various embodiments and, together with the detailed description, describe technical features of the various embodiments.
FIG. 1 is a diagram showing the configuration of an electronic device according to one embodiment.
Figure 2 is a diagram showing the configuration of a program according to one embodiment.
FIG. 3 illustrates a system that uses artificial intelligence to determine abnormal signs based on financial data and manages risks based on the abnormal signs, according to one embodiment.
Figure 4 is a diagram showing the main components of a server that uses artificial intelligence to determine abnormal signs based on financial data and manages risks based on abnormal signs.
FIG. 5 illustrates an example of a gated recurrent unit (GRU) model used in the first risk management model and the second risk management model according to one embodiment.
Figure 6 is a block diagram showing the hardware configuration of a server according to one embodiment.

The following embodiments are combinations of the components and features of the embodiments in a given form. Each component or feature may be considered optional unless otherwise explicitly stated. Each component or feature may be implemented in a form that is not combined with other components or features. In addition, some components and/or features may be combined to form various embodiments. The order of operations described in various embodiments may be changed. Some components or features of one embodiment may be included in another embodiment, or may be replaced with corresponding components or features of another embodiment.

In the description of the drawings, procedures or steps that may obscure the gist of the various embodiments are not described, and procedures or steps that can be understood by a person with ordinary skill in the art are also not described.

Throughout the specification, when a part is said to "comprising" or "including" a component, this does not mean that other components are excluded, but rather that other components can be included, unless otherwise stated. Furthermore, terms such as "part," "unit," "module," etc. described in the specification mean a unit that processes at least one function or operation, which may be implemented by hardware, software, or a combination of hardware and software. Furthermore, terms such as "a" or "an," "one," "the," and similar related words may be used in the context of describing various embodiments (especially in the context of the claims below) to include both the singular and the plural, unless otherwise indicated herein or clearly contradicted by context.

Hereinafter, embodiments according to various embodiments will be described in detail with reference to the attached drawings. The detailed description set forth below together with the attached drawings is intended to explain exemplary embodiments of various embodiments and is not intended to represent the only embodiment.

In addition, specific terms used in various embodiments are provided to help understanding of various embodiments, and the use of such specific terms may be changed in other forms without departing from the technical spirit of various embodiments.

FIG. 1 is a diagram showing the configuration of an electronic device according to one embodiment.

FIG. 1 is a block diagram of an electronic device (101) in a network environment (100) according to various embodiments. Referring to FIG. 1, in the network environment (100), the electronic device (101) may communicate with the electronic device (102) via a first network (198) (e.g., a short-range wireless communication network), or may communicate with at least one of the electronic device (104) or the server (108) via a second network (199) (e.g., a long-range wireless communication network). According to one embodiment, the electronic device (101) may communicate with the electronic device (104) via the server (108). According to one embodiment, the electronic device (101) may include a processor (120), a memory (130), an input module (150), an audio output module (155), a display module (160), an audio module (170), a sensor module (176), an interface (177), a connection terminal (178), a haptic module (179), a camera module (180), a power management module (188), a battery (189), a communication module (190), a subscriber identification module (196), or an antenna module (197). In some embodiments, the electronic device (101) may omit at least one of these components (e.g., the connection terminal (178)), or may have one or more other components added. In some embodiments, some of these components (e.g., the sensor module (176), the camera module (180), or the antenna module (197)) may be integrated into one component (e.g., the display module (160)). The electronic device (101) may also be referred to as a client, terminal, or peer.

The processor (120) may control at least one other component (e.g., a hardware or software component) of an electronic device (101) connected to the processor (120) by executing, for example, software (e.g., a program (140)), and may perform various data processing or calculations. According to one embodiment, as at least a part of the data processing or calculations, the processor (120) may store a command or data received from another component (e.g., a sensor module (176) or a communication module (190)) in a volatile memory (132), process the command or data stored in the volatile memory (132), and store result data in a nonvolatile memory (134). According to one embodiment, the processor (120) may include a main processor (121) (e.g., a central processing unit or an application processor) or an auxiliary processor (123) (e.g., a graphics processing unit, a neural processing unit (NPU), an image signal processor, a sensor hub processor, or a communication processor) that can operate independently or together with the main processor (121). For example, when the electronic device (101) includes a main processor (121) and an auxiliary processor (123), the auxiliary processor (123) may be configured to use less power than the main processor (121) or to be specialized for a given function. The auxiliary processor (123) may be implemented separately from the main processor (121) or as a part thereof.

The auxiliary processor (123) may control at least a portion of functions or states associated with at least one of the components of the electronic device (101) (e.g., the display module (160), the sensor module (176), or the communication module (190)), for example, on behalf of the main processor (121) while the main processor (121) is in an inactive (e.g., sleep) state, or together with the main processor (121) while the main processor (121) is in an active (e.g., application execution) state. In one embodiment, the auxiliary processor (123) (e.g., an image signal processor or a communication processor) may be implemented as a part of another functionally related component (e.g., a camera module (180) or a communication module (190)). In one embodiment, the auxiliary processor (123) (e.g., a neural network processing unit) may include a hardware structure specialized for processing artificial intelligence models.

The artificial intelligence model can be generated through machine learning. Such learning can be performed, for example, in the electronic device (101) on which the artificial intelligence model is executed, or can be performed through a separate server (e.g., server (108)). The learning algorithm can include, for example, supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning, but is not limited to the examples described above. The artificial intelligence model can include a plurality of artificial neural network layers. The artificial neural network can be one of a deep neural network (DNN), a convolutional neural network (CNN), a recurrent neural network (RNN), a restricted Boltzmann machine (RBM), a deep belief network (DBN), a bidirectional recurrent deep neural network (BRDNN), deep Q-networks, or a combination of two or more of the above, but is not limited to the examples described above. An artificial intelligence model may additionally or alternatively include a software structure in addition to a hardware structure.

The memory (130) can store various data used by at least one component (e.g., processor (120) or sensor module (176)) of the electronic device (101). The data can include, for example, software (e.g., program (140)) and input data or output data for commands related thereto. The memory (130) can include volatile memory (132) or nonvolatile memory (134).

The program (140) may be stored as software in memory (130) and may include, for example, an operating system (142), middleware (144), or an application (146).

The input module (150) can receive commands or data to be used in a component of the electronic device (101) (e.g., a processor (120)) from an external source (e.g., a user) of the electronic device (101). The input module (150) can include, for example, a microphone, a mouse, a keyboard, a key (e.g., a button), or a digital pen (e.g., a stylus pen).

The audio output module (155) can output an audio signal to the outside of the electronic device (101). The audio output module (155) can include, for example, a speaker or a receiver. The speaker can be used for general purposes such as multimedia playback or recording playback. The receiver can be used to receive an incoming call. According to one embodiment, the receiver can be implemented separately from the speaker or as a part thereof.

The display module (160) can visually provide information to an external party (e.g., a user) of the electronic device (101). The display module (160) can include, for example, a display, a holographic device, or a projector and a control circuit for controlling the device. According to one embodiment, the display module (160) can include a touch sensor configured to detect a touch, or a pressure sensor configured to measure the intensity of a force generated by the touch.

The audio module (170) can convert sound into an electrical signal, or vice versa, convert an electrical signal into sound. According to one embodiment, the audio module (170) can obtain sound through an input module (150), or output sound through an audio output module (155), or an external electronic device (e.g., an electronic device (102)) (e.g., a speaker or a headphone) directly or wirelessly connected to the electronic device (101).

The sensor module (176) can detect an operating state (e.g., power or temperature) of the electronic device (101) or an external environmental state (e.g., user state) and generate an electric signal or data value corresponding to the detected state. According to one embodiment, the sensor module (176) can include, for example, a gesture sensor, a gyro sensor, a barometric pressure sensor, a magnetic sensor, an acceleration sensor, a grip sensor, a proximity sensor, a color sensor, an IR (infrared) sensor, a biometric sensor, a temperature sensor, a humidity sensor, or an illuminance sensor.

The interface (177) may support one or more designated protocols that may be used to directly or wirelessly connect the electronic device (101) with an external electronic device (e.g., the electronic device (102)). In one embodiment, the interface (177) may include, for example, a high definition multimedia interface (HDMI), a universal serial bus (USB) interface, an SD card interface, or an audio interface.

The connection terminal (178) may include a connector through which the electronic device (101) may be physically connected to an external electronic device (e.g., the electronic device (102)). According to one embodiment, the connection terminal (178) may include, for example, an HDMI connector, a USB connector, an SD card connector, or an audio connector (e.g., a headphone connector).

The haptic module (179) can convert an electrical signal into a mechanical stimulus (e.g., vibration or movement) or an electrical stimulus that a user can perceive through a tactile or kinesthetic sense. According to one embodiment, the haptic module (179) can include, for example, a motor, a piezoelectric element, or an electrical stimulation device.

The camera module (180) can capture still images and videos. According to one embodiment, the camera module (180) can include one or more lenses, image sensors, image signal processors, or flashes.

The power management module (188) can manage power supplied to the electronic device (101). According to one embodiment, the power management module (188) can be implemented as, for example, at least a part of a power management integrated circuit (PMIC).

The battery (189) can power at least one component of the electronic device (101). In one embodiment, the battery (189) can include, for example, a non-rechargeable primary battery, a rechargeable secondary battery, or a fuel cell.

The communication module (190) may support establishment of a direct (e.g., wired) communication channel or a wireless communication channel between the electronic device (101) and an external electronic device (e.g., the electronic device (102), the electronic device (104), or the server (108)), and performance of communication through the established communication channel. The communication module (190) may operate independently from the processor (120) (e.g., the application processor) and may include one or more communication processors that support direct (e.g., wired) communication or wireless communication. According to one embodiment, the communication module (190) may include a wireless communication module (192) (e.g., a cellular communication module, a short-range wireless communication module, or a GNSS (global navigation satellite system) communication module) or a wired communication module (194) (e.g., a local area network (LAN) communication module or a power line communication module). Among these communication modules, a corresponding communication module may communicate with an external electronic device (104) via a first network (198) (e.g., a short-range communication network such as Bluetooth, wireless fidelity (WiFi) direct, or infrared data association (IrDA)) or a second network (199) (e.g., a long-range communication network such as a legacy cellular network, a 5G network, a next-generation communication network, the Internet, or a computer network (e.g., a LAN or WAN)). These various types of communication modules may be integrated into a single component (e.g., a single chip) or implemented as multiple separate components (e.g., multiple chips). The wireless communication module (192) may use subscriber information (e.g., an international mobile subscriber identity (IMSI)) stored in the subscriber identification module (196) to identify or authenticate the electronic device (101) within a communication network such as the first network (198) or the second network (199).

The wireless communication module (192) can support a 5G network and next-generation communication technology after a 4G network, for example, NR access technology (new radio access technology). The NR access technology can support high-speed transmission of high-capacity data (eMBB (enhanced mobile broadband)), terminal power minimization and connection of multiple terminals (mMTC (massive machine type communications)), or high reliability and low latency (URLLC (ultra-reliable and low-latency communications)). The wireless communication module (192) can support, for example, a high-frequency band (e.g., mmWave band) to achieve a high data transmission rate. The wireless communication module (192) may support various technologies for securing performance in a high-frequency band, such as beamforming, massive multiple-input and multiple-output (MIMO), full dimensional MIMO (FD-MIMO), array antenna, analog beam-forming, or large scale antenna. The wireless communication module (192) may support various requirements specified in an electronic device (101), an external electronic device (e.g., an electronic device (104)), or a network system (e.g., a second network (199)). According to one embodiment, the wireless communication module (192) can support a peak data rate (e.g., 20 Gbps or more) for eMBB realization, a loss coverage (e.g., 164 dB or less) for mMTC realization, or a U-plane latency (e.g., 0.5 ms or less for downlink (DL) and uplink (UL) each, or 1 ms or less for round trip) for URLLC realization.

The antenna module (197) can transmit or receive signals or power to or from the outside (e.g., an external electronic device). According to one embodiment, the antenna module (197) can include an antenna including a radiator formed of a conductor or a conductive pattern formed on a substrate (e.g., a PCB). According to one embodiment, the antenna module (197) can include a plurality of antennas (e.g., an array antenna). In this case, at least one antenna suitable for a communication method used in a communication network, such as the first network (198) or the second network (199), can be selected from the plurality of antennas by, for example, the communication module (190). A signal or power can be transmitted or received between the communication module (190) and the external electronic device through the selected at least one antenna. According to some embodiments, in addition to the radiator, another component (e.g., a radio frequency integrated circuit (RFIC)) can be additionally formed as a part of the antenna module (197).

According to various embodiments, the antenna module (197) may form a mmWave antenna module. According to one embodiment, the mmWave antenna module may include a printed circuit board, an RFIC positioned on or adjacent a first side (e.g., a bottom side) of the printed circuit board and capable of supporting a designated high-frequency band (e.g., a mmWave band), and a plurality of antennas (e.g., an array antenna) positioned on or adjacent a second side (e.g., a top side or a side) of the printed circuit board and capable of transmitting or receiving signals in the designated high-frequency band.

At least some of the above components may be interconnected and exchange signals (e.g., commands or data) with each other via a communication method between peripheral devices (e.g., a bus, a general purpose input and output (GPIO), a serial peripheral interface (SPI), or a mobile industry processor interface (MIPI)).

In one embodiment, commands or data may be transmitted or received between the electronic device (101) and an external electronic device (104) via a server (108) connected to a second network (199). Each of the external electronic devices (102, or 104) may be the same or a different type of device as the electronic device (101). In one embodiment, all or part of the operations executed in the electronic device (101) may be executed in one or more of the external electronic devices (102, 104, or 108). For example, when the electronic device (101) is to perform a certain function or service automatically or in response to a request from a user or another device, the electronic device (101) may, instead of executing the function or service itself or in addition, request one or more external electronic devices to perform at least a part of the function or service. One or more external electronic devices that have received the request may execute at least a part of the requested function or service, or an additional function or service related to the request, and transmit the result of the execution to the electronic device (101). The electronic device (101) may process the result as it is or additionally and provide it as at least a part of a response to the request. For this purpose, for example, cloud computing, distributed computing, mobile edge computing (MEC), or client-server computing technology may be used. The electronic device (101) may provide an ultra-low latency service by using, for example, distributed computing or mobile edge computing. In another embodiment, the external electronic device (104) may include an IoT (Internet of Things) device. The server (108) may be an intelligent server using machine learning and/or a neural network. According to one embodiment, the external electronic device (104) or the server (108) may be included in the second network (199). The electronic device (101) can be applied to intelligent services (e.g., smart home, smart city, smart car, or healthcare) based on 5G communication technology and IoT-related technology.

The server (108) is connected to an electronic device (101) and can provide a service to the connected electronic device (101). In addition, the server (108) can perform a membership registration procedure, store and manage various information of users registered as members accordingly, and provide various purchase and payment functions related to the service. In addition, the server (108) can share in real time the execution data of a service application running on each of a plurality of electronic devices (101) so that the service can be shared between users. In terms of hardware, this server (108) can have the same configuration as a typical web server or service server. However, in terms of software, it can include program modules (Modules) that are implemented through any language such as C, C++, Java, Python, Golang, or Kotlin and perform various functions. In addition, the server (108) generally refers to a computer system and computer software (server program) installed therefor that is connected to an unspecified number of clients and/or other servers through an open computer network such as the Internet, and that receives a request to perform a task from a client or other server and provides the result of the task. In addition, the server (108) should be understood as a broad concept that includes, in addition to the server program described above, a series of application programs that operate on the server (108) and, in some cases, various databases (DB: Database, hereinafter referred to as “DB”) that are built internally or externally. Accordingly, the server (108) classifies member registration information and various information and data about the game and stores and manages them in the DB, and this DB can be implemented internally or externally of the server (108). In addition, the server (108) can be implemented using a server program that is provided in various ways according to the operating system such as Windows, Linux, UNIX, Macintosh, etc. on general server hardware, and representative examples thereof include IIS (Internet Information Server) used in a Windows environment and CERN, NCSA, APPACH, TOMCAT, etc. used in a UNIX environment, which can implement a web service. In addition, the server (108) can also be linked with an authentication system and a payment system for user authentication of a service or purchase payment related to a service.

The first network (198) and the second network (199) refer to a connection structure that enables information exchange between each node, such as terminals and servers, or a network that connects the server (108) and electronic devices (101, 104). The first network (198) and the second network (199) include, but are not limited to, the Internet, a Local Area Network (LAN), a Wireless Local Area Network (Wireless LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), 3G, 4G, LTE, 5G, Wi-Fi, etc. The first network (198) and the second network (199) may be closed first networks (198) and second networks (199) such as LANs and WANs, but are preferably open such as the Internet. The Internet refers to the worldwide open computer first network (198) and second network (199) structure that provides protocols such as TCP/IP protocol, TCP, UDP (user datagram protocol), and various services existing at higher layers, namely HTTP (HyperText Transfer Protocol), Telnet, FTP (File Transfer Protocol), DNS (Domain Name System), SMTP (Simple Mail Transfer Protocol), SNMP (Simple Network Management Protocol), NFS (Network File Service), and NIS (Network Information Service).

A database can have a general data structure implemented in the storage space (hard disk or memory) of a computer system using a database management program (DBMS). The database can have a data storage form that allows free searching (extracting), deleting, editing, adding, etc. of data. The database can be implemented to suit the purpose of one embodiment of the present disclosure using a relational database management system (RDBMS) such as Oracle, Informix, Sybase, and DB2, an object-oriented database management system (OODBMS) such as Gemston, Orion, and O2, and an XML native database such as Excelon, Tamino, and Sekaiju, and can have appropriate fields or elements to achieve its function.

Figure 2 is a diagram showing the configuration of a program according to one embodiment.

FIG. 2 is a block diagram (200) illustrating a program (140) according to various embodiments. According to one embodiment, the program (140) may include an operating system (142), middleware (144), or an application (146) executable on the operating system (142) for controlling one or more resources of the electronic device (101). The operating system (142) may include, for example, AndroidTM, iOSTM, WindowsTM, SymbianTM, TizenTM, or BadaTM. At least some of the programs (140) may be preloaded on the electronic device (101), for example, at the time of manufacturing, or may be downloaded or updated from an external electronic device (e.g., the electronic device (102 or 104), or the server (108)) when used by a user. All or part of the program (140) may include a neural network.

The operating system (142) may control the management (e.g., allocation or retrieval) of one or more system resources (e.g., processes, memory, or power) of the electronic device (101). The operating system (142) may additionally or alternatively include one or more driver programs for driving other hardware devices of the electronic device (101), such as an input module (150), an audio output module (155), a display module (160), an audio module (170), a sensor module (176), an interface (177), a haptic module (179), a camera module (180), a power management module (188), a battery (189), a communication module (190), a subscriber identification module (196), or an antenna module (197).

The middleware (144) may provide various functions to the application (146) so that functions or information provided from one or more resources of the electronic device (101) may be used by the application (146). The middleware (144) may include, for example, an application manager (201), a window manager (203), a multimedia manager (205), a resource manager (207), a power manager (209), a database manager (211), a package manager (213), a connectivity manager (215), a notification manager (217), a location manager (219), a graphics manager (221), a security manager (223), a call manager (225), or a voice recognition manager (227).

The application manager (201) can manage, for example, the life cycle of the application (146). The window manager (203) can manage, for example, one or more GUI resources used on the screen. The multimedia manager (205) can identify, for example, one or more formats required for playing media files, and perform encoding or decoding of a corresponding media file among the media files using a codec suitable for a corresponding format selected among the formats. The resource manager (207) can manage, for example, the source code of the application (146) or the memory space of the memory (130). The power manager (209) can manage, for example, the capacity, temperature, or power of the battery (189), and determine or provide related information required for the operation of the electronic device (101) using the corresponding information. According to one embodiment, the power manager (209) can be linked with a BIOS (basic input/output system) (not shown) of the electronic device (101).

The database manager (211) may, for example, create, search, or modify a database to be used by the application (146). The package manager (213) may, for example, manage the installation or update of an application distributed in the form of a package file. The connectivity manager (215) may, for example, manage a wireless connection or direct connection between the electronic device (101) and an external electronic device. The notification manager (217) may, for example, provide a function for notifying a user of the occurrence of a specified event (e.g., an incoming call, a message, or an alarm). The location manager (219) may, for example, manage location information of the electronic device (101). The graphics manager (221) may, for example, manage one or more graphic effects to be provided to the user or a user interface related thereto.

The security manager (223) may provide, for example, system security or user authentication. The telephony manager (225) may manage, for example, a voice call function or a video call function provided by the electronic device (101). The voice recognition manager (227) may, for example, transmit a user's voice data to the server (108) and receive, from the server (108), a command corresponding to a function to be performed in the electronic device (101) based at least in part on the voice data, or converted text data based at least in part on the voice data. In one embodiment, the middleware (244) may dynamically delete some of the existing components or add new components. In one embodiment, at least a portion of the middleware (144) may be included as a part of the operating system (142), or may be implemented as separate software different from the operating system (142).

The application (146) may include, for example, a home (251), a dialer (253), an SMS/MMS (255), an instant message (IM) (257), a browser (259), a camera (261), an alarm (263), a contact (265), voice recognition (267), an email (269), a calendar (271), a media player (273), an album (275), a watch (277), a health (279) (e.g., measuring biometric information such as the amount of exercise or blood sugar), or an environmental information (281) (e.g., measuring barometric pressure, humidity, or temperature information) application. According to one embodiment, the application (146) may further include an information exchange application (not shown) that can support information exchange between the electronic device (101) and an external electronic device. The information exchange application may include, for example, a notification relay application configured to transmit designated information (e.g., a call, a message, or an alarm) to an external electronic device, or a device management application configured to manage an external electronic device. The notification relay application may, for example, transmit notification information corresponding to a designated event (e.g., receipt of a mail) that occurred in another application (e.g., an email application (269)) of the electronic device (101) to the external electronic device. Additionally or alternatively, the notification relay application may receive notification information from the external electronic device and provide the information to a user of the electronic device (101).

The device management application may control, for example, power (e.g., turning on or off) or functions (e.g., brightness, resolution, or focus) of an external electronic device or a component thereof (e.g., a display module or a camera module of the external electronic device) that communicates with the electronic device (101). The device management application may additionally or alternatively support installation, deletion, or updating of applications running on the external electronic device.

Throughout this specification, the terms neural network, neural network, and network function may be used interchangeably. A neural network may be composed of a set of interconnected computational units, which may generally be referred to as "nodes." These "nodes" may also be referred to as "neurons." A neural network is composed of at least two or more nodes. The nodes (or neurons) constituting the neural networks may be interconnected by one or more "links."

In a neural network, two or more nodes connected through a link can form a relationship of input nodes and output nodes relatively. The concept of input nodes and output nodes is relative, and any node in an output node relationship to one node can be in an input node relationship with another node, and vice versa. As described above, the input node-to-output node relationship can be created based on links. One or more output nodes can be connected to one input node through links, and vice versa.

In a relationship between input nodes and output nodes connected through a single link, the value of the output node can be determined based on the data input to the input node. Here, the node interconnecting the input node and the output node can have a weight. The weight can be variable and can be variable by a user or an algorithm in order for the neural network to perform a desired function. Here, the edge or link interconnecting the input node and the output node has a weight that can be variably applied by a user or an algorithm in order for the neural network to perform a desired function. For example, when one or more input nodes are interconnected to one output node through each link, the output node can determine the output node value based on the values input to the input nodes connected to the output node and the weight set for the link corresponding to each input node.

As described above, a neural network is a network in which two or more nodes are interconnected through one or more links to form input node and output node relationships within the neural network. Depending on the number of nodes and links within the neural network, the relationship between the nodes and links, and the weight values assigned to each link, the characteristics of the neural network can be determined. For example, if there are two neural networks with the same number of nodes and links and different weight values between the links, the two neural networks can be recognized as being different from each other.

FIG. 3 illustrates a system that uses artificial intelligence to determine abnormal signs based on financial data and manages risks based on the abnormal signs, according to one embodiment. The embodiment of FIG. 3 can be combined with various embodiments of the present disclosure.

Referring to FIG. 3, the transaction risk management system (30) may include a server (310), a user terminal (320), an exchange server (330), and a lending institution server (340).

The server (310) may provide information related to the stocks via a home trading system, a graphical user interface, a graphical user experience, and/or a web page. The home trading system, the graphical user interface, the graphical user experience, and/or the web page may be provided by the server (310), but may also be provided by different brokerage firms that operate and/or manage multiple accounts in conjunction with the server (310). For example, the server (310) may include the server (108) of FIG. 1.

The user terminal (320) may refer to a terminal of a user who wishes to trade an investment product through the server (310). The user terminal (320) may include a desktop computer, a laptop computer, a notebook, a smartphone, a tablet PC, a mobile phone, a smart watch, and smart glasses capable of communication. For example, the user terminal (320) may include an electronic device (102) of FIG. 1.

The server (310) can output an order user interface (hereinafter, “order UI”) to a user who wants to order a transaction item through a user terminal (320). For example, the server (310) can output an order UI that is dynamically determined by the user’s account information or order information through the user terminal (320) of the corresponding user. For example, the order information can include information on the order details already placed by the user. The server (310) can obtain a sell input for the item, a buy input, and/or a correction input for an existing order, or a cancellation input for an existing order from the user through the order UI.

The server (310) can transmit a buy order corresponding to a buy input, a sell order corresponding to a sell input, a correction order corresponding to a correction input, and a cancel order corresponding to a cancel input to the exchange server (330).

The server (310) may collect personal information about the user of the user terminal (320). For example, the personal information may include a name, an ID (identifier), a password, a road name address, a telephone number, a mobile phone number, an email address, and/or a history of the user selling and/or buying stocks through a stock trading platform provided by the server (310) of the present disclosure, valuation profit and loss, rate of return, valuation amount, holding quantity, etc. In the present disclosure, 'stock' may mean an investment product handled in the securities market and virtual currency market, such as stocks, futures, options, and coins. 'Stock trading' may be a concept that collectively refers to trading activities for investment products handled in the securities market and virtual currency market, such as stocks, futures, options, and coins.

The server (310) may operate volatile investment products including virtual currencies such as stocks/ETFs (Exchange Traded Funds), funds, gold, futures, options, and/or coins, or may process investment product trading/redemption work. The server (310) may be linked to a securities company server, an investment management company server, and/or a fund management company server. The server (310) may operate a liquidity account in which the user's entire investment amount to be invested in at least one item is deposited.

The server (310) can provide information related to stocks, investment information, corporate information, and market price information, and can analyze the trend flow of the rate of increase and decrease of stocks for a certain period of time by using various indices. For example, the server (310) can crawl in real time the supply and demand of foreigners and institutions in KOSPI and KOSDAQ, the won-dollar exchange rate, the NASDAQ futures index (NASDAQ futures price), the Shanghai Composite Stock Price Index, etc., to provide the current domestic stock market situation to the user in real time. In addition, the server (310) can additionally generate information on the HIS (Hang Seng Index), Nikkei 225 (JPN225), Shenzhen Composite Index, DAX (Deutscher Aktien IndeX), FTSE (Financial Times Stock Exchange) 100 Index, and DJIA (Dow Jones Industrial Average) and provide it to the user.

The server (310) can process data according to a user's request and provide stock-related information corresponding to the user's request by means of the processed data, such as numbers, charts, and/or tables. Stock-related information can include various information related to known stock transactions, such as registered stock names, key indicator information, and auxiliary indicator information. By providing stock-related information, the server (310) can help users perform appropriate transactions by providing useful information necessary for transactions.

For example, key indicator information may include information on real-time prices, market capitalization, bid prices, ask prices, fluctuation rates, lowest price, highest price, opening price, closing price, transaction volume, and transaction strength.

For example, auxiliary indicator information may include trend indicators, volatility indicators, momentum indicators, and market strength indicators. For example, trend indicators may include trend lines, moving average lines, MACD (Moving Average Convergence & Divergence), DM (Directional Movement Index), ROC (Rate Of Change), and ADX (Average Directional Movement Index). For example, volatility indicators may include Boolean Bands, ATR, Envelope, and Keltner Channels. For example, momentum indicators may include divergence, RSI (Relative Strength Index), sentiment line, three-line conversion, AB Ratio, Mass Index, stochastic, SONAR, P&F, and TRIX. For example, market strength indicators may include volume, MFI (Money Flow Index), EOM (Ease Of Movement), OBV, moving average of volume, Volume Oscillator, and Volume Ratio.

In one embodiment, the server (310) may generate trading decision information by the administrator of the server (310) or the user connected to the server (310). The trading decision information may include stock purchase information and stock sale information. For example, the server (310) may obtain a first order execution target sell price for a first stock and a second order execution target buy price for a second stock from the user terminal (320). The order execution target sell price may mean the target price of the stock that the user wishes to sell when the user sells a specific stock. For example, when the price of the first stock becomes '251.90', if the user specifies the first order execution target sell price '251.90' for the first stock and inputs a sell order amount '2' so that the sell order can be executed, the server (310) may receive the first order execution target sell price '251.90' through the user terminal (320).

The server (310) can generate trading decision information for various investment products such as stocks, futures, coins, gold, and/or options. The server (310) can generate an order signal based on the trading decision information and provide the generated order signal to the exchange server (300). The exchange server (300) can receive the account-specific order signal obtained from the server (310) and perform a series of processes to execute a transaction corresponding to the received account-specific order signal.

In another embodiment, the server (310) may make a trading decision for a specific stock or a specific group of stocks through a predetermined logic or algorithm. The server (310) may generate trading decision information corresponding to the trading decision based on the trading decision. Specific embodiments of the server (310) may vary, and many system trading logics, etc. are known or are being publicly implemented, and a detailed description of the logic or algorithm of specific trading decision information will be omitted.

The server (310) may also be linked with a lending institution server (340). The server (310) may provide a service that allows a user to use a secured loan with a specific item as collateral, and may provide the service in conjunction with the lending institution server (340). The user terminal (320) may receive a loan from the lending institution server (340) by providing a specific item as collateral. The lending institution server (340) may refer to a server operated by a lending institution such as a bank that provides services such as secured loans with an item selected by the user as collateral. The server (310) may include a server operated by a securities company that provides services such as selling of traded items and establishment of collateral rights, or may be linked with a server operated by the securities company.

In FIG. 3, the server (310) is illustrated as a single device for convenience of explanation, but depending on the embodiment, the server (310) may include a plurality of devices operatively connected to the server (310). For example, if a plurality of accounts are accounts operated and/or managed by different securities companies, the server (310) may be linked with the systems of the different securities companies.

FIG. 4 is a diagram showing the main components of a server that uses artificial intelligence to determine abnormal signs based on financial data and manages risks based on the abnormal signs. FIG. 4 can be combined with various embodiments of the present disclosure.

Referring to FIG. 4, the server (310) may include a data processing unit (311), an overload risk management unit (312), a transaction risk management unit (313), and a risk management message transmission unit (314).

The data processing unit (311) is a configuration that performs comprehensive processing related to data, and can perform data reception, data processing, and data transmission, etc. The data processing unit (311) can calculate the amount of data traffic in real time based on data being transmitted, data being received, and data being processed.

The data processing unit (311) can generate traffic information for managing overload risk based on order data and generate monitoring indicator information for managing transaction risk based on transaction data.

For example, order data may include sell data, buy data, correction data, and cancellation data. Transaction data may include sell data for which a transaction was concluded, buy data for which a transaction was concluded, and transaction amount data.

Traffic information may be information indicating data traffic volume according to order type. For example, traffic information may include data traffic volume according to order type. Data processing unit (311) may generate traffic information by calculating data traffic volume for each of sell data, buy data, correction data, and cancel data.

The monitoring indicator information may be information required to determine an indicator for monitoring abnormal transactions. For example, the monitoring indicator information may include a time-interval selling price, a time-interval buying price, a time-interval price, and a time-interval transaction amount. The data processing unit (311) may generate the monitoring indicator information by determining a time-interval selling price, a time-interval buying price, a time-interval price, and a time-interval transaction amount based on the transaction data. For example, the time interval may be in seconds. For example, the time interval may be set to at least one of 1 second, 5 seconds, 10 seconds, 20 seconds, 30 seconds, or 60 seconds.

In general, if the amount of data traffic that the server (310) can handle is exceeded, the server (310) can no longer receive data, and a system error may occur. For example, if the maximum allowable amount of data traffic is exceeded, the server (310) may go down. In addition, if the server (310) goes down, the user may suffer damages because the sale of a specific item may not be made when the price plummets, or the user may suffer damages because the transaction is concluded at a different price from the price specified by the user due to an error in the server (310).

At this time, the overload risk management unit (312) can prevent overload of the server (310) in advance by determining whether the amount of data traffic according to the order data exceeds the risk threshold.

For example, the overload risk management unit (312) determines risk information on data traffic volume through the first risk management model using the first neural network based on traffic information, and generates a message related to overload risk based on the risk information, thereby managing the overload risk for the server (310). The risk information may include information on the risk of overload occurring in the server (310). For example, the risk information may include a risk threshold value and an overload time. Here, the risk threshold value may be a data traffic volume that is a criterion for transmitting a warning message. The overload time may be the time from the time when the data traffic volume exceeds the risk threshold value to the time when the server (310) is expected to be overloaded.

According to one embodiment, the overload risk management unit (312) may generate a first state vector through data preprocessing of traffic information. The first state vector may include data traffic volume by order type, maximum allowable data traffic volume, total number of users and user access frequency, values for traffic volatility, and the ratio of users who transact more than the daily average standard transaction amount.

The data traffic volume by order type may include data traffic volume for each of sell, buy, correct, and cancel. For example, the data traffic volume for each of sell, buy, correct, and cancel may be a value that adds up the sizes of data packets generated when the server (310) processes data according to each order type. For example, the data traffic volume by order type may be in megabytes.

The maximum allowable data traffic volume can be preset based on the network bandwidth and hardware performance of the server (310). For example, the maximum allowable data traffic volume can be in megabytes per second.

The overload risk management unit (312) can determine the total number of users by counting users connected to the server (310). The overload risk management unit (312) can determine the user's connection frequency based on the connection record for each user. For example, the connection frequency can be the number of connections per second.

The value for traffic volatility may be a value indicating how much the total data traffic volume fluctuates over time. For example, the overload risk management unit (312) may determine the value for traffic volatility based on the total data traffic volume that is the sum of the data traffic volume by order type. Additionally, for example, the overload risk management unit (312) may determine the value for traffic volatility according to the following mathematical expression 1.

In the above mathematical expression 1, the V _traffic is a value for the traffic volatility, the n is the number of time sections, the T _i is the total data traffic volume for the corresponding time section, and the may be the average data traffic volume.

For example, the average data traffic volume may be the average of the data traffic volume over a preset period of time.

For example, a value for traffic volatility might be in megabytes squared.

The percentage of users who transact more than the daily average standard transaction amount may be the number of users who transact more than the standard transaction amount divided by the total number of users. For example, the standard transaction amount may be preset in the server (310). For example, the standard transaction amount may be set as a transaction amount that takes more than a preset time (e.g., 1 second) to be processed by the server (310).

For example, the overload risk management unit (312) can determine risk information on data traffic volume by inputting the first state vector into the first risk management model.

For example, a first neural network may include a first input layer, one or more first hidden layers, and a first output layer.

For example, the first risk management model can be learned based on a plurality of first state vectors and a plurality of correct risk vectors. Each learning data consisting of a plurality of first state vectors and a plurality of correct risk vectors is input to a first input layer of the first neural network, passes through one or more first hidden layers and a first output layer, and is output as a first output vector. The first output vector is input to a first loss function layer connected to the first output layer. The first loss function layer outputs a first loss value using a first loss function that compares the first output vector with the first correct vector for each learning data. The parameters of the first neural network can be learned in a direction in which the first loss value decreases.

A plurality of first state vectors used as learning data of the first risk management model can be generated based on actual data according to past traffic information and records of a plurality of users who have accessed the server in the past. Each of a plurality of correct risk vectors used as learning data of the first risk management model can be generated based on past actual used risk information. For example, a correct risk vector can include a correct risk threshold value and a correct overload time based on the correct risk threshold value.

For example, the first risk management model may include a first neural network based on a gated recurrent unit (GRU). The GRU may be a model that modifies the recurrent neural network (RNN), and since the RNN has a structure that depends on past observation values, problems such as vanishing gradients or exploding gradients may occur. The neural network model developed to solve this problem is the LSTM (long short term memory networks), and the nodes inside the LSTM can be replaced with memory cells to accumulate information or delete some of the past information. Through this, the problem of vanishing gradients or the problem of having very large gradients in the RNN can be supplemented. The GRU is a model that improves the processing speed by concisely modifying the structure of the LSTM.

For example, one first state vector used as learning data of the first risk management model can constitute one correct risk vector and one first learning data set. At this time, multiple first learning data sets can be pre-stored.

Additionally, for example, in the correct answer risk vector, the correct answer risk threshold can be determined by the following mathematical expression 2.

In the above mathematical expression 2, the Th _d is the correct answer risk threshold, the T _max is the maximum allowable data traffic volume, the w _b is a weight for a buy order, the T _b is an average data traffic volume for a buy order, the w _s is a weight for a sell order, the T _s is an average data traffic volume for a sell order, the w _m is a weight for a correction order, the T _m is an average data traffic volume for a correction order, the w _c is a weight for a cancel order, the T _c is an average data traffic volume for a cancel order, the V _traffic is a value for traffic volatility, the V _max is a value for maximum traffic volatility, the U _t is the total number of users, the f _u is an average value of the connection frequency of each of the total users, and the R _high may be a ratio of users who trade more than the average daily standard transaction amount.

For example, the value for maximum traffic variability may be a preset value based on the network bandwidth and hardware performance for the server.

For example, w _b , w _s , w _m , w _c can be set based on the impact of the average data traffic of each order type on the server. For example, w _b , w _s , w _m , w _c can be preset to values greater than 0 and less than 1. For example, the sum of w _b , w _s , w _m , w _c can be set to 1. For example, w _b can be set to 0.4, w _s to 0.4, w _m to 0.1, and w _c to 0.1.

Through this, the first risk management model can be trained to determine the risk threshold by considering the data traffic volume according to the order type by setting the weight by order type. In addition, the more users there are whose transaction amount is higher than the standard transaction amount, and the more severe the data traffic volatility based on the total number of users and the access frequency of each user, the more likely an unexpected server down phenomenon is, so the first risk management model can be trained to determine a lower risk threshold for providing a warning signal. In addition, the more severe the traffic volatility, the lower the risk threshold is set, so that the first risk management model can be trained to provide a warning signal at an earlier point in time when the server is quickly approaching an overload state.

Additionally, for example, the correct answer overload time in the correct answer risk vector can be determined by the following mathematical expression 3.

In the above mathematical expression 3, the t _overload is the correct answer overload time, the T _max is the maximum allowable data traffic amount, the Th _d is the correct answer risk threshold, the C _server is a value representing the traffic processing capability of the server for time t, and the r(t) may be a traffic change rate for time t.

For example, the correct answer risk threshold value may be a value determined by the mathematical expression 2 described above. In this case, the correct answer risk threshold value may be the amount of data traffic.

For example, C _server can be the value for the maximum traffic variability at time t divided by the value for the maximum traffic variability minus 1 multiplied by the maximum allowable data traffic volume. That is, C _server is can be determined as follows. For example, r(t) is can be set to . That is, r(t) can be determined as the value obtained by subtracting the data traffic volume one time interval before time t from the data traffic volume at time t, divided by the time interval.

Through this, the network performance of the server can be improved by training the first risk management model to determine the overload time as the time required until the server goes down without adding dummy data as in the conventional method. In other words, the network performance of the server can be improved because the server does not operate while the dummy data is added without performing the process of adding dummy data.

For example, the first risk management model can determine a predicted value for a risk vector for an input first state vector, and iteratively learn in a direction in which the predicted value minimizes the difference from the correct risk vector.

For example, the overload risk management unit (312) may determine a preliminary threshold based on a risk threshold, an overload time, and the number of users currently connected to the server (310). The preliminary threshold may be a data traffic volume that serves as a criterion for transmitting a preliminary warning message.

Additionally, for example, the overload risk management unit (312) can determine the reserve threshold value according to the following mathematical expression 4.

In the above mathematical expression 4, Th _p may be the preliminary threshold value, Th _d may be the risk threshold value, U _d may be the average number of daily connected users, U _t may be the total number of users, and t _overload may be the overload time.

For example, messages related to overload risk may include a preliminary warning message and a warning message. For example, a preliminary warning message may be a message indicating the first time that an overload may occur for the server (310). For example, a warning message may be a message indicating that an overload may occur for the server (310) after an overload time.

For example, the overload risk management unit (312) may generate a preliminary warning message for overload risk based on the total data traffic volume of the server exceeding a preliminary threshold value. For example, the preliminary warning message may include an indicator indicating the preliminary warning message, the time at which the preliminary warning message was generated, and the preliminary threshold value.

For example, the overload risk management unit (312) may generate a warning message for overload risk based on whether the total data traffic volume of the server exceeds a risk threshold. For example, the warning message may include an indicator indicating the warning message, the time the warning message was generated, the risk threshold, and the overload time.

According to one embodiment, the transaction risk management unit (313) can manage the transaction risk by determining the probability of occurrence of each of a plurality of abnormal transaction types using detection indicator information according to transaction data. For example, the transaction risk management unit (313) can determine the probability of each of a plurality of abnormal transaction types through a second risk management model using a second neural network based on the surveillance indicator information and the risk information, and can generate a message related to the transaction risk based on the probability of occurrence of each of the plurality of abnormal transaction types.

For example, the transaction risk management department (313) can generate a second state vector through data preprocessing on surveillance indicator information and risk threshold values.

For example, a second state vector may include values for risk thresholds, overload times, bid/ask spreads, price spreads, volume spreads, local maxima and local minima, and price distributions.

The value for the bid price fluctuation ratio may include a fluctuation ratio for the bid price and a fluctuation ratio for the ask price. The value for the bid price fluctuation ratio may be determined based on the bid price and the ask price for each time interval from the time the trading market opens to the present time. For example, the trading risk management unit (313) may determine the fluctuation ratio for the bid price as the value obtained by dividing the bid price of the previous time interval by the value obtained by subtracting the bid price of the current time interval from the bid price of the previous time interval for each time interval. For example, the trading risk management unit (313) may determine the fluctuation ratio for the bid price as the value obtained by dividing the sell price of the previous time interval by the value obtained by subtracting the sell price of the current time interval from the sell price of the previous time interval. In other words, the value for the bid price fluctuation ratio may include a fluctuation ratio for the bid price and a fluctuation ratio for the ask price for each time interval from the time the trading market opens to the present time.

The value for the price fluctuation ratio can be determined based on the price for each time interval from the time the trading market opens to the present time. For example, the trading risk management unit (313) can determine the value for the price fluctuation ratio as the value obtained by dividing the price for the previous time interval by the value obtained by subtracting the price for the current time interval from the price for the previous time interval for each time interval. For example, the value for the price fluctuation ratio can include the price fluctuation ratio for each time interval from the time the trading market opens to the present time.

The value for the transaction volume change ratio can be determined based on the transaction volume for each time interval from the time the trading market opens to the present time. For example, the trading risk management unit (313) can determine the value for the transaction volume change ratio as the value obtained by dividing the transaction volume for the previous time interval by the value obtained by subtracting the transaction volume for the current time interval from the transaction volume for each time interval. For example, the value for the transaction volume change ratio can include the transaction volume change ratio for each time interval from the time the trading market opens to the present time.

The local maximum and local minimum may include at least one local maximum and at least one local minimum for each of the plurality of moving averages. For example, the plurality of moving averages may include a moving average for 5 days, a moving average for 20 days, a moving average for 60 days, and a moving average for 120 days. For example, the at least one local maximum may be determined as the highest value in a price range above the moving average for each of the plurality of moving averages. For example, the at least one local minimum may be determined as the lowest value in a price range below the moving average for each of the plurality of moving averages. For example, the transaction risk management unit (313) may determine at least one local maximum for a range above the moving average and at least one local minimum for a range below the moving average based on each of the plurality of moving averages.

The value for the price distribution may include a value for the distribution of the first digit of the prices for the multiple stocks, a value for the distribution of the second digit of the prices for the multiple stocks, and a value for the distribution of the first two digits of the prices for the multiple stocks. For example, if the multiple stocks are A, B, and C, and the prices of A, B, and C are 18000, 25000, and 650, respectively, the value for the distribution of the first digit of the prices for the multiple stocks may be [0.33, 0.33, 0, 0, 0, 0.33, 0, 0, 0]. That is, the value for the distribution of the first digit of the prices for the multiple stocks may be determined by dividing the total number of stocks by the number of stocks having the corresponding number as the first digit of the price, for each of 1 to 9 representing the first digit of the price. At this time, the value for the distribution of the second digit of the price for multiple items may be [0, 0, 0, 0, 0.66, 0, 0, 0.33, 0]. That is, the value for the distribution of the second digit of the price for multiple items may be determined as a value obtained by dividing the total number of items by the number of items having the corresponding number as the second digit of the price, for each of 1 to 9 representing the second digit of the price. The value for the distribution of the first two digits of the price for multiple items may be a value obtained by dividing the total number of items by the number of items having the corresponding number as the first two digits of the price, for each of numbers from 10 to 99. That is, the value for the price distribution may include a value for the distribution of the first digit of the price for multiple items by time interval from the time the trading market opens to the present time, a value for the distribution of the second digit of the price for multiple items by time interval, and a value for the distribution of the first two digits of the price for multiple items by time interval.

For example, the transaction risk management unit (313) can determine the occurrence probability for each of a plurality of abnormal transaction types by inputting the second state vector into the second risk management model. At this time, the plurality of abnormal transaction types can include a first abnormal transaction type according to a false order, a second abnormal transaction type according to a most traded order, and a third abnormal transaction type according to an expected price involvement order.

The first abnormal transaction type due to false orders may be a pattern in which a large number of orders with a low probability of execution are repeatedly submitted and canceled. The second abnormal transaction type due to the most traded orders may be a pattern in which repeated transactions are made at the same price and the same quantity, indicating that transactions are abnormally made between related accounts. The third abnormal transaction type due to expected price-related orders may be a pattern in which orders are concentrated at the time when the opening or closing price is expected, and are corrected or canceled at the end to affect the actual price formation, indicating that the execution price may be artificially adjusted before the opening or closing price is formed.

For example, the second neural network may include a second input layer, one or more second hidden layers, and a second output layer.

For example, the second risk management model can be learned based on a plurality of second state vectors, a plurality of abnormal state vectors, and a plurality of correct abnormal transaction type occurrence probabilities. Each learning data consisting of a plurality of second state vectors and a plurality of correct risk threshold values is input to a second input layer of the second neural network, passes through one or more second hidden layers and a second output layer, and is output as a second output vector, and the second output vector is input to a second loss function layer connected to the second output layer, and the second loss function layer outputs a second loss value using a second loss function that compares the second output vector with the second correct vector for each learning data, and the parameters of the second neural network can be learned in a direction in which the second loss value decreases.

A plurality of second state vectors used as learning data for the second risk management model can be generated based on surveillance indicator information generated in the past and risk information determined in the past. A plurality of abnormal state vectors used as learning data for the second risk management model can be generated for each of a plurality of abnormal transaction types based on surveillance indicator information and risk information in which abnormal transaction types occurred in the past.

For example, the abnormal state vector may include values for the risk threshold, overload time, bid/ask fluctuation ratio, price fluctuation ratio, transaction volume fluctuation ratio, local maximum and local minimum, and price distribution at which the abnormal transaction type occurred. For example, multiple abnormal state vectors may be generated for one abnormal transaction type. For example, the multiple abnormal state vectors may include abnormal state vectors for multiple cases in which the first abnormal transaction type occurred, abnormal state vectors for multiple cases in which the second abnormal transaction type occurred, and abnormal state vectors for multiple cases in which the third abnormal transaction type occurred.

The occurrence probability of each abnormal transaction type may include the probability of occurrence of each of the plurality of abnormal transaction types, determined by comparing the second state vector and the abnormal state vector input as learning data by abnormal transaction type. For example, the occurrence probability of each of the plurality of correct abnormal transaction types may be the probability of occurrence of each of the plurality of abnormal transaction types for each of the plurality of second state vectors input as learning data. For example, the occurrence probability may be set to a value greater than 0 and less than 1.

For example, a second risk management model may include a second neural network based on GRU.

For example, the transaction risk management unit (313) may determine at least one abnormal transaction type among a plurality of abnormal transaction types, the occurrence probability of which is higher than a preset reference probability. For example, the transaction risk management unit (313) may generate a transaction warning message corresponding to at least one abnormal transaction type. That is, the transaction warning message may be generated independently for each abnormal transaction type. For example, a message related to transaction risk may include a transaction warning message corresponding to each of a plurality of abnormal transaction types. For example, the transaction warning message may include an indicator indicating an abnormal transaction type. For example, the indicator may be different depending on the plurality of abnormal transaction types. For example, the indicator may be set to a value of 1 for a first abnormal transaction type, a value of 2 for a second abnormal transaction type, and a value of 3 for a third abnormal transaction type.

The risk management message transmission unit (314) can transmit messages related to overload risk and messages related to transaction risk to the administrator terminal. The administrator terminal may be a terminal used by an administrator who manages the server (310). The administrator terminal may include a desktop computer, a laptop computer, a notebook, a smartphone, a tablet PC, a smart watch, and a smart glass capable of communication. For example, the administrator terminal may include the electronic device (102) of FIG. 1.

For example, the risk management message transmission unit (314) may transmit a preliminary warning message generated by the overload risk management unit (312) to the administrator terminal based on the total data traffic volume of the server (310) exceeding a preliminary threshold value.

For example, the risk management message transmission unit (314) can transmit a warning message generated by the overload risk management unit (313) to the administrator terminal based on the total data traffic volume of the server (310) exceeding the risk threshold value.

For example, the risk management message transmission unit (314) can transmit a transaction warning message for at least one abnormal transaction type among multiple abnormal transaction types whose occurrence probability is higher than a preset standard probability to the administrator terminal.

FIG. 5 illustrates an example of a gated recurrent unit (GRU) model used in the first risk management model and the second risk management model according to one embodiment. The embodiment of FIG. 5 can be combined with various embodiments of the present disclosure.

Referring to FIG. 5, the first risk management model and the second risk management model may use a GRU model (500).

For example, a GRU model (500) may include an input layer (510), one or more hidden layers (520), and an output layer (530).

Specifically, one or more hidden layers (520) may include one or more GRU blocks, and one GRU block may include a reset gate and an update gate. Here, the reset gate and the update gate may include a sigmoid layer. For example, the sigmoid layer may include a sigmoid function ( ) can be a layer with an activation function. For example, the hidden state can be controlled through a reset gate and an update gate, and there can be weights for each gate and input.

The reset gate resets the past information, and the weight r(t) derived through the previous hidden layer can be determined by mathematical expression 5.

For example, in the case of the first risk management model, a plurality of first state vectors are input to the input layer (510), and the reset gate takes the inner product of the current input value (x _t ) generated based on the plurality of first state vectors with the weight W _r of the current time point, and takes the inner product of the hidden state (h _(t-1) ) of the previous time point generated based on the plurality of first state vectors with the weight U _r of the previous time point, and finally, the two values are added and input to the sigmoid function so that the result can be output as a value between 0 and 1. It can be determined how much to utilize the hidden state value of the previous time point through this value between 0 and 1.

For example, in the case of the second risk management model, a plurality of second state vectors and a plurality of abnormal state vectors are input to the input layer (510), and the reset gate takes an inner product of the current time point input value (xt) generated based on the plurality of second state vectors and the plurality of abnormal state vectors with the weight Wr of the current time point, and takes the inner product of the previous time point hidden state (h(t-1)) generated based on the plurality of second state vectors and the plurality of abnormal state vectors with the weight Ur of the previous time point, and finally, the two values are added and input to the sigmoid function so that the result can be output as a value between 0 and 1. It can be determined how much to utilize the hidden state value of the previous time point through this value between 0 and 1.

The update gate determines the update rate for past and present information, and z(t) is the amount of information at the current point in time, which can be determined by mathematical expression 6.

For example, when the input value (x _t ) of the current time point is input, the inner product is taken with the weight W _z of the current time point, the hidden state (h _(t-1) ) of the previous time point is input with the inner product with the weight U _z of the previous time point, and finally the two values are added and input to the sigmoid function so that the result can be output as a value between 0 and 1. In addition, 1-z (t) can be multiplied by the information of the hidden layer of the previous time point (h _(t-1) ).

This allows z(t) to reflect how much to use current information and 1-z(t) to reflect how much to use past information.

By multiplying the results of the reset gate, the information candidate group at the current time point t can be determined by mathematical expression 7.

For example, if the input value (x _t ) of the current time point is input, the inner product value of the weight W _h of the current time point and the hidden state (h _(t-1) ) of the previous time point can be input to the tanh function by adding the inner product of the weight U _h of the previous time point and the product of r(t). For example, tanh means a nonlinear activation function (hyperbolic tangent function).

By combining the results of the update gate and the candidates, the weights of the hidden layer at the current point in time can be determined by Equation 8.

For example, the weight of the hidden layer at the current time point can be determined by the sum of the product of the output value z(t) of the update gate and the hidden state at the current time point (h(t)) and the product of the value 1-z(t) discarded by the update gate and the hidden state at the previous time point (h(t-1)).

For example, weight initialization can be performed for a GRU-based neural network. Weight initialization can be performed based on the weight obtained by dividing the sum of the number of input values input to the layer and the number of output values output from the layer for each layer. Through this, the starting point of the weight can be set to a value within an appropriate range.

Through the above-described process, parameters of GRU-based neural networks for each of the first risk management model and the second risk management model can be learned.

According to one embodiment, one second state vector used as learning data of the second risk management model may constitute an occurrence probability by correct abnormal transaction type and one second learning data set. At this time, a plurality of second learning data sets may be stored in advance. For example, the occurrence probability by correct abnormal transaction type may include an occurrence probability for the correct first abnormal transaction type, an occurrence probability for the correct second abnormal transaction type, and an occurrence probability for the correct third abnormal transaction type.

For example, the occurrence probability for the correct first abnormal transaction type can be determined based on the similarity between the values for the order fluctuation ratio, the values for the transaction volume fluctuation ratio, and the values for the price distribution between the second state vector and a plurality of abnormal state vectors representing the first abnormal transaction type.

Additionally, for example, the occurrence probability for the correct first or higher transaction type can be determined by the following mathematical expression 9.

In the mathematical expression 9 above, the P _s is the occurrence probability for the correct first abnormal transaction type, the w _r is a weight for reliability, the sim1 _H is an average value of the similarity for the price fluctuation ratio between the second state vector and a plurality of abnormal state vectors representing the first abnormal transaction type, the sim1 _E is an average value of the similarity for the transaction amount fluctuation ratio between the second state vector and a plurality of abnormal state vectors representing the first abnormal transaction type, the sim1 _D is an average value of the similarity for the price distribution values between the second state vector and a plurality of abnormal state vectors representing the first abnormal transaction type, and the w _H , w _E , and w _D may be weights for the respective similarities.

For example, the similarity in the bid price fluctuation ratio between the second state vector and the abnormal state vector representing the first abnormal transaction type may be determined based on the value obtained by adding 1 to the average of the absolute value of the difference between the bid price and the absolute value of the difference between the ask price for each time interval between the second state vector and the abnormal state vector, and dividing the value by 1. For example, the similarity in the bid price fluctuation ratio between the second state vector and the abnormal state vector representing the first abnormal transaction type may be determined based on the value obtained by adding 1 to the average of the absolute value of the difference between the bid price and the ask price for each time interval between the second state vector and the abnormal state vector, and dividing the value by 1. can be determined as follows. The above n is the number of time intervals, and the above is the change ratio of the buy order in the i-th time interval of the second state vector, and is the change ratio of the buy order in the i-th time interval of the ideal state vector, and is the change ratio of the selling price in the i-th time interval of the second state vector, and can be the rate of change of the selling price in the ith time interval of the ideal state vector.

For example, the similarity in the transaction volume change ratio between the second state vector and the abnormal state vector representing the first abnormal transaction type may be determined based on the value obtained by adding 1 to the average of the absolute values of the differences in the transaction volume change ratios by time interval between the second state vector and the abnormal state vector, and dividing the value by 1. For example, the similarity in the transaction volume change ratio between the second state vector and the abnormal state vector representing the first abnormal transaction type may be determined based on the value obtained by adding 1 to the average of the absolute values of the differences in the transaction volume change ratios by time interval between the second state vector and the abnormal state vector. can be determined as follows. The above n is the number of time intervals, and the above is the rate of change in the transaction amount in the i-th time interval of the second state vector, can be the rate of change in the transaction amount in the ith time interval of the ideal state vector.

For example, the similarity for the values of the price distribution between the second state vector and the abnormal state vector representing the first abnormal transaction type can be determined based on the value obtained by adding 1 to the average of the absolute values of the differences in the values of the price distribution between the second state vector and the abnormal state vector and dividing it by 1. For example, the similarity for the values of the price distribution representing the second state vector and the first abnormal transaction type can be determined based on the value obtained by adding 1 to the average of the absolute values of the differences in the values of the price distribution between the second state vector and the abnormal state vector and dividing it by 1. can be determined as follows. The above n is the number of time intervals, and the above is the value for the distribution of the first digit of the price for multiple items in the i-th time interval of the second state vector, It is a value for the distribution of the first digit of the price for multiple items in the i-th time interval of the ideal state vector, and is the value for the distribution of the second digit of the price for multiple items in the i-th time interval of the second state vector, The value for the distribution of the second digit of the price for multiple items in the i-th time interval of the ideal state vector, and is the value for the distribution of the first two digits of the prices for multiple items in the ith time interval of the second state vector, It can be a value for the distribution of the first two digits of the prices for multiple items in the ith time interval of the ideal state vector.

For example, w _H , w _E , and w _D can be preset to values greater than 0 and less than 1. For example, the sum of w _H , w _E , and w _D can be set to be 1.

For example, the weight for reliability can be preset to a value greater than 0.5 and less than 1. For example, the weight for reliability can be set to a value closer to 1 when the risk threshold is greater than the reference threshold and the overload time is greater than the reference time. In other words, the weight for reliability can adjust the occurrence probability of the corresponding abnormal transaction type according to the reliability by reflecting the risk threshold and the overload time. The reference threshold and the reference time can be preset values based on the performance of the server.

Through this, the second risk management model can learn how often the bid or ask price increases sharply, is canceled, and then adjusted back to a lower price to detect the first abnormal transaction type, how much the order volume is large despite the execution volume being abnormally low, and how much the price distribution deviates from a natural numerical distribution.

For example, the occurrence probability for the second abnormal transaction type can be determined based on the similarity between the value for the transaction amount change ratio, the value for the price change ratio, and the value for the price distribution between the second state vector and a plurality of abnormal state vectors representing the second abnormal transaction type.

Additionally, for example, the occurrence probability for the second or higher correct transaction type can be determined by the following mathematical expression 10.

In the above mathematical expression 10, the P _s is the occurrence probability for the correct second abnormal transaction type, the w _r is a weight for reliability, the sim2 _E is an average value of the similarity for the transaction amount fluctuation ratio between the second state vector and a plurality of abnormal state vectors representing the second abnormal transaction type, the sim2 _P is an average value of the similarity for the price fluctuation ratio between the second state vector and a plurality of abnormal state vectors representing the second abnormal transaction type, the sim2 _D is an average value of the similarity for the price distribution values between the second state vector and a plurality of abnormal state vectors representing the second abnormal transaction type, and the w _E , w _P , and w _D may be weights for the respective similarities.

For example, the similarity in terms of the transaction amount change ratio between the second state vector and the abnormal state vector representing the second abnormal transaction type can be determined in the same manner as the similarity in terms of the transaction amount change ratio between the second state vector and the abnormal state vector representing the first abnormal transaction type described above.

For example, the similarity in the price fluctuation ratio between the second state vector and the abnormal state vector representing the second abnormal transaction type can be determined based on the value obtained by adding 1 to the average of the absolute values of the differences in the price fluctuation ratios between the second state vector and the abnormal state vector, and dividing that value by 1. For example, the similarity in the price fluctuation ratio between the second state vector and the abnormal state vector representing the second abnormal transaction type can be determined based on the value obtained by adding 1 to the average of the absolute values of the differences in the price fluctuation ratios between the second state vector and the abnormal state vector representing the second abnormal transaction type. can be determined as follows. The above n is the number of time intervals, and the above is the rate of change in the price of the i-th time interval of the second state vector, can be the rate of change of the price in the ith time interval of the ideal state vector.

For example, the similarity for values of the price distribution between the second state vector and the abnormal state vector representing the second abnormal transaction type can be determined in the same manner as the similarity for values of the price distribution between the second state vector and the abnormal state vector representing the first abnormal transaction type.

Through this, the secondary risk management model can learn how often the same transaction volume occurs repeatedly, how often transactions are made at the same price over a period of time, and how much the distribution of prices deviates from a natural numerical distribution, in order to detect the second abnormal transaction type.

Additionally, for example, the occurrence probability for the third or higher correct transaction type can be determined by the following mathematical expression 11.

In the above mathematical expression 11, the P _q is the occurrence probability for the correct third or more abnormal transaction type, the w _r is a weight for reliability, the sim3 _p is an average value of the similarity for the price fluctuation ratio between the second state vector and a plurality of abnormal state vectors representing the third or more abnormal transaction type, the sim3 _E is an average value of the similarity for the transaction amount fluctuation ratio between the second state vector and a plurality of abnormal state vectors representing the third or more abnormal transaction type, the sim3 _X is an average value of the similarity for the local maximum and local minimum between the second state vector and a plurality of abnormal state vectors representing the third or more abnormal transaction type, and the w _P , w _E , and w _X may be weights for the respective similarities.

For example, the similarity in the price fluctuation ratio between the second state vector and the abnormal state vector representing the third abnormal transaction type can be determined in the same manner as the similarity in the price fluctuation ratio between the second state vector and the abnormal state vector representing the second abnormal transaction type described above.

For example, the similarity in terms of the transaction amount change ratio between the second state vector and the abnormal state vector representing the third abnormal transaction type can be determined in the same manner as the similarity in terms of the transaction amount change ratio between the second state vector and the abnormal state vector representing the first abnormal transaction type described above.

For example, the similarity between the second state vector and the plurality of abnormal state vectors representing the third abnormal transaction type for the local maximum and local minimum may be determined by dividing the value obtained by adding 1 to the absolute value of the difference between at least one local maximum and at least one local minimum for each of the plurality of moving averages by 1. For example, the similarity between the second state vector and the plurality of abnormal state vectors representing the third abnormal transaction type for the local maximum and local minimum may be determined by can be determined as follows. The above n is the number of time intervals, and the above is at least one local maximum for an interval higher than the jth moving average of the ith time interval of the second state vector, and is at least one local maximum for an interval higher than the jth moving average of the ith time interval of the ideal state vector, and is at least one local minimum for an interval lower than the jth moving average of the ith time interval of the second state vector, and may be at least one local minimum for an interval lower than the jth moving average of the i-th time interval of the ideal state vector.

Through this, the secondary risk management model can learn the time when price movements occur just before the opening or closing price is formed, the frequency and correction/cancellation patterns of orders, and the degree to which prices rise or fall sharply, in order to detect the third and higher transaction types.

FIG. 6 is a block diagram showing a hardware configuration of a server according to one embodiment. The embodiment of FIG. 6 can be combined with various embodiments of the present disclosure.

As illustrated in FIG. 6, the server (600) may include a processor (610), a communication unit (620), and a memory (630). However, not all of the components illustrated in FIG. 6 are essential components of the server (600). The server (600) may be implemented with more components than the components illustrated in FIG. 6, or may be implemented with fewer components than the components illustrated in FIG. 6. For example, the server (600) according to some embodiments may further include a user input interface (not illustrated), an output unit (not illustrated), etc., in addition to the processor (610), the communication unit (620), and the memory (630).

The processor (610) typically controls the overall operation of the server (600). The processor (610) may include one or more processors and control other components included in the server (600). For example, the processor (610) may control the communication unit (620) and the memory (630) by executing programs stored in the memory (630). In addition, the processor (610) may perform the functions of the server (600) described in FIGS. 3 to 5 by executing programs stored in the memory (630).

The communication unit (620) may include one or more components that allow the server (600) to communicate with other devices (not shown) and the server (not shown). The other devices (not shown) may be computing devices such as the server (600) or sensing devices, but are not limited thereto. The communication unit (620) may receive user input from other electronic devices or receive data stored in an external device from an external device via a network.

The memory (630) can store a program for processing and controlling the processor (610). For example, the memory (630) can store information input to the server or information received from another device via a network. In addition, the memory (630) can store data generated by the processor (610). The memory (630) can also store information input to the server (600) or output from the server (600).

The memory (630) may include at least one type of storage medium among a flash memory type, a hard disk type, a multimedia card micro type, a card type memory (for example, an SD or XD memory, etc.), a RAM (Random Access Memory), a SRAM (Static Random Access Memory), a ROM (Read-Only Memory), an EEPROM (Electrically Erasable Programmable Read-Only Memory), a PROM (Programmable Read-Only Memory), a magnetic memory, a magnetic disk, and an optical disk.

The embodiments described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. For example, the devices, methods, and components described in the embodiments may be implemented using one or more general-purpose computers or special-purpose computers, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a programmable logic unit (PLU), a microprocessor, or any other device capable of executing instructions and responding to them. The processing device may execute an operating system (OS) and one or more software applications running on the OS. In addition, the processing device may access, store, manipulate, process, and generate data in response to the execution of the software. For ease of understanding, the processing device is sometimes described as being used alone, but those skilled in the art will appreciate that the processing device may include multiple processing elements and/or multiple types of processing elements. For example, the processing device may include multiple processors, or a processor and a controller. Other processing configurations, such as parallel processors, are also possible.

The software may include a computer program, code, instructions, or a combination of one or more of these, which may configure a processing device to perform a desired operation or may independently or collectively command the processing device. The software and/or data may be permanently or temporarily embodied in any type of machine, component, physical device, virtual equipment, computer storage medium or device, or transmitted signal waves, for interpretation by the processing device or for providing instructions or data to the processing device. The software may also be distributed over network-connected computer systems, and stored or executed in a distributed manner. The software and data may be stored on one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program commands that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program commands, data files, data structures, etc., alone or in combination. The program commands recorded on the medium may be those specially designed and configured for the embodiment or may be those known to and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program commands such as ROMs, RAMs, flash memories, etc. Examples of the program commands include not only machine language codes generated by a compiler but also high-level language codes that can be executed by a computer using an interpreter, etc. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiment, and vice versa.

Although the embodiments have been described with limited drawings as described above, those skilled in the art can apply various technical modifications and variations based on the above. For example, even if the described techniques are performed in a different order than the described method, and/or the components of the described system, structure, device, circuit, etc. are combined or combined in a different form than the described method, or are replaced or substituted by other components or equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are also included in the scope of the claims described below.

Claims (3)

As a server that manages risk,
A data processing unit that generates traffic information for managing overload risk based on order data and generates monitoring indicator information for managing transaction risk based on transaction data;
An overload risk management unit that determines risk information on data traffic volume through a first risk management model using a first neural network based on the above traffic information and generates a message related to overload risk based on the above risk information;
A transaction risk management unit that determines the probability of each of a plurality of abnormal transaction types through a second risk management model using a second neural network based on the above surveillance indicator information and the above risk information, and generates a message related to transaction risk based on the occurrence probability of each of the plurality of abnormal transaction types; and
Including a risk management message transmission unit that transmits a message related to the above overload risk and a message related to the above transaction risk to the administrator terminal.
Server.
In paragraph 1,
The above overload risk management department,
Generate a first state vector through data preprocessing of the above traffic information,
The above first state vector includes data traffic volume by order type, maximum allowable data traffic volume, total number of users and user access frequency, values for traffic volatility, and the proportion of users transacting more than the daily average standard transaction amount.
By inputting the first state vector into the first risk management model, risk information on the data traffic volume is determined,
The above risk information includes risk thresholds and overload times,
Determine a preliminary threshold based on the above risk threshold, the above overload time, and the number of users currently connected to the above server,
The above first risk management model is learned based on a plurality of first state vectors and a plurality of correct risk vectors,
Generate a preliminary warning message for overload risk based on the total data traffic of the above server exceeding the preliminary threshold,
Generate a warning message about overload risk based on whether the total data traffic volume of the above server exceeds the above risk threshold,
The above overload risk related message includes the above preliminary warning message and the above warning message.
Server.
In the second paragraph,
The above transaction risk management department,
Generate a second state vector through data preprocessing of the above surveillance indicator information and the above risk information,
The second state vector includes values for the risk threshold, the overload time, the bid/ask spread ratio, the price spread ratio, the transaction volume spread ratio, the local maximum and local minimum, and the price distribution.
By inputting the second state vector into the second risk management model, the occurrence probability for each of the plurality of abnormal transaction types is determined,
The above multiple abnormal transaction types include the first abnormal transaction type based on a false order, the second abnormal transaction type based on a most traded order, and the third abnormal transaction type based on an expected price involvement order.
The above second risk management model is learned based on multiple second state vectors, multiple abnormal state vectors, and multiple correct abnormal transaction type occurrence probabilities.
Among the above multiple abnormal transaction types, at least one abnormal transaction type is determined whose occurrence probability is greater than or equal to a preset standard probability,
Generate a transaction warning message corresponding to at least one of the above abnormal transaction types,
The above transaction risk related message includes a transaction warning message corresponding to each of the above multiple abnormal transaction types.
Server.

Images