WO2021031607A1 - 一种风险控制方法、计算机设备及可读存储介质 - Google Patents
一种风险控制方法、计算机设备及可读存储介质 Download PDFInfo
- Publication number
- WO2021031607A1 WO2021031607A1 PCT/CN2020/087669 CN2020087669W WO2021031607A1 WO 2021031607 A1 WO2021031607 A1 WO 2021031607A1 CN 2020087669 W CN2020087669 W CN 2020087669W WO 2021031607 A1 WO2021031607 A1 WO 2021031607A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- risk
- score
- risk score
- behavior data
- data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Ceased
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0635—Risk analysis of enterprise or organisation activities
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/21—Design, administration or maintenance of databases
- G06F16/215—Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2455—Query execution
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2455—Query execution
- G06F16/24552—Database cache management
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
Definitions
- This application relates to the field of computer technology, and in particular to a risk control method, computer equipment and readable storage medium.
- videos are disseminated in diversified ways, such as live webcasts and short videos.
- Take webcast as an example. It draws on and continues the advantages of the Internet. It uses the video method to conduct online live broadcast. It can publish product display, related conferences, online training and other content on the Internet on-site, using the intuitive, interactive, and interactive features of the Internet. Unrestricted geographical features can enhance the promotion effect of the event site.
- Internet black industry refers to an industry that has a clear division of labor and closely connected interest groups formed through network technology that seeks illegal benefits by invading computer information systems and illegally stealing computer information system data including personal information. system.
- black industry behavior is increasingly evolving to batch and automation, which poses new challenges to risk control.
- general business platforms often carry out discounts or cash rebates for marketing purposes.
- Black production is heard and large-scale arbitrage is called "wool" in the industry. The most common method is to register a large number of new users to receive the platform. Activity Award.
- the risk control system usually uses the IP black and gray list to filter out known/suspected proxy IPs, and further, depict user portraits, judge abnormal requests based on the user's most frequently used IP, and adopt higher-strength authentication to distinguish black products behavior.
- the risk control system of an Internet company is designed as a search system.
- the inventor found that when the number of users reaches hundreds of millions and there are a lot of behavioral data, this kind of risk control system with search as the core is only available when requested. Calculate the risk score, and the risk score required in judging the degree of risk can only be responded after the calculation is completed. Therefore, the existing risk control system cannot respond quickly.
- a risk control method, computer equipment and readable storage medium are now provided, which independently perform the two processes of calculating the score and judging the degree of risk, ensuring the high-speed response of the risk control service.
- This application provides a risk control method, which includes a step of calculating a risk score and a step of judging the degree of risk, wherein:
- the step of calculating the risk score includes performing calculation processing on the user's buried point data according to a preset risk scoring rule to obtain a risk score;
- the step of judging the degree of risk includes receiving a business request from the user, selecting a corresponding risk assessment rule and a preset threshold according to the business request, and searching for the risk assessment rule corresponding to the score obtained in the risk score calculation step
- the risk score is used as the evaluation score, and the evaluation score is compared with the threshold corresponding to the business request to obtain the risk evaluation result.
- the present application also provides a computer device that includes a memory, a processor, and computer-readable instructions stored in the memory and capable of running on the processor, and the processor performs calculations when the computer-readable instructions are executed Risk scoring steps and steps to judge the degree of risk, including:
- the step of calculating the risk score includes performing calculation processing on the user's buried point data according to a preset risk scoring rule to obtain a risk score;
- the step of judging the degree of risk includes receiving a business request from the user, selecting a corresponding risk assessment rule and a preset threshold according to the business request, and searching for the risk assessment rule corresponding to the score obtained in the risk score calculation step
- the risk score is used as the evaluation score, and the evaluation score is compared with the threshold corresponding to the business request to obtain the risk evaluation result.
- This application also provides a computer-readable storage medium on which computer-readable instructions are stored, and when the computer-readable instructions are executed by a processor, the steps of calculating the risk score and determining the degree of risk are realized, wherein:
- the step of calculating the risk score includes performing calculation processing on the user's buried point data according to a preset risk scoring rule to obtain a risk score;
- the step of judging the degree of risk includes receiving a business request from the user, selecting a corresponding risk assessment rule and a preset threshold according to the business request, and searching for the risk assessment rule corresponding to the score obtained in the risk score calculation step
- the risk score is used as the evaluation score, and the evaluation score is compared with the threshold corresponding to the business request to obtain the risk evaluation result.
- This application also provides a risk control system, including a risk calculation module and a risk judgment module, wherein:
- the risk calculation module is used to calculate and process the user's buried point data according to preset risk scoring rules to obtain a risk score
- the risk judgment module is configured to receive the business request of the user and select the corresponding risk assessment rule and preset threshold according to the business request, and find the risk assessment rule in the risk score obtained in the step of calculating the risk score.
- the corresponding risk score is used as the evaluation score, and the evaluation score is compared with the threshold corresponding to the business request to obtain the risk evaluation result.
- the risk assessment rules and preset thresholds corresponding to the business request can be selected according to the business request, so as to realize the addition, deletion and combination of rules without delay, and achieve the ideal risk control effect.
- the risk score data is transmitted through the message queue processing tool to prevent data loss.
- the expiration time is set for the risk score data in the second database, and meaningless data can be deleted, thereby increasing storage space;
- Figure 1 is a system framework diagram corresponding to the risk control method of this application.
- Figure 2 is a schematic diagram of the two processes in the risk control method of this application being carried out independently.
- Fig. 3 is a specific schematic diagram of Fig. 2.
- Fig. 4 is a flowchart of the first embodiment of the application for calculating the risk score.
- Fig. 5 is a flowchart of a second embodiment of the application for calculating risk scores.
- Figure 6 is a flow chart of the application for judging the degree of risk.
- Figure 7 is a block diagram of the risk control system of the application.
- FIG. 8 is a schematic diagram of the hardware structure of the computer equipment of the risk control method of this application.
- first, second, third, etc. may be used in this application to describe various information, the information should not be limited to these terms. These terms are only used to distinguish the same type of information independently from each other.
- first information may also be referred to as second information, and similarly, the second information may also be referred to as first information.
- word “if” as used herein can be interpreted as "when” or “when” or "in response to determination”.
- the user participates in the live broadcast and lottery activities with the help of terminal devices A, B, C, D, and E.
- the terminal devices A, B, C, D, and E share the user’s
- the behavior data is transmitted to the server W, and the server W receives and processes the user's buried point data and calculates the risk score.
- the user sends a lottery service request through the terminal devices A, B, C, D, and E, and performs risk assessment in combination with the risk score via the server W, and executes the corresponding risk control strategy.
- Only one server W is given here.
- the application scenario here may also include multiple servers communicating with each other.
- the server W may be a cloud server or a local server.
- a risk control method which includes a step of calculating a risk score and a step of judging the degree of risk, where:
- the step of calculating the risk score includes performing calculation processing on the user's buried point data according to a preset risk scoring rule to obtain a risk score;
- the step of judging the degree of risk includes receiving a business request from the user, selecting a corresponding risk assessment rule and a preset threshold according to the business request, and searching for the risk assessment rule corresponding to the score obtained in the risk score calculation step
- the risk score is used as the evaluation score, and the evaluation score is compared with the threshold corresponding to the business request to obtain the risk evaluation result.
- the two processes of calculating the risk score and judging the degree of risk are carried out independently, which ensures the high-speed response of the risk control service.
- the server W calculates the points of the terminal equipment A, B, C, D, and E according to preset risk scoring rules to obtain the complete risk score data; when judging the degree of risk, the server W selects the risk assessment rule and preset threshold corresponding to the service request according to the service request of the terminal device A, finds the score corresponding to the risk assessment rule in the risk score obtained in the step of calculating the risk score, and The risk score and the threshold corresponding to the business request are evaluated and analyzed to achieve an ideal risk control effect.
- the server W calculates the risk score on the buried point data of the terminal devices A, B, C, D, and E, and determines the degree of risk, as follows:
- Room page data, barrage data, lottery data and other buried data user behavior buried in the server data, including barrage connection behavior, barrage sending behavior, access to room page behavior, follow behavior, gashapon activity behavior, and treasure box collection Behavior, purchase privilege behavior, lottery behavior, sign-in behavior, gift-giving behavior, recharge behavior.
- Buried point data transmission company-level real-time data transmission middleware realizes large-scale data collection.
- HDFS big data system placement the embedded point data is placed into the big data file system HDFS, and persistent storage provides calculation basis.
- Offline calculation Take the data of placing orders as input, use the MapReduce computing framework to perform calculations such as cluster analysis on user behavior, and output the data in the form of user-rule-value.
- Real-time calculation Taking the real-time stream of data as input, calculate the risk characteristics that users can expose in a short time.
- the risk score is output to the Kafka data queue: the production user-rule-value is output to the Kafka data queue.
- Live risk control system consumption risk score Live risk control data service, responsible for consuming the risk score of Kafka data queue.
- the first database stores risk scores and synchronizes processing of blocked messages from the master station.
- Subscription database changes production enters the data queue.
- Second database After the risk control service is consumed, it is persistently stored in the second database (redis database), and all entries have a certain expiration time according to the strategy.
- Risk control service Responsible for processing the request and returning the judgment result of risk control.
- LRU algorithm cache is used to alleviate the problem of excessively high QPS of the redis database for service requests during peak periods and reduce by 96%.
- Real-time risk assessment rule configuration According to the judgment result of the risk control system, user feedback and other information, use linear regression and other methods to formulate reasonable rule thresholds and rule combinations. ,
- S120 Calculate a risk score based on the buried point data according to a preset risk scoring rule
- S140 The converted risk score is transmitted to the storage module via the message queue processing tool
- the storage module stores the risk score.
- the buried point data of S110 collects the barrage connection behavior data of terminal devices A, B, C, D, and E through the server, barrage sending behavior data, room page behavior data, attention behavior data, At least one of gashapon activity data, treasure box collection behavior data, privilege purchase behavior data, redemption behavior data, lottery behavior data, sign-in behavior data, gift giving behavior data, or recharge behavior data.
- the gashapon event including the fantasy gashapon machine, will only appear during the event. If the cumulative use value reaches the preset value (the value depends on the event rules), you can get 1 fantasy gashapon coin.
- Use Fantasy Gacha Coins to participate in the lucky draw of the Fantasy Gacha Machine.
- About Fantasy Gacha Coin You can get a Fantasy Gacha Coin by giving away celebration fireworks, goldfish fat times, and a small TV for every 10 points of faith generated. After the event ends, unused Fantasy Gacha Coins will be exchanged for normal Gacha Coins at a ratio of 10 to 1. If there are less than 10 Fantasy Gacha Coins, they will not be exchanged.
- the server W places the collected embedded point data to the big data file system HDFS, and persistent storage provides a calculation basis, and the data placed on the disk is used as the basis for the calculation of S120.
- the calculation type of S120 includes offline calculation and/or real-time calculation, and the corresponding calculation type is selected according to different application scenarios. Multiple calculations can exist at the same time, or one of the calculation methods can be selected as needed, and the buried point data used for calculation in real-time online calculations is usually generated by users in a relatively short period of time (for example, 30 seconds, the length of time can be customized) Behavioral data, while the buried point data used for calculation in offline calculations is usually behavioral data generated by users in a relatively long period of time (for example, 24 hours, the length of time can be self-defined).
- Historical data can be calculated according to needs, such as calculating the user's behavior statistics in the past day, the past week, and the past three months to improve accuracy and avoid misjudgments;
- converting the risk score into a standard data format in S130 is to arrange the user account information, the risk scoring rule information, and the risk score information of the user account in a predetermined order.
- the message queue processing tool of S140 is a kafka tool, and data is transmitted through the kafka tool to prevent data loss.
- Figure 5 is a second embodiment of the process of calculating the risk score. The specific steps include:
- S120 Calculate a risk score based on the buried point data according to a preset risk scoring rule
- S140 The converted risk score is transmitted to the storage module via the message queue processing tool
- the corresponding time limit according to the relationship between the generation time of the user behavior and the judgment result time. For example, it is necessary to judge the user behavior during the activity process. Assuming that the activity process lasts for 4 hours, the buried point data earlier than the activity start is expired data and does not need to be transmitted to The second database is no longer used to calculate the risk score; the second database (such as the redis database) sets the expiration time for the score data, which can delete the meaningless data, thereby increasing the storage space;
- the method further includes:
- S160 Cache the content of the second database through the LRU algorithm; use the cache to prevent system flushing, where the full name of LRU is Least recently used, and the Chinese interpretation of LRU is the least recently used.
- the calculation type in S120 includes offline calculation and/or real-time calculation, and the corresponding calculation type is selected according to different application scenarios.
- the query rate per second of the second database can reach 600K during the peak period, so a caching strategy is adopted. , The query rate per second request content in the second database exceeding the query rate per second is written into the local storage unit, the query rate per second in the second database is greatly reduced to 2K, and the second database query per second in the peak period is alleviated The rate is too high.
- the steps of judging the degree of risk include:
- S220 According to the business request, select a risk assessment rule and a preset threshold corresponding to the business request;
- S230 Find the risk score corresponding to the risk assessment rule in the risk score obtained in the step of calculating the risk score as the assessment score;
- S240 Determine whether the evaluation score exceeds a preset threshold; if so, execute S250; if not, execute S260;
- the risk assessment rules in S220 are combined and matched according to business requests, and different business requests have different combinations.
- the service rejection request in S250 may be a refusal to browse webpages, a refusal to enter the live broadcast room, and a lottery is not allowed, and the service pass request in S260 may be permission to browse webpages, allow access to the live broadcast room, and allow participation in a lottery.
- the assessment results can also be stored for later reference or processing.
- the risk assessment rules can be different logical combinations, and the first embodiment of the risk assessment rule and the second embodiment of the risk assessment rule will be used as examples to illustrate.
- Risk assessment rule embodiment 1 Risk assessment rules are logic and rules
- the preset risk scoring rules in S120 can be set according to the requirements of risk monitoring. Assuming that there are 50 preset risk scoring rules for buried point data, which are the first risk scoring rule, the second risk scoring rule, the third risk scoring rule, and the fiftieth risk scoring rule, When calculating the risk score for the first user account, the first risk score under the first risk scoring rule corresponding to the first user account is obtained, and the first user account corresponds to the second risk score under the second risk scoring rule. By analogy, the fiftieth user account corresponds to the fiftieth risk score under the fiftieth risk scoring rules.
- the risk score will be calculated according to the preset risk scoring rules.
- the user account will be scored in the preset risk score
- the risk score under the rule is a non-zero value. For example, for an abnormality, the user account’s risk score under the preset risk scoring rule is 1 point. If the abnormal behavior occurs more often, the user account will be scored in the preset risk score The higher the cumulative risk score under the rule is, for example, if there are 5 exceptions, the cumulative risk score of the user account under the preset risk scoring rule is 5 points.
- the risk score of the user account under the preset risk scoring rules is 0 points. If the buried data is not collected, the user account is in the preset risk calculation. The risk score under the scoring rules is 0.
- the risk control system receives the lottery business request of the first user ID1, and the risk assessment rules for the configuration and lottery business request are the first risk scoring rule, the second risk scoring rule, and the fifth risk scoring rule.
- Logical combination of rules, read ID1-first risk scoring rule -3 points, read ID1-second risk scoring rule -10 points, read ID1-fifth risk scoring rule -100 points, then calculate the total The risk score is 3+10+100 113, and the threshold corresponding to the lottery service request is 100. If the threshold is exceeded, the lottery service request of the user ID1 is rejected.
- Risk assessment rule embodiment two, risk assessment rule is logic or rule
- the risk control system receives the lottery business request of the first user ID1, and the risk assessment rules for the configuration and lottery business request are the first risk scoring rule, the second risk scoring rule, and the fifth risk scoring rule.
- This application provides a risk control system 1, which includes:
- the risk calculation module 100 is used to calculate and process the user's buried point data according to preset risk scoring rules to obtain a risk score;
- the risk judgment module 200 is configured to receive the business request of the user and select the corresponding risk assessment rule and preset threshold according to the business request, and find the risk assessment rule corresponding to the risk score obtained in the step of calculating the risk score The risk score of is used as the evaluation score, and the evaluation score is compared with the threshold corresponding to the business request to obtain the risk evaluation result;
- the risk calculation module 100 and the risk judgment module 200 operate independently.
- the risk calculation module 100 includes:
- the collection module 101 is used to collect user's buried point data
- the calculation module 102 is configured to calculate the risk score according to the preset risk scoring rules for the buried point data
- the conversion module 103 is configured to convert the risk score into a standard data format
- the transmission module 104 is configured to transmit the converted risk score to the storage module via the message queue processing tool;
- the storage module 105 is used to store the risk score.
- the buried point data includes barrage connection behavior data, barrage sending behavior data, room page access behavior data, attention behavior data, gashapon activity data, treasure box collection behavior data, privilege purchase behavior data, At least one of redemption behavior data, lottery behavior data, sign-in behavior data, gift-giving behavior data, or recharge behavior data.
- the conversion module 103 converts the risk score into a standard data format by arranging user account information, risk scoring rule information, and risk score information in a predetermined order.
- the storage module 105 first stores the risk score in the first database; then transmits the risk score to the second database, and the second database sets an expiration date for the risk score.
- the risk control system includes a buffer module 106 for caching the content of the second database through the LRU algorithm.
- the calculation types performed by the calculation module include offline calculations and/or real-time calculations, and the corresponding calculation types are selected according to different application scenarios.
- the risk judgment module 200 includes:
- the receiving module 201 is used to obtain the service request of the user
- the configuration module 202 is configured to select a risk assessment rule and a preset threshold corresponding to the business request according to the business request;
- the reading module 203 is configured to find the risk score corresponding to the risk assessment rule in the storage module 105 as the assessment score;
- the comparison module 204 is configured to determine whether the evaluation score exceeds a preset threshold
- the control module 205 is configured to reject the service request or pass the service request according to the judgment result.
- this application also provides a computer device 2, and the computer device 2 includes:
- the memory 21 is used to store executable program codes
- the processor 22 is configured to call the executable program code in the memory 21, and the execution steps include the above-mentioned risk control method.
- One processor 22 is taken as an example in FIG. 8.
- the memory 21 can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules, such as program instructions corresponding to the risk control method in the embodiments of the present application /Module.
- the processor 22 executes various functional applications and data processing of the computer device 2 by running non-volatile software programs, instructions, and modules stored in the memory 21, that is, implements the risk control method of the foregoing method embodiment.
- the memory 21 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application program required by at least one function; the storage data area may store data of a user's embedded points in the computer device 2.
- the memory 21 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices.
- the memory 21 may optionally include a memory 21 remotely provided with respect to the processor 22, and these remote memories 21 may be connected to the risk control system 1 via a network. Examples of the aforementioned networks include but are not limited to the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
- the one or more modules are stored in the memory 21, and when executed by the one or more processors 22, the risk control method in any of the foregoing method embodiments is executed, for example, the above-described FIG. 4- Figure 6 program.
- the computer device 2 of the embodiment of the present application exists in various forms, including but not limited to:
- Mobile communication equipment This type of equipment is characterized by mobile communication functions, and its main goal is to provide voice and data communications.
- Such terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.
- Ultra-mobile personal computer equipment This type of equipment belongs to the category of personal computers, has calculation and processing functions, and generally also has mobile Internet features.
- Such terminals include: PDA, MID and UMPC devices, such as iPad.
- Portable entertainment equipment This type of equipment can display and play multimedia content.
- Such devices include: audio, video players (such as iPod), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.
- Server A device that provides computing services.
- the structure of a server includes a processor, hard disk, memory, system bus, etc.
- the server is similar to a general-purpose computer architecture, but because it needs to provide highly reliable services, it is , Reliability, security, scalability, and manageability.
- Another embodiment of the present application further provides a non-volatile computer-readable storage medium, the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by one or more processors, such as One processor 22 in FIG. 8 may enable the above-mentioned one or more processors 22 to execute the risk control method in any of the above-mentioned method embodiments, for example, to execute the programs in FIGS. 4 to 6 described above.
- the device embodiments described above are merely illustrative.
- the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place. , Or it can be distributed to at least two network units. Some or all of the modules may be selected according to actual needs to achieve the objectives of the solutions of the embodiments of the present application. Those of ordinary skill in the art can understand and implement it without creative work.
- each implementation manner can be implemented by means of software plus a general hardware platform, and of course, it can also be implemented by hardware.
- Those of ordinary skill in the art can understand that all or part of the processes in the methods of the foregoing embodiments can be implemented by instructing relevant hardware through computer-readable instructions.
- the programs can be stored in a computer-readable storage medium.
- the step of calculating the risk score includes calculating the user's buried point data according to preset risk scoring rules to obtain the risk score;
- the step of judging the degree of risk includes receiving a business request from the user and selecting a corresponding risk assessment rule and a preset threshold according to the business request, and searching for the risk score corresponding to the risk assessment rule from the scores obtained in the risk score calculation step As the evaluation score, the evaluation score is compared with the threshold corresponding to the business request to obtain the risk evaluation result.
- the storage medium can be a magnetic disk, an optical disc, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM), etc.
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Human Resources & Organizations (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Strategic Management (AREA)
- Entrepreneurship & Innovation (AREA)
- Economics (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Databases & Information Systems (AREA)
- Quality & Reliability (AREA)
- Marketing (AREA)
- Operations Research (AREA)
- Tourism & Hospitality (AREA)
- Development Economics (AREA)
- General Business, Economics & Management (AREA)
- Educational Administration (AREA)
- Game Theory and Decision Science (AREA)
- Data Mining & Analysis (AREA)
- Computing Systems (AREA)
- Computer Hardware Design (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computational Linguistics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
Description
Claims (20)
- 一种风险控制方法,包括计算风险得分步骤与判断风险程度步骤,其中:所述计算风险得分步骤包括依据预设风险计分规则对用户的埋点数据进行计算处理,以获取风险得分;所述判断风险程度步骤包括接收所述用户的业务请求并根据所述业务请求选择对应的风险评估规则与预设阈值,在所述计算风险得分步骤获取的得分中寻找所述风险评估规则对应的风险得分作为评估得分,并将所述评估得分与所述业务请求对应的阈值进行比较,获取风险评估结果。
- 根据权利要求1所述的方法,所述计算风险得分步骤包括:采集用户的埋点数据;将所述埋点数据根据预设风险计分规则计算风险得分;将所述风险得分转换成标准数据格式;转换后的得分经消息队列处理工具传输至存储模块,以供存储模块存储所述风险得分。
- 根据权利要求2所述的方法,所述埋点数据包括弹幕连接行为数据、弹幕发送行为数据、访问房间页行为数据、关注行为数据、扭蛋活动行为数据、领取宝箱行为数据、购买特权行为数据、兑换行为数据、抽奖行为数据、签到行为数据、送礼行为数据或充值行为数据中的至少一种。
- 根据权利要求2所述的方法,所述将风险得分转换成标准数据格式是将用户账户信息、风险计分规则信息与风险得分信息按照预定顺序排列。
- 根据权利要求2所述的方法,存储模块存储所述风险得分的步骤,具体包括:将所述风险得分存储至第一数据库;将所述风险得分传输至第二数据库,且所述第二数据库对所述风险得分设置了过期期限。
- 根据权利要求5所述的方法,所述风险得分传输至所述第二数据库之后,还包括:将第二数据库的内容通过LRU算法进行缓存。
- 根据权利要求2所述的方法,所述将埋点数据根据预设风险计分规则计算风险得分中的计算类型包括离线计算和/或实时计算。
- 根据权利要求1-7中任一项所述的方法,所述将所述评估得分与所述业务请求对应的阈值进行比较,获取风险评估结果,具体包括:判断所述评估得分是否超出预设阈值;若是,则拒绝业务请求;若否,则通过业务请求。
- 一种计算机设备,所述计算机设备,包括存储器、处理器以及存储在存储器上并可在处理器上运行的计算机可读指令,所述处理器执行所述计算机可读指令时实现计算风险 得分步骤与判断风险程度步骤,其中:所述计算风险得分步骤包括依据预设风险计分规则对用户的埋点数据进行计算处理,以获取风险得分;所述判断风险程度步骤包括接收所述用户的业务请求并根据所述业务请求选择对应的风险评估规则与预设阈值,在所述计算风险得分步骤获取的得分中寻找所述风险评估规则对应的风险得分作为评估得分,并将所述评估得分与所述业务请求对应的阈值进行比较,获取风险评估结果。
- 根据权利要求9所述的计算机设备,所述计算风险得分步骤包括:采集用户的埋点数据;将所述埋点数据根据预设风险计分规则计算风险得分;将所述风险得分转换成标准数据格式;转换后的得分经消息队列处理工具传输至存储模块,以供存储模块存储所述风险得分。
- 根据权利要求10所述的计算机设备,所述埋点数据包括弹幕连接行为数据、弹幕发送行为数据、访问房间页行为数据、关注行为数据、扭蛋活动行为数据、领取宝箱行为数据、购买特权行为数据、兑换行为数据、抽奖行为数据、签到行为数据、送礼行为数据或充值行为数据中的至少一种。
- 根据权利要求10所述的计算机设备,所述将风险得分转换成标准数据格式是将用户账户信息、风险计分规则信息与风险得分信息按照预定顺序排列;所述将埋点数据根据预设风险计分规则计算风险得分中的计算类型包括离线计算和/或实时计算。
- 根据权利要求10所述的计算机设备,存储模块存储所述风险得分的步骤,具体包括:将所述风险得分存储至第一数据库;将所述风险得分传输至第二数据库,且所述第二数据库对所述风险得分设置了过期期限;以及将第二数据库的内容通过LRU算法进行缓存。
- 根据权利要求9-13任一项所述的计算机设备,所述将所述评估得分与所述业务请求对应的阈值进行比较,获取风险评估结果,具体包括:判断所述评估得分是否超出预设阈值;若是,则拒绝业务请求;若否,则通过业务请求。
- 一种计算机可读存储介质,其上存储有计算机可读指令,所述计算机可读指令被处理器执行时实现计算风险得分步骤与判断风险程度步骤,其中:所述计算风险得分步骤包括依据预设风险计分规则对用户的埋点数据进行计算处理,以获取风险得分;所述判断风险程度步骤包括接收所述用户的业务请求并根据所述业务请求选择对应的风险评估规则与预设阈值,在所述计算风险得分步骤获取的得分中寻找所述风险评估规则对应的风险得分作为评估得分,并将所述评估得分与所述业务请求对应的阈值进行比较,获取风险评估结果。
- 根据权利要求15所述的计算机可读存储介质,所述计算风险得分步骤包括:采集用户的埋点数据;将所述埋点数据根据预设风险计分规则计算风险得分;将所述风险得分转换成标准数据格式;转换后的得分经消息队列处理工具传输至存储模块,以供存储模块存储所述风险得分。
- 根据权利要求16所述的计算机可读存储介质,所述埋点数据包括弹幕连接行为数据、弹幕发送行为数据、访问房间页行为数据、关注行为数据、扭蛋活动行为数据、领取宝箱行为数据、购买特权行为数据、兑换行为数据、抽奖行为数据、签到行为数据、送礼行为数据或充值行为数据中的至少一种;所述将风险得分转换成标准数据格式是将用户账户信息、风险计分规则信息与风险得分信息按照预定顺序排列;所述将埋点数据根据预设风险计分规则计算风险得分中的计算类型包括离线计算和/或实时计算。
- 根据权利要求16所述的计算机可读存储介质,存储模块存储所述风险得分的步骤,具体包括:将所述风险得分存储至第一数据库;将所述风险得分传输至第二数据库,且所述第二数据库对所述风险得分设置了过期期限;以及将第二数据库的内容通过LRU算法进行缓存。
- 根据权利要求15-18任一项所述的计算机可读存储介质,所述将所述评估得分与所述业务请求对应的阈值进行比较,获取风险评估结果,具体包括:判断所述评估得分是否超出预设阈值;若是,则拒绝业务请求;若否,则通过业务请求。
- 一种风险控制系统,包括风险计算模块和风险判断模块,其中:所述风险计算模块,用于依据预设风险计分规则对用户的埋点数据进行计算处理,以获取风险得分;所述风险判断模块,用于接收所述用户的业务请求并根据所述业务请求选择对应的风险评估规则与预设阈值,在所述计算风险得分步骤获取的风险得分中寻找所述风险评估规则对应的风险得分作为评估得分,并将所述评估得分与所述业务请求对应的阈值进行比较,获取风险评估结果。
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US17/636,283 US12361357B2 (en) | 2019-08-22 | 2020-04-29 | Risk control method, computer device, and readable storage medium |
| EP20854478.3A EP4020349A4 (en) | 2019-08-22 | 2020-04-29 | RISK CONTROL PROCEDURE, COMPUTER DEVICE AND READABLE STORAGE MEDIA |
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910780554.0A CN112418580A (zh) | 2019-08-22 | 2019-08-22 | 一种风险控制方法、计算机设备及可读存储介 |
| CN201910780554.0 | 2019-08-22 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2021031607A1 true WO2021031607A1 (zh) | 2021-02-25 |
Family
ID=74660115
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2020/087669 Ceased WO2021031607A1 (zh) | 2019-08-22 | 2020-04-29 | 一种风险控制方法、计算机设备及可读存储介质 |
Country Status (4)
| Country | Link |
|---|---|
| US (1) | US12361357B2 (zh) |
| EP (1) | EP4020349A4 (zh) |
| CN (1) | CN112418580A (zh) |
| WO (1) | WO2021031607A1 (zh) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113010434A (zh) * | 2021-04-07 | 2021-06-22 | 广州启生信息技术有限公司 | 一种实现轻量级应用埋点的系统和方法 |
| CN113570166A (zh) * | 2021-09-08 | 2021-10-29 | 湖南惠农科技有限公司 | 风控实时预测识别方法及装置 |
| CN114297689A (zh) * | 2021-12-29 | 2022-04-08 | 鲁信科技股份有限公司 | 一种基于隐私计算的金融风控方法、设备及存储介质 |
| CN114490302A (zh) * | 2022-03-04 | 2022-05-13 | 大庆火兔网络科技有限公司 | 一种基于大数据分析的威胁行为分析方法及服务器 |
| CN114885183A (zh) * | 2022-04-21 | 2022-08-09 | 武汉斗鱼鱼乐网络科技有限公司 | 一种识别礼包风险用户的方法、装置、介质及设备 |
| CN115499232A (zh) * | 2022-09-26 | 2022-12-20 | 重庆长安汽车股份有限公司 | 实名认证方法、装置、服务器及存储介质 |
| CN117221917A (zh) * | 2023-10-07 | 2023-12-12 | 中国电信股份有限公司技术创新中心 | 基站小区健康度评估方法、装置、计算机设备和存储介质 |
Families Citing this family (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112989135B (zh) * | 2021-04-15 | 2023-03-24 | 杭州网易再顾科技有限公司 | 实时风险团伙的识别方法、介质、装置和计算设备 |
| CN113434681A (zh) * | 2021-06-30 | 2021-09-24 | 平安科技(深圳)有限公司 | 业务操作控制方法、装置、电子设备及介质 |
| CN114511134B (zh) * | 2021-12-30 | 2024-12-17 | 北京字跳网络技术有限公司 | 风控策略生成方法、设备、存储介质及程序产品 |
| CN115102742B (zh) * | 2022-06-16 | 2024-06-18 | 中移(杭州)信息技术有限公司 | 网络请求评估方法、装置、设备及存储介质 |
| CN115134352B (zh) * | 2022-06-27 | 2023-06-20 | 重庆长安汽车股份有限公司 | 一种埋点数据上传方法、装置、设备及介质 |
| CN115730826A (zh) * | 2022-11-25 | 2023-03-03 | 北京奇艺世纪科技有限公司 | 风险控制规则配置方法和装置、电子设备、存储介质 |
| CN117077998A (zh) * | 2023-02-02 | 2023-11-17 | 北京思创信息系统有限公司 | 一种隐患排查方法、系统、终端及存储介质 |
| CN116415237B (zh) * | 2023-03-03 | 2024-03-19 | 港珠澳大桥管理局 | 风险设备识别方法、装置、计算机设备和存储介质 |
| US20240311381A1 (en) * | 2023-03-17 | 2024-09-19 | Ab Initio Technology Llc | Using Metadata to Drive Batch and Real-Time Processing in Data Processing Systems |
| CN117010690B (zh) * | 2023-08-04 | 2024-11-05 | 洛阳炼化宏达实业有限责任公司 | 基于人工智能的生产安全预警方法 |
| CN117113356A (zh) * | 2023-08-08 | 2023-11-24 | 中国人民财产保险股份有限公司 | 安全管控方法、系统和电子设备 |
| CN117132001B (zh) * | 2023-10-24 | 2024-01-23 | 杭银消费金融股份有限公司 | 一种多目标风控策略优化方法及系统 |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107067157A (zh) * | 2017-03-01 | 2017-08-18 | 北京奇艺世纪科技有限公司 | 业务风险评估方法、装置及风控系统 |
| CN107147621A (zh) * | 2017-04-20 | 2017-09-08 | 微医集团(浙江)有限公司 | 互联网医疗黄牛风险控制的实现方法 |
| CN107679897A (zh) * | 2017-09-25 | 2018-02-09 | 北京京东尚科信息技术有限公司 | 一种安全风险控制方法和装置 |
| CN110033171A (zh) * | 2019-03-19 | 2019-07-19 | 阿里巴巴集团控股有限公司 | 一种识别金融企业风险的方法、系统平台和介质 |
Family Cites Families (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7346575B1 (en) * | 2002-01-07 | 2008-03-18 | First Data Corporation | Systems and methods for selectively delaying financial transactions |
| US20040199462A1 (en) * | 2003-04-02 | 2004-10-07 | Ed Starrs | Fraud control method and system for network transactions |
| CN101996381A (zh) * | 2009-08-14 | 2011-03-30 | 中国工商银行股份有限公司 | 一种零售资产风险的计算方法及系统 |
| US8881289B2 (en) * | 2011-10-18 | 2014-11-04 | Mcafee, Inc. | User behavioral risk assessment |
| US9203860B1 (en) * | 2012-03-20 | 2015-12-01 | United Services Automobile Association (Usaa) | Dynamic risk engine |
| US9356939B1 (en) * | 2013-03-14 | 2016-05-31 | Ca, Inc. | System and method for dynamic access control based on individual and community usage patterns |
| CN104423975B (zh) * | 2013-08-21 | 2017-10-10 | 华为技术有限公司 | 数据处理的方法与装置 |
| US20150066575A1 (en) * | 2013-08-28 | 2015-03-05 | Bank Of America Corporation | Enterprise risk assessment |
| EP3078156A4 (en) * | 2013-10-11 | 2017-07-12 | Visa International Service Association | Network token system |
| CN105516071B (zh) * | 2014-10-13 | 2019-01-18 | 阿里巴巴集团控股有限公司 | 验证业务操作安全性的方法、装置、终端及服务器 |
| CN106469376B (zh) * | 2015-08-20 | 2021-12-03 | 创新先进技术有限公司 | 一种风险控制方法和设备 |
| CN105959235B (zh) * | 2016-07-21 | 2019-02-12 | 中国工商银行股份有限公司 | 分布式数据处理系统及方法 |
| CN107886430A (zh) * | 2017-11-29 | 2018-04-06 | 南京甄视智能科技有限公司 | 贷后风险控制方法和系统 |
| US20190287182A1 (en) * | 2018-03-14 | 2019-09-19 | American Express Travel Related Services Company, Inc. | Transaction Compliance Scoring System |
| CN108875388A (zh) * | 2018-05-31 | 2018-11-23 | 康键信息技术(深圳)有限公司 | 实时风险控制方法、装置及计算机可读存储介质 |
| CN109360104A (zh) * | 2018-08-27 | 2019-02-19 | 平安科技(深圳)有限公司 | 用户类型划分方法、系统、计算机设备和存储介质 |
| CN110033153A (zh) * | 2018-12-05 | 2019-07-19 | 阿里巴巴集团控股有限公司 | 一种对信息推荐进行资源奖励方法、装置及设备 |
| US10896574B2 (en) * | 2018-12-31 | 2021-01-19 | Playtika Ltd | System and method for outlier detection in gaming |
| CN109739849B (zh) * | 2019-01-02 | 2021-06-29 | 山东省科学院情报研究所 | 一种数据驱动的网络敏感信息挖掘与预警平台 |
| US11233770B2 (en) * | 2019-07-02 | 2022-01-25 | Vmware Inc. | User behavior based security in a software defined data center |
-
2019
- 2019-08-22 CN CN201910780554.0A patent/CN112418580A/zh active Pending
-
2020
- 2020-04-29 EP EP20854478.3A patent/EP4020349A4/en not_active Withdrawn
- 2020-04-29 US US17/636,283 patent/US12361357B2/en active Active
- 2020-04-29 WO PCT/CN2020/087669 patent/WO2021031607A1/zh not_active Ceased
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107067157A (zh) * | 2017-03-01 | 2017-08-18 | 北京奇艺世纪科技有限公司 | 业务风险评估方法、装置及风控系统 |
| CN107147621A (zh) * | 2017-04-20 | 2017-09-08 | 微医集团(浙江)有限公司 | 互联网医疗黄牛风险控制的实现方法 |
| CN107679897A (zh) * | 2017-09-25 | 2018-02-09 | 北京京东尚科信息技术有限公司 | 一种安全风险控制方法和装置 |
| CN110033171A (zh) * | 2019-03-19 | 2019-07-19 | 阿里巴巴集团控股有限公司 | 一种识别金融企业风险的方法、系统平台和介质 |
Non-Patent Citations (1)
| Title |
|---|
| See also references of EP4020349A4 |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113010434A (zh) * | 2021-04-07 | 2021-06-22 | 广州启生信息技术有限公司 | 一种实现轻量级应用埋点的系统和方法 |
| CN113570166A (zh) * | 2021-09-08 | 2021-10-29 | 湖南惠农科技有限公司 | 风控实时预测识别方法及装置 |
| CN114297689A (zh) * | 2021-12-29 | 2022-04-08 | 鲁信科技股份有限公司 | 一种基于隐私计算的金融风控方法、设备及存储介质 |
| CN114297689B (zh) * | 2021-12-29 | 2022-09-20 | 鲁信科技股份有限公司 | 一种基于隐私计算的金融风控方法、设备及存储介质 |
| CN114490302A (zh) * | 2022-03-04 | 2022-05-13 | 大庆火兔网络科技有限公司 | 一种基于大数据分析的威胁行为分析方法及服务器 |
| CN114885183A (zh) * | 2022-04-21 | 2022-08-09 | 武汉斗鱼鱼乐网络科技有限公司 | 一种识别礼包风险用户的方法、装置、介质及设备 |
| CN115499232A (zh) * | 2022-09-26 | 2022-12-20 | 重庆长安汽车股份有限公司 | 实名认证方法、装置、服务器及存储介质 |
| CN117221917A (zh) * | 2023-10-07 | 2023-12-12 | 中国电信股份有限公司技术创新中心 | 基站小区健康度评估方法、装置、计算机设备和存储介质 |
Also Published As
| Publication number | Publication date |
|---|---|
| EP4020349A1 (en) | 2022-06-29 |
| US20220294821A1 (en) | 2022-09-15 |
| EP4020349A4 (en) | 2022-07-20 |
| US12361357B2 (en) | 2025-07-15 |
| CN112418580A (zh) | 2021-02-26 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2021031607A1 (zh) | 一种风险控制方法、计算机设备及可读存储介质 | |
| CN103647800B (zh) | 推荐应用资源的方法及系统 | |
| CN104539514B (zh) | 消息过滤方法和装置 | |
| CN112104642B (zh) | 一种异常账号确定方法和相关装置 | |
| CN111159587B (zh) | 用户访问信息处理方法、装置及终端设备 | |
| CN104317804B (zh) | 发布投票信息的方法和装置 | |
| US20160379122A1 (en) | Recommendation algorithm optimization method, device and system | |
| CN103106267A (zh) | 基于微博的众包问答系统信息采集方法 | |
| CN110457601A (zh) | 社交账号的识别方法和装置、存储介质及电子装置 | |
| JP2011191911A (ja) | 広告配信装置、広告配信システム、広告配信方法、及びプログラム | |
| CN111523035A (zh) | App浏览内容的推荐方法、装置、服务器和介质 | |
| CN107368499A (zh) | 一种客户标签建模及推荐方法及装置 | |
| CN110290142B (zh) | 基于场景的鉴权方法、装置、服务器及存储介质 | |
| CN114840565B (zh) | 抽样查询方法、装置、电子设备及计算机可读存储介质 | |
| CN114969493B (zh) | 一种内容推荐方法和相关装置 | |
| WO2026007593A1 (zh) | 一种数据处理方法、装置、设备、计算机可读存储介质及计算机程序产品 | |
| CN114547449A (zh) | 推荐资源的确定方法、装置、服务器及计算机程序产品 | |
| US20180070194A1 (en) | Systems and methods for providing an interactive community through device communication | |
| CN115914666B (zh) | 用户识别方法、装置、电子设备及非易失性存储介质 | |
| CN115714708A (zh) | 无宽带用户的确定方法、装置及可读存储介质 | |
| CN116955838A (zh) | 数据处理方法、装置、电子设备以及存储介质 | |
| CN115379261B (zh) | 视频的发送方法、装置、电子设备及存储介质 | |
| CN112434894A (zh) | 一种实时风险控制方法、计算机设备及可读存储介质 | |
| KR101151695B1 (ko) | 이용자 특성에 따른 모바일 에코 시스템 및 이의 서비스 제공 방법 | |
| CN111949876B (zh) | 信息处理方法及装置、电子设备和计算机可读存储介质 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 20854478 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| ENP | Entry into the national phase |
Ref document number: 2020854478 Country of ref document: EP Effective date: 20220322 |
|
| WWG | Wipo information: grant in national office |
Ref document number: 17636283 Country of ref document: US |
|
| WWW | Wipo information: withdrawn in national office |
Ref document number: 2020854478 Country of ref document: EP |