WO2021168617A1

WO2021168617A1 - Processing method and apparatus for service risk management, electronic device, and storage medium

Info

Publication number: WO2021168617A1
Application number: PCT/CN2020/076457
Authority: WO
Inventors: 唐煜
Original assignee: 深圳市欢太科技有限公司; Oppo广东移动通信有限公司
Priority date: 2020-02-24
Filing date: 2020-02-24
Publication date: 2021-09-02
Also published as: CN115004652A

Abstract

The present application relates to the technical field of electronic devices, and discloses a processing method and apparatus for service risk management, an electronic device, and a storage medium. The method comprises: when a device is accessing a current service, acquiring current service data of the device; inputting the current service data into a trained prediction model, so as to obtain a current function value outputted by the trained prediction model; acquiring a current detection result of the current service data on the basis of the current function value and a preset credibility threshold, wherein the current detection result is used to indicate whether or not the current service data is malicious data; and determining a processing procedure for the device accessing the current service on the basis of the current detection result. In an embodiment of the present application, a function value outputted by a trained prediction model and a preset credibility threshold are used to determine whether service data is malicious data, thereby improving the credibility of malicious data determination.

Description

Business risk control processing method, device, electronic equipment and storage medium

Technical field

This application relates to the technical field of electronic equipment, and more specifically, to a business risk control processing method, device, electronic equipment, and storage medium.

Background technique

The current business security risk control system is mainly triggered from business characteristics, segmenting users according to business, and formulating relevant rules to identify black and gray users. First, use Hadoop, Spark and other big data tools to perform statistical analysis on daily business, extract some static or dynamic characteristics related to the business, design a rule base based on business characteristics, use the rule base and the extracted user characteristics to rate users, according to The rating results set the user’s risk level, and open relevant permissions to the user based on the risk level, thereby rejecting certain behaviors of the user. In this process, the black product users found tend to have high credibility, but they often exist among normal users. There are many potential black production users, and these black production users are difficult to identify by the rule system and subdivided users alone.

Summary of the invention

In view of the above problems, this application proposes a business risk control processing method, device, electronic equipment, and storage medium to solve the above problems.

In the first aspect, an embodiment of the present application provides a business risk control processing method, and the method includes:

When the device performs current service access, obtain the current service data of the device; input the current service data into the trained prediction model to obtain the current function value output by the trained prediction model; based on the current function value And a preset credibility threshold to obtain the current detection result of the current service data, where the current detection result is used to characterize whether the current service data is malicious data; The way in which the current business access is handled.

In the second aspect, an embodiment of the present application provides a business risk control processing device, the device includes: a current business data acquisition module for acquiring current business data of the device when the device is performing current business access; current function The value obtaining module is used to input the current business data into the trained prediction model to obtain the current function value output by the trained prediction model; the current detection result obtaining module is used to obtain the current function value based on the current function value and preset The credibility threshold is used to obtain the current detection result of the current business data, where the current detection result is used to characterize whether the current business data is malicious data; the processing mode determination module is used to determine based on the current detection result The processing mode for the current service access of the device.

In a third aspect, an embodiment of the present application provides an electronic device, including a memory and a processor, the memory is coupled to the processor, the memory stores instructions, and the instructions are executed when the instructions are executed by the processor. The processor executes the above method.

In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium stores program code, and the program code can be invoked by a processor to execute the above method.

The business risk control processing method, device, electronic equipment, and storage medium provided in the embodiments of this application acquire the current business data of the device when the device performs current business access, and input the current business data into the trained prediction model to obtain the trained The current function value output by the prediction model is based on the current function value and the preset credibility threshold to obtain the current detection result of the current business data, where the current detection result is used to characterize whether the current business data is malicious data, and it is determined based on the current detection result According to the processing method of the current service access of the device, the function value output by the trained prediction model and the preset credibility threshold are used to determine whether the service data is malicious data, and the credibility of malicious data judgment is improved.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings that need to be used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained from these drawings without creative work.

FIG. 1 shows a schematic flowchart of a business risk control processing method provided by an embodiment of the present application;

FIG. 2 shows a schematic flowchart of a business risk control processing method provided by another embodiment of the present application;

FIG. 3 shows a schematic flowchart of step S206 of the business risk control processing method shown in FIG. 2 of the present application;

FIG. 4 shows a schematic flowchart of step S207 of the business risk control processing method shown in FIG. 2 of the present application;

FIG. 5 shows a schematic flowchart of step S2072 of the business risk control processing method shown in FIG. 4 of the present application;

FIG. 6 shows a schematic flowchart of a business risk control processing method provided by another embodiment of the present application;

FIG. 7 shows a schematic flowchart of a business risk control processing method provided by another embodiment of the present application;

FIG. 8 shows a schematic flowchart of a business risk control processing method provided by yet another embodiment of the present application;

FIG. 9 shows a schematic flowchart of step S501 of the business risk control processing method shown in FIG. 8 of the present application;

FIG. 10 shows a schematic flowchart of step S5012 of the business risk control processing method shown in FIG. 9 of the present application;

Fig. 11 shows a block diagram of a business risk control processing device provided by an embodiment of the present application;

FIG. 12 shows a block diagram of an electronic device used to execute the business risk control processing method according to the embodiment of the present application;

FIG. 13 shows a storage unit used to store or carry program code for implementing the business risk control processing method according to the embodiment of the present application according to an embodiment of the present application.

Detailed ways

In order to enable those skilled in the art to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the accompanying drawings in the embodiments of the present application.

Aiming at the current method of identifying black users through a rule system and segmented users, the inventor found through research that the rule system generally includes a data storage system composed of non-relational databases and relational databases, consisting of real-time computing training and discrete computing clusters. The real-time computing cluster is used for online computing, and the offline computing cluster is used for periodic execution tasks. The rule engine generates rules through the rule library, which optimizes the matching of rules and increases the efficiency of the real-time risk control system. , And the rule system has added an index-based and model-based risk control rule evaluation mechanism to ensure the effectiveness of the risk control rules. However, the rule system has the following problems: 1. Different rules are formulated according to different business needs, and there are shortcomings such as mutual independence, weak coordination and complex rules under the rule setting; 2. Because most of the rules formulated according to the business are It is believed that the interpretable features related to the business are crossed out, so the black production users can make a better breakthrough when creating false data; 3. The business risk control system is inconsistent in real-time protection and offline protection. The business characteristics of offline data are more comprehensive, and more rules are targeted. Real-time data often has limited rules due to the time inconsistency of the data source.

In response to the above problems, the inventor has discovered through long-term research and proposed the business risk control processing method, device, electronic equipment, and storage medium provided by the embodiments of this application. The function value and preset credibility output by the trained prediction model The degree threshold determines whether the business data is malicious data, and improves the credibility of malicious data judgment. Among them, the specific business risk control processing method will be described in detail in the subsequent embodiments.

Please refer to FIG. 1, which shows a schematic flowchart of a business risk control processing method provided by an embodiment of the present application. The business risk control processing method determines whether the business data is malicious data through the function value output by the trained prediction model and the preset credibility threshold, thereby improving the credibility of malicious data judgment. In a specific embodiment, the business risk control processing method is applied to the business risk control processing device 200 shown in FIG. 11 and the electronic device 100 configured with the business risk control processing device 200 (FIG. 12). The following will take an electronic device as an example to describe the specific process of this embodiment. Of course, it is understandable that the electronic device applied in this embodiment may be a smart phone, a tablet computer, a wearable electronic device, etc., which is not limited here. The following will elaborate on the process shown in Figure 1. The business risk control processing method may specifically include the following steps:

Step S101: Acquire current service data of the device when the device performs current service access.

In some embodiments, business visits may include, for example, application browsing in a software store, application download in a software store, and application installation in a software store, etc., and may include product browsing in a shopping platform, ordering of products on a shopping platform, and product collection on a shopping platform. It can also include game browsing in a game store, game download in a game store, etc., which are not limited here. In some embodiments, the device may include, but is not limited to: a mobile terminal, a tablet computer, a desktop computer, a wearable electronic device, etc., which is not limited herein.

In this embodiment, when the device performs current service access, the current service data of the device can be obtained. For example, when the device is visiting the current software store, the current business data of the device can be acquired, or when the device is visiting the current shopping platform, the current business data of the device can be acquired, etc. In some implementations, the current service data of the device may include: whether the device number corresponding to the device appears in two different places at the same time period, whether the device model does not meet the specifications, the normal active duration of the device, and whether the device corresponding number is Violations have been recorded, the number of violations corresponding to the device has been recorded, and the credit score of the number corresponding to the device, etc., are not limited here.

Step S102: Input the current service data into the trained prediction model, and obtain the current function value output by the trained prediction model.

In this embodiment, after obtaining the current service data of the device, the current service data can be input into the trained prediction model, where the trained prediction model is obtained through machine learning. Specifically, the training data set is first collected , Where the attributes or features of one type of data in the training data set are distinguished from another type of data, and then the neural network is trained and modeled by the collected training data set according to a preset algorithm, so as to summarize based on the training data set Laws, get the trained prediction model. In this embodiment, the training data set may include, for example, service data of multiple devices and function values corresponding to the service data of multiple devices. Among them, the trained prediction model can be used to output the current function value according to the current service data of the device. In this embodiment, the current service data of the device can be input into the trained prediction model, and the current function value output by the trained prediction model can be obtained.

In some embodiments, the trained prediction model may be stored locally in the electronic device after pre-training is completed. Based on this, after obtaining the current business data of the device, the electronic device can directly call the trained prediction model locally. For example, it can directly send an instruction to the trained prediction model to instruct the trained prediction model to be stored in the target. The area reads the current business data of the device, or the electronic device can directly input the current business data of the device into the trained prediction model stored locally, thereby effectively avoiding the reduction of the current business data input of the device due to the influence of network factors. The speed of the predicted model is to improve the speed at which the trained predictive model obtains the current business data of the device and improve the user experience.

In some embodiments, the trained prediction model may also be stored in a server that is in communication with the electronic device after the pre-training is completed. Based on this, after the electronic device obtains the current business data of the device, it can send an instruction through the network to the trained prediction model stored in the server to instruct the trained prediction model to read the current business data of the device through the network, or electronic The device can send the current business data of the device to the trained prediction model stored on the server through the network, so that by storing the trained prediction model on the server, the storage space of the electronic device is reduced, and the need for the electronic device is reduced. The impact of normal operation.

Among them, the current function value output by the trained prediction model can be sigmoid, where the sigmoid function is a common sigmoid function in biology, and it also becomes a sigmoid growth curve. In information science, due to its single increase and reverse The sigmoid function is often used as the activation function of neural networks to map variables between 0-1. In some embodiments, the current function value output by the trained prediction model based on the current service data of the device is between 0-1, where the sigmoid result is generally greater than 0.5 as label 1, that is, the current service whose sigmoid result is greater than 0.5 The data is used as blacklist data (malicious data), and the sigmoid result is not greater than 0.5 as tag 0, that is, the current business data whose sigmoid result is not greater than 0.5 is regarded as whitelist data (non-malicious data).

Step S103: Obtain a current detection result of the current service data based on the current function value and a preset credibility threshold, where the current detection result is used to characterize whether the current service data is malicious data.

In some embodiments, the credibility threshold may be preset and stored as the preset credibility threshold, and the preset credibility threshold is used as the judgment result of the current function value output by the trained prediction model. Therefore, in In this embodiment, after obtaining the current function value output by the trained prediction model, the current function value can be compared with a preset credibility threshold to obtain a comparison result, and based on the comparison result, the current business data of the current business data can be obtained. Test results. Wherein, the preset credibility threshold may be obtained by calculating the business data of multiple devices in the historical time period through the rule system.

In some embodiments, the preset credibility threshold may be 0.5. After obtaining the current function value output by the trained prediction model, the current function value and 0.5 may be compared to obtain the comparison result, and based on the comparison As a result, the current detection result of the current business data is obtained. Wherein, when the current function value is less than 0.5, the comparison result indicates that the current function value is less than the preset credibility threshold. At this time, the obtained current business data detection result indicates that the current business data is non-malicious data, that is, the current business data corresponds to The device reaches sufficient normal active time and so on. When the current function value is not less than 0.5, the comparison result indicates that the current function value is not less than the preset credibility threshold. At this time, the obtained current business data detection result indicates that the current business data is malicious data, that is, the current business data corresponds to The same device number corresponding to the device appears in two different places in the same segment of the event, and the model of the device does not conform to the specification, etc.

Step S104: Determine a processing method for the current service access of the device based on the current detection result.

In some implementation manners, after the current detection result of the current service data is obtained, the processing method for the current service access of the device may be determined based on the current detection result. For example, when the current detection result of the current business data is that the current business data of the device is malicious data, the current business access of the device may be characterized by the software store swiping the amount and the shopping platform swiping the order. Therefore, the current business data can be rejected The current business access of the device. When the current detection result of the current business data is that the current business data of the device is non-malicious data, the current business access of the device is characterized by the fact that there is no software store swiping, and the shopping platform swiping the order is a normal business visit. Therefore, the current business access of the device can be performed.

The business risk control processing method provided by an embodiment of the present application obtains the current business data of the device when the device performs current business access, inputs the current business data into the trained prediction model, and obtains the current function value output by the trained prediction model Based on the current function value and the preset credibility threshold, the current detection result of the current business data is obtained, where the current detection result is used to characterize whether the current business data is malicious data, and the current business access for the device is determined based on the current detection result In this way, the function value output by the trained prediction model and the preset credibility threshold are used to determine whether the business data is malicious data, and the credibility of malicious data judgment is improved.

Please refer to FIG. 2, which shows a schematic flowchart of a business risk control processing method provided by another embodiment of the present application. Wherein, the current detection result is also used to characterize the current business data as uncertain data. The process shown in FIG. 2 will be described in detail below. The business risk control processing method may specifically include the following steps:

Step S201: When the device performs current service access, obtain the current service data of the device.

Step S202: Input the current service data into the trained prediction model, and obtain the current function value output by the trained prediction model.

Step S203: Obtain a current detection result of the current service data based on the current function value and a preset credibility threshold, where the current detection result is used to characterize whether the current service data is malicious data.

For the specific description of step S201 to step S203, please refer to step S101 to step S103, which will not be repeated here.

Step S204: When the current detection result characterizes that the current service data is malicious data, deny the current service access of the device.

In some embodiments, when it is determined that the current detection result characterizes the current business data as malicious data, for example, when the current function value output by the trained prediction model is 0.8 and the preset credibility threshold is 0.5, it can be determined that the current detection The result indicates that the current business data is malicious data. Therefore, the current business access of the device can be denied to ensure the authenticity of the application ranking of the software store and the product ranking of the shopping platform, so as to reduce the influence of malicious data on the user's normal selection.

Step S205: When the current detection result characterizes that the current service data is non-malicious data, execute the current service access of the device.

In some embodiments, when it is determined that the current detection result characterizes the current business data as non-malicious data, for example, when the current function value output by the trained prediction model is 0.2 and the preset credibility threshold is 0.5, it can be determined that the current The detection result indicates that the current business data is non-malicious data. Therefore, the current business access of the device can be performed to provide real data for the application ranking of the software store, the product ranking of the shopping platform, etc., to provide a reference for the user's choice.

Step S206: When the current detection result characterizes that the current service data is uncertain data, obtain other service data when the device is accessing other services.

Among them, in practice, the rule label model has a certain probability of misjudgment, that is, there is a misjudgment for the result of sigmoid of 0.5 or less. For example, when the preset credibility threshold is 0.5 and the current function value is 0.6, according to the judgment rule of the rule label model, because the current function value is greater than the preset credibility threshold, the current detection result obtained represents the current business data It is malicious data. However, in practice, the current business data with the current function value of 0.6 is not necessarily malicious data. Therefore, only passing 0.5 as the basis for judgment may lead to misjudgment.

Therefore, in order to reduce the probability of misjudgment of the rule label model, in this embodiment, the calculation can be performed based on the business data of multiple devices in the historical time period, and the preset credibility threshold is set to reduce the interval of 0-1 The original two intervals (0-0.5, 0.5-1) are optimized into three intervals, that is, the current business data represented by the detection result obtained based on the current function value and the preset credibility threshold in this embodiment may include: Malicious data, uncertain data, and non-malicious data. For example, the preset credibility threshold may include 0.3 and 0.7, and accordingly, the interval of 0-1 may be divided into an interval of 0-0.3, an interval of 0.3-0.7, and an interval of 0.7-1, where, When the current function value is in the range of 0-0.3, it can be determined that the current business data corresponding to the current function value is non-malicious data. When the current function value is in the range of 0.3-0.7, it can be determined that the current business data corresponding to the current function value is Uncertain data, when the current function value is in the range of 0.7-1, it can be determined that the current business data corresponding to the current function value is malicious data.

In some embodiments, when the current detection result characterizes that the current service data is uncertain data, in order to more accurately determine whether the current service data of the device is malicious data, other service data of the device when accessing other services can be obtained, where , The obtained other business data may include: business data of the device in other aspects, violations of rules in other fields of the device, etc., which are not limited here. For example, when the current business visit of the device is an application download in a software store, if the current detection result indicates that the current business data is uncertain data, the device can obtain other information when the device is downloading games in the game store or communicating with products on the shopping platform. The business data is used as a reference for the current test results.

Please refer to FIG. 3, which shows a schematic flowchart of step S206 of the business risk control processing method shown in FIG. 2 of the present application. The following will elaborate on the process shown in FIG. 3, and the method may specifically include the following steps:

Step S2061: When the current detection result characterizes that the current service data is uncertain data, obtain the service type of the current service data.

In some embodiments, when the current detection result indicates that the current business data is uncertain data, the business type of the current business data can be acquired. Among them, the service type of the current service data can be determined according to the current service access. For example, if the current business visit is application browsing of a software store, the business type of the current business data can be determined to be the first type. If the current business visit is application download or installation of the software store, the business type of the current business data can be determined to be the second type. Type, if the current business visit is the product browsing of the shopping platform, the business type of the current business data can be determined to be the first type. If the current business visit is the order of the goods on the shopping platform, the business type of the current business data can be determined to be the second type Wait.

Step S2062: When the service type of the current service data meets the preset service type, obtain other service data when the device is accessing other services.

In some embodiments, a preset service type may be preset and stored, and the preset service type is used as a basis for judging the service type of the current data. Therefore, in this embodiment, after obtaining the service type of the current service data , The service type of the current service data can be compared with the preset service type to determine whether the service type of the current service data meets the preset service type. If it is satisfied, the other service data of the device during other service access is obtained. If it is not satisfied, the current detection result obtained shall prevail, and the processing method of the current service access to the device is determined according to the current detection result. For example, in this embodiment, the preset service type may be the second type, and when the current service visit is application download in the software store, application installation in the software store, or product order on the shopping platform, the current business data can be determined The business type meets the preset business type; when the current business visit is the application browsing of the software store or the product browsing of the shopping platform, it can be determined that the business type of the current business data does not meet the preset business type.

In some embodiments, when the service type of the current service data meets the transaction type, it is determined that the service type of the current service data meets the preset service type, and other service data of the device when accessing other services can be obtained. Among them, if the business type of the current business data meets the transaction type, it means that the current business visit may be related to money, and business visits are more important. Therefore, in order to reduce the possibility of misjudgment, you can also obtain other services of the device during other business visits. Data to improve the accuracy of the current test results.

Step S207: Input the current service data and the other service data into the trained prediction model, and obtain other function values output by the trained prediction model.

Among them, the trained prediction model can also be used to output other function values based on the current business data and other business data of the device. In some embodiments, after obtaining other service data of the device, the current service data and other service data can be input into the trained prediction model to obtain other function values output by the trained prediction model.

Please refer to FIG. 4, which shows a schematic flowchart of step S207 of the business risk control processing method shown in FIG. 2 of the present application. The following will elaborate on the process shown in FIG. 4, and the method may specifically include the following steps:

Step S2071: Obtain intelligence scores corresponding to other business data when the device is accessing other services, where the intelligence scores are used to characterize the probability that the other business data is not non-malicious data.

In this embodiment, after acquiring other business data of the device during other business access, the intelligence score corresponding to the other business data of the device during other business access can be acquired, where the intelligence score is used to characterize or reflect The probability that other business data is not malicious data. In some implementations, media situation analysis can be performed by contacting business-side features, and related policies can be generated for devices with uncertain data, so as to obtain device violations of rules in other areas, and determine whether devices violate rules in other areas. The intelligence score corresponding to other business data when the device is accessing other business.

Step S2072: Perform data enhancement processing on the other business data based on the intelligence score to obtain multiple other business data.

In this embodiment, after acquiring the intelligence score corresponding to other business data when the device is performing other business access, data enhancement processing (the frequency of other business data recurring) can be performed on other business data based on the intelligence score to obtain Multiple other business data. Among them, data enhancement refers to an effective way to expand the size of data samples. Deep learning is a method based on big data. We currently hope that the larger the scale and the higher the quality of the data, the better, but in the actual process, it is difficult for the collected data to cover all scenarios. There are different enhancement methods for different data types. For example, data enhancement for image data mainly includes methods such as image rotation, image segmentation, image RGB change, and image scaling. For text files, there are methods such as synonym replacement, document cropping, word vector preprocessing, and dictionary use. Regarding the numerical data faced in business risk control, there are mainly features such as cross combination of characteristics and repeated appearance of sample data, so as to obtain multiple other business data through data enhancement processing.

Please refer to FIG. 5, which shows a schematic flowchart of step S2072 of the business risk control processing method shown in FIG. 4 of the present application. The following will elaborate on the process shown in FIG. 5, and the method may specifically include the following steps:

Step S20721: Obtain the duration of the intelligence score corresponding to the other service data when the device is accessing other services.

In some implementations, after acquiring other business data of the device during other business accesses, the intelligence scores corresponding to other business data of the device during other business accesses can be acquired, as well as other business data of the device during other business accesses. The business data corresponds to the duration of the intelligence score. In some implementations, you can analyze the media situation by contacting the business side features, generate relevant strategies for devices with uncertain data (online), and correspond to the situation of the device in the next few days based on the uncertain data (offline), so as to obtain the status of the device. Violation of rules in other areas and the duration of the device's status in this dimension. Based on the violation of rules in other areas and the duration of the device's status in this dimension, determine the device's other services when accessing other services The intelligence score corresponding to the data, and the duration of other business data corresponding to the intelligence score when the device is accessing other services.

Step S20722: Perform data enhancement processing on the other business data based on the intelligence score and the duration to obtain multiple other business data.

In this embodiment, after obtaining the intelligence score corresponding to other business data when the device is performing other business visits, and the duration of the other business data corresponding to the intelligence score when the device is performing other business visits, the intelligence score can be based on the intelligence score. Perform data enhancement processing on other business data to obtain multiple other business data. Among them, the intelligence score and the data enhancement multiple are positively correlated, that is, the higher the intelligence score, the higher the data enhancement multiple, the lower the intelligence score, the lower the data enhancement multiple. In some embodiments, the duration and the data enhancement factor are positively correlated, that is, the longer the duration, the higher the data enhancement factor, and the shorter the duration, the lower the data enhancement factor.

Step S2073: Input the current service data and the multiple other service data into the trained prediction model, and obtain other function values output by the trained prediction model.

Step S208: Obtain the current service data and other detection results of the other service data based on the other function value and the preset credibility threshold, where the other detection results are used to characterize the current service Whether the data is malicious data.

In this embodiment, after obtaining other function values output by the trained prediction model, the other function values can be compared with a preset credibility threshold to obtain a comparison result, and based on the comparison result, the current business data can be obtained. Other test results. It is understandable that since the input data of the trained prediction model changes from current business data to current business data and other business data, the trained prediction model is based on the current function value output by the current business data and based on the current business data and Other function values output by other business data are different, that is, the current detection result obtained is different from other detection results, so that the purpose of optimizing the detection result and reducing judgment can be achieved.

Step S209: Determine a processing mode for the current service access of the device based on the other detection results.

In some embodiments, after obtaining other detection results of the current service data, the processing mode for the current service access of the device may be determined based on the other detection results.

In the business risk control processing method provided by another embodiment of the present application, when the current detection result indicates that the current business data is uncertain, other business data of the device in other aspects are jointly input into the trained prediction model to obtain the detection result, so as to improve The accuracy of the test results.

Please refer to FIG. 6. FIG. 6 shows a schematic flowchart of a business risk control processing method provided by another embodiment of the present application. The process shown in Figure 6 will be described in detail below. The business risk control processing method may specifically include the following steps:

Step S301: When the device performs the current service access, obtain the current service data of the device.

Step S302: Input the current service data into the trained prediction model, and obtain the current function value output by the trained prediction model.

Step S303: Obtain a current detection result of the current service data based on the current function value and a preset credibility threshold, where the current detection result is used to characterize whether the current service data is malicious data, or Uncertain data.

Step S304: Determine a processing mode for the current service access of the device based on the current detection result.

For the specific description of step S301 to step S304, please refer to step S101 to step S104, which will not be repeated here.

Step S305: Obtain multiple first function values output by the trained prediction model in the first time period and multiple second function values output in the second time period, where the first time period And the second time period are adjacent time periods.

Among them, in business security, there are offensive and defensive situations. The black production users attack the business in a way that is not static. They will change the attack method over time and forge new data to deceive the trained prediction model. Therefore, in this embodiment , It can monitor the changes of the inspection results that characterize the business data as uncertain data to determine whether the trained prediction model needs to be retrained. In some embodiments, multiple first function values output based on business data in the first time period of the trained prediction model, and multiple second function values output based on business data in the second time period can be obtained. , Where the first time period and the second time period are adjacent time periods. It should be noted that the length of the first time period and the second time period are not limited here, and the first time period can be before the second time period or after the second time period, which is not limited here. .

Step S306: Obtain a plurality of first detection results based on the plurality of first function values and a preset credibility threshold, and obtain a plurality of second detections based on the plurality of second function values and a preset credibility threshold result.

In this embodiment, after obtaining the multiple first function values output by the trained prediction model in the first time period and the multiple second function values output in the second time period, it may be based on the multiple first function values. The function value and the preset credibility threshold obtain multiple first detection results, and the multiple second detection results are obtained based on the multiple second function values and the preset credibility threshold.

Step S307: Obtain the proportion of the plurality of first detection results that characterize the business data as uncertain data as the first proportion, and obtain the proportion of the plurality of second detection results that characterize the business data as uncertain data as the second proportion. Proportion.

It is understandable that the multiple first detection results include: the first detection result that characterizes the business data as malicious data, the first detection result that characterizes the business data as non-malicious data, and the first detection result that characterizes the business data as uncertain data. One test result. Therefore, the proportion of the first test results that characterize the business data as uncertain data can be obtained as the first proportion. Specifically, the number of the first test results that characterize the business data as uncertain data can be used as the numerator to increase the number of The first detection result is used as the denominator to calculate the calculation result obtained as the first ratio.

It is understandable that the multiple second detection results include: the second detection result that characterizes the business data as malicious data, the second detection result that characterizes the business data as non-malicious data, and the first detection result that characterizes the business data as uncertain data. 2. Test results. Therefore, the proportion of the multiple second test results that characterize the business data as uncertain data can be obtained as the second proportion. Specifically, the number of the second test results that characterize the business data as uncertain data can be used as the numerator to increase the number of test results. The second detection result is used as the denominator to calculate the calculation result obtained as the second ratio.

Step S308: When the difference between the first ratio and the second ratio is greater than a specified difference, retrain the trained prediction model.

In some embodiments, a designated difference may be preset and stored, and the designated difference may be used as a basis for determining the difference between the first ratio and the second ratio. Therefore, in this embodiment, after the first ratio and the second ratio are obtained, the difference between the first ratio and the second ratio can be calculated to obtain the difference between the first ratio and the second ratio, and The difference between the first ratio and the second ratio is compared with the specified difference. When the comparison result indicates that the difference between the first ratio and the second ratio is greater than the specified difference, it indicates the difference between two adjacent time periods. If the uncertain data in the business data fluctuates greatly, the trained prediction model needs to be retrained. When the comparison result indicates that the difference between the first proportion and the second proportion is not greater than the specified difference, the characterization is If there is no change or small change in the uncertain data in the business data of two adjacent time periods, there is no need to retrain the trained prediction model.

The business risk control processing method provided in another embodiment of the present application also monitors uncertain data in the detection result determined based on the function value output by the trained prediction model, and re-predicts when the detection result is abnormal. The model is trained to optimize the prediction model and improve the accuracy of the detection results.

Please refer to FIG. 7, which shows a schematic flowchart of a business risk control processing method provided by another embodiment of the present application. The following will elaborate on the process shown in Figure 7. The business risk control processing method may specifically include the following steps:

Step S401: Obtain a first training data set, where the first training data set includes first service data of multiple devices and function values corresponding to the first service data of the multiple devices.

Regarding the trained prediction model in the foregoing embodiment, the embodiment of this application also includes a training method for the prediction model, wherein the training of the prediction model may be performed in advance according to the acquired training data set, and each subsequent time When the function value is predicted, the prediction can be made according to the prediction model, without the need to train the prediction model every time a prediction is made.

In this embodiment, a first training data set may be obtained, and the first training data set includes first service data of multiple devices and function values corresponding to the first service data of multiple devices. In some embodiments, the first training data set may be collected in a historical time period.

Step S402: Based on the first training data set, the first service data of the multiple devices are used as input data, and the function values corresponding to the first service data of the multiple devices are used as output data, using a machine learning algorithm Perform training to obtain the first prediction model as the trained prediction model.

In the embodiment of the present application, for the first training data set, a machine learning algorithm may be used for training, so as to obtain the first prediction model as the trained prediction model. Among them, the machine learning algorithms used can include: neural networks, Long Short-Term Memory (LSTM) networks, threshold loop units, simple loop units, autoencoders, decision trees, random forests, feature mean classification, classification Regression tree, hidden Markov, K-Nearest Neighbor (KNN) algorithm, logistic regression model, Bayesian model, Gaussian model and KL divergence (Kullback-Leibler divergence), etc.

The following takes a neural network as an example to illustrate the training of the initial model based on the training data set.

The first business data of multiple devices in a set of data in the training data set are used as the input samples (input data) of the neural network, and the function values corresponding to the first business data of multiple devices in the set of data are used as the output samples of the neural network ( Output Data). The neurons in the input layer are fully connected with the neurons in the hidden layer, and the neurons in the hidden layer are fully connected with the neurons in the output layer, which can effectively extract potential features of different granularities. And the number of hidden layers can be multiple, so as to better fit the non-linear relationship and make the prediction model obtained by training more accurate.

It is understandable that the training process of the prediction model may be completed by electronic equipment, or may not be completed by electronic equipment. When the training process is not completed by the electronic device, the electronic device can be used only as a direct user or an indirect user.

In some embodiments, the prediction model may periodically or irregularly obtain new training data, and train and update the prediction model.

Step S403: When the device performs current service access, obtain the current service data of the device.

Step S404: Input the current service data into the trained prediction model, and obtain the current function value output by the trained prediction model.

Step S405: Obtain a current detection result of the current service data based on the current function value and a preset credibility threshold, where the current detection result is used to characterize whether the current service data is malicious data.

Step S406: Determine a processing mode for the current service access of the device based on the current detection result.

For the specific description of step S403 to step S406, please refer to step S101 to step S104, which will not be repeated here.

In the business risk control processing method provided by another embodiment of the present application, the first prediction model is obtained as a trained prediction model through the first training data set and the machine learning algorithm, so as to improve the trained prediction model based on the input data. The accuracy of the output data.

Please refer to FIG. 8, which shows a schematic flowchart of a business risk control processing method provided by yet another embodiment of the present application. The following will elaborate on the process shown in Figure 8. The business risk control processing method may specifically include the following steps:

Step S501: Obtain a first training data set, where the first training data set includes first service data of multiple devices and function values corresponding to the first service data of the multiple devices.

Please refer to FIG. 9, which shows a schematic flowchart of step S501 of the business risk control processing method shown in FIG. 8 of the present application. The process shown in FIG. 9 will be described in detail below, and the method may specifically include the following steps:

Step S5011: Obtain the first service data of the multiple devices.

Step S5012: Add tags to the first service data of the multiple devices respectively based on preset rules to obtain the first service data tags of the multiple devices.

In some implementations, this embodiment can also provide a rule system, where the rule system can generate a blacklist and a whitelist based on historical data, so as to add tags to the collected first business data, and violate the rules based on the overall historical data. In the case, set the credibility threshold of the label. The rules are mainly composed of two aspects: a. The business history generates a blacklist. In business risk control, users will give feedback to the official after their account is stolen. The same device number appears in two different places at the same time, and the device model does not meet the specifications. This accurate information will form a business blacklist. And get the credibility of the blacklist. b. The business history generates a whitelist. According to the normal active duration of the device, a business whitelist is formed, and the credibility of the whitelist is obtained.

In this embodiment, after acquiring the first service data of multiple devices, the first service data of the multiple devices may be labeled based on a preset rule system (preset rules) to obtain the first service data of the multiple devices. A business data label. In some embodiments, when the first service data of the device is obtained, a blacklist label or a whitelist label is added to the first service data based on a preset rule, wherein, when the preset rule determines the value of the first service data of the device When at least part of the information does not meet the requirements, it is determined that the first service data of the device is blacklist data, and a blacklist tag can be added to the first service data of the device, for example, tag 1. When the preset rule determines that the first service data of the device is the first When all the information of the business data meets the regulations, it is determined that the first business data of the device is whitelist data, and a whitelist label may be added to the first business data of the device, for example, a label 0 is added.

Please refer to FIG. 10, which shows a schematic flowchart of step S5012 of the business risk control processing method shown in FIG. 9 of the present application. The process shown in FIG. 10 will be described in detail below, and the method may specifically include the following steps:

Step S50121: respectively detect whether the first service data of the multiple devices meet the preset rule.

In some embodiments, after acquiring the first service data of multiple devices, it can be detected whether the first service data of multiple devices meets preset rules, where the preset rules may include those in the rule system that determine that they meet the blacklist Rules corresponding to business data. That is, after acquiring the first service data of multiple devices, it is possible to separately detect whether the first service data of multiple devices meet the blacklist data.

Step S50122: Add a first tag to the first service data of the device that is detected to meet the preset rule, and add a second tag to the first service data of the device that is detected to not meet the preset rule to obtain multiple devices The first business data label.

In some embodiments, the detection result is obtained by separately detecting whether the first service data of multiple devices meets the preset rule, and the first service data of the detected device satisfying the preset rule is added to the first service data according to the detection result. Label, adding a second label to the detected first service data of the device that does not meet the preset rule, so as to obtain the first service data label of the multiple devices. Among them, when the preset rule includes the rule corresponding to the business data that is determined to meet the blacklist in the rule system, the first business data of the device that is detected to meet the blacklist can be added to the first label, such as adding label 1, it will be detected A second label is added to the first service data of devices that do not meet the blacklist. For example, when label 0 is added, the first service data labels of multiple devices can be obtained, that is, multiple labels 0 and multiple labels 1 can be obtained and output.

Step S50123: Obtain the proportion of the first business data that meets the preset rule among the first business data of the multiple devices as the first proportion.

It can be understood that the first service data of multiple devices includes: the first service data of devices that meet the preset rules and the first service data of devices that do not meet the preset rules. Therefore, multiple devices can be acquired. Among the first service data of, the first service data that meets the preset rule is used as the numerator, and the calculation result obtained by using the first service data of multiple devices as the denominator is used as the first proportion.

Step S50124: Acquire the proportion of the first business data that does not meet the preset rule among the first business data of the multiple devices as a second proportion.

It can be understood that the first service data of multiple devices includes: the first service data of devices that meet the preset rules and the first service data of devices that do not meet the preset rules. Therefore, multiple devices can be acquired. Among the first service data of, the first service data that does not meet the preset rule is used as the numerator, and the calculation result obtained by using the first service data of multiple devices as the denominator is used as the second proportion.

Step S50125: Obtain a credibility threshold based on the first proportion and the second proportion as a preset credibility threshold.

In some embodiments, after obtaining the first proportion and the second proportion, the credibility threshold may be obtained based on the first proportion and the second proportion as the preset credibility threshold. Specifically, after obtaining the first proportion and the second proportion, the black sample credibility threshold and the white sample credibility threshold may be obtained based on the first proportion and the second proportion as the preset credibility threshold. Wherein, when the preset rule includes the rule corresponding to the business data satisfying the blacklist in the rule system, the black sample credibility threshold can be obtained based on the first proportion, and the white sample credibility can be obtained based on the second proportion Threshold.

For example, when the first service data of multiple devices includes four, three of which meet the preset rule, and one of them does not meet the preset rule, the first proportion is 0.75, and the second proportion is 0.25. Therefore, The reliability threshold can be 0-0.25, 0.25-0.75, and 0.75-1, that is, business data with a function value in the range of 0-0.25 is non-malicious data, and business data with a function value in the range of 0.25-0.75 is uncertain data, and the function value The business data at 0.75-1 is malicious data.

Step S5013: Obtain a first training data set, where the training data set includes first service data labels of multiple devices and function values corresponding to the first service data labels of multiple devices.

Step S502: Based on the first training data set, the first service data of the multiple devices are used as input data, and the function values corresponding to the first service data of the multiple devices are used as output data, using a machine learning algorithm Perform training to obtain the first prediction model as the trained prediction model.

In some embodiments, based on the first training data set, the first service data of multiple devices can be processed by Onehot as input data, and the function values corresponding to the first service data of multiple devices can be used as output data. The machine learning algorithm is trained to obtain the first prediction model as the trained prediction model.

In some embodiments, based on the first training data set, the first service data of multiple devices can be processed by Onehot as input data, and the function values corresponding to the first service data of multiple devices can be used as output data. The algorithm is trained to obtain the first prediction model as the trained prediction model.

Specifically, business security needs Menorization and Generalization characteristics for black and gray users. It not only needs to remember the characteristics of black and gray users, but also needs to dig out new features based on the characteristics of black and gray users to predict potential black and gray users. At the same time, the data after adding labels for business security has the characteristics of more discrete features and fewer continuous features. After the discrete features are processed by Onehot, the dimensionality will become very high, which is not conducive to the processing of tree models and other algorithms. , Among them, Onehot processing: also known as one-bit effective encoding, which mainly uses N-bit status registers to encode N states. Each state has its own independent register bit, and only one bit is valid at any time. In machine learning, it is often used to process discrete features of data and program sparse features. Based on these two characteristics, the DeepFM algorithm is used as the base algorithm of the prediction model. DeepFM is a typical Wide&Deep algorithm. The Wide side uses the FM algorithm, which has the function of Memorization, and can memorize the original characteristics of the black production; its Deep side is a deep neural network model, and the number of layers and each layer on the Deep side can be selected according to the data feature dimension and the size of the data volume. Layer nodes (3 layers of neural networks are generally selected, and the number of nodes in each layer is generally the same). This side has the characteristics of Generalization, which can generate new features for predicting black and gray users.

Step S503: Obtain the detection result of the first service data of the multiple devices based on the function values corresponding to the first service data of the multiple devices and the preset credibility threshold.

In this embodiment, after the function values corresponding to the first service data of the multiple devices are collected, the function values can be compared with a preset credibility threshold to obtain a comparison result, and multiple devices can be obtained based on the comparison result. The detection result of the first service data of the device.

Step S504: When the detection result of the first service data of the multiple devices characterizes that the first service data of the target device in the first service data of the multiple devices is uncertain data, acquire the first service data of the target device 2. Business data.

In some embodiments, when the detection result of the first service data of multiple devices characterizes that the first service data of the target device in the first service data of the multiple devices is uncertain data, the prediction model trained for time is more accurate To reduce misjudgments, the second business data of the target device can be acquired, where the acquired second business data of the target device may include: business data of the target device in other aspects, and violations of rules in other areas of the device, etc. , It is not limited here.

Step S505: Obtain a second training data set. The second training data set includes the first service data of the multiple devices, the function values corresponding to the first service data of the multiple devices, and the first service data of the target device. Two service data and the function value corresponding to the second service data of the target device.

In this embodiment, a second training data set can be obtained. The second training data set includes first service data of multiple devices, function values corresponding to the first service data of multiple devices, and second service data of the target device. And the function value corresponding to the second service data of the target device. In some embodiments, the second training data set may be collected in a historical time period.

Step S506: Based on the second training data set, the first service data of the multiple devices and the second service data of the target device are used as input data, and the first service data of the multiple devices are corresponding to the The function value and the function value corresponding to the second service data of the target device are used as output data, and the second prediction model is obtained as the trained prediction model by training with a machine learning algorithm.

Among them, in the process of training based on the second training data set, the second service data of the target device can be repeatedly obtained to continuously reduce the number of the first service data that characterizes the target device as uncertain data in the detection result. When the number is lower than the specified threshold or the number of repetitions reaches the specified number of times, training can be stopped, and the second model can be used as a trained prediction model for online prediction.

Step S507: Acquire current service data of the device when the device performs current service access.

Step S508: Input the current service data into the trained prediction model, and obtain the current function value output by the trained prediction model.

Step S509: Obtain a current detection result of the current service data based on the current function value and a preset credibility threshold, where the current detection result is used to characterize whether the current service data is malicious data.

Step S510: Determine a processing mode for the current service access of the device based on the current detection result.

For the specific description of step S507 to step S510, please refer to step S101 to step S104, which will not be repeated here.

In the business risk control processing method provided in yet another embodiment of the present application, the first prediction model is obtained by training through the first training data set and the machine learning algorithm, and when the detection result based on the first prediction model includes uncertain data, The second training data set is used to train and optimize the model to improve the accuracy of the output data obtained by the trained prediction model based on the input data.

Therefore, the embodiments of the present application can achieve the following effects: (1) Perform high-dimensional crossover and extraction of features. The features are uninterpretable, and it is more difficult for black-produced users to find the business rules of features and break them. ②The rules of the scheme participate in label credibility setting and data enhancement, and do not directly judge black products based on the rules. The characteristics of the offline and online risk control processes are the same, so it has better data consistency. ③Using DeepFM as the base model makes the system have the characteristics of Memorization and Generalization, which can not only remember historical black production information but also cross out the characteristics of potential black production information. ④ In the process of inputting the model, the credibility of the label is set according to the rules, and the sigmoid function of the model is combined as the output, which can prevent the label noise from deviating from the entire model and improve the credibility of the model. ⑤Using detectors to monitor changes in the state of uncertain data in the system, and judging the possibility of black production users changing their attack methods, can provide a basis for model retraining. ⑥ Tracking the uncertain data part can further modify the model and at the same time improve the interpretability of the model.

Please refer to FIG. 11, which shows a block diagram of a business risk control processing apparatus 200 provided by an embodiment of the present application. The following will elaborate on the block diagram shown in FIG. 11, the business risk control processing device 200 includes: a current business data acquisition module 210, a current function value acquisition module 220, a current detection result acquisition module 230, and a processing method determination module 240, wherein :

The current business data acquisition module 210 is configured to acquire current business data of the device when the device performs current business access.

The current function value obtaining module 220 is configured to input the current service data into the trained prediction model, and obtain the current function value output by the trained prediction model.

The current detection result obtaining module 230 is configured to obtain the current detection result of the current service data based on the current function value and the preset credibility threshold, wherein the current detection result is used to characterize whether the current service data is Is malicious data.

The processing mode determining module 240 is configured to determine the processing mode for the current service access of the device based on the current detection result.

Further, the processing method determining module 240 includes: a current service access denial submodule and a current service access execution submodule, wherein:

The current service access rejection submodule is configured to reject the current service access of the device when the current detection result indicates that the current service data is malicious data.

The current service access execution submodule is configured to execute the current service access of the device when the current detection result characterizes that the current service data is non-malicious data.

Further, the current detection result is also used to characterize that the current business data is uncertain data, and the business risk control processing device 200 further includes: other business data acquisition modules, other function value acquisition modules, and other detection result acquisition modules And other processing methods to determine the module, including:

The other business data acquisition module is used to acquire other business data when the device is accessing other business when the current detection result characterizes that the current business data is uncertain data.

Further, the other business data acquisition module includes: a business type acquisition sub-module and other business data acquisition sub-modules, wherein:

The service type obtaining submodule is configured to obtain the service type of the current service data when the current detection result indicates that the current service data is uncertain data.

The other business data acquisition submodule is used to acquire other business data when the device is accessing other business when the business type of the current business data meets the preset business type.

Further, the other business data acquisition sub-module includes: another business data acquisition unit, wherein:

The other service data obtaining unit is used to obtain other service data when the device is accessing other services when the service type of the current service data meets the transaction type.

The other function value obtaining module is configured to input the current service data and the other service data into the trained prediction model to obtain other function values output by the trained prediction model.

Further, the other function value obtaining module includes: an intelligence score obtaining submodule, multiple other business data obtaining submodules, and other function value obtaining submodules, wherein:

The intelligence score obtaining sub-module is used to obtain the intelligence score corresponding to other business data when the device is accessing other services, where the intelligence score is used to characterize the probability that the other business data is not non-malicious data.

Multiple other business data acquisition sub-modules are used to perform data enhancement processing on the other business data based on the intelligence score to obtain multiple other business data.

Further, the multiple other business data acquiring submodules include: a duration acquiring unit and multiple other business data acquiring units, wherein:

The duration acquisition unit is used to acquire the duration of the intelligence score corresponding to the other business data of the device during other business visits.

Multiple other business data acquisition units are configured to perform data enhancement processing on the other business data based on the intelligence score and the duration time to obtain multiple other business data.

The other function value obtaining submodule is configured to input the current service data and the multiple other service data into the trained prediction model to obtain other function values output by the trained prediction model.

The other detection result obtaining module is configured to obtain the current service data and other detection results of the other service data based on the other function value and the preset credibility threshold, wherein the other detection results are used for Characterize whether the current business data is malicious data.

The other processing method determining module is configured to determine the processing method for the current service access of the device based on the other detection results.

Further, the business risk control processing device 200 further includes: a function value acquisition module, a detection result acquisition module, a ratio acquisition module, and a retraining module, wherein:

The function value acquisition module is used to acquire multiple first function values output by the trained prediction model in the first time period and multiple second function values output in the second time period, wherein the The first time period and the second time period are adjacent time periods.

The detection result obtaining module is configured to obtain a plurality of first detection results based on the plurality of first function values and a preset credibility threshold, and obtain a plurality of detection results based on the plurality of second function values and a preset credibility threshold. The second test result.

Proportion acquisition module, configured to acquire the proportion of the plurality of first detection results that characterize the business data as uncertain data as the first proportion, and obtain the proportion of the plurality of second detection results that characterize the business data as uncertain data As the second ratio.

The retraining module is used for retraining the trained prediction model when the difference between the first ratio and the second ratio is greater than a specified difference.

Further, the business risk control processing device 200 further includes: a first training data set acquisition module and a first prediction model acquisition module, wherein:

The first training data set acquisition module is configured to acquire a first training data set, where the first training data set includes first service data of multiple devices and function values corresponding to the first service data of the multiple devices.

Further, the first training data set acquisition module includes: a first business data acquisition sub-module, a first business data label acquisition sub-module, and a first training data set acquisition sub-module, wherein:

The first service data obtaining submodule is used to obtain the first service data of the multiple devices.

The first service data label obtaining sub-module is configured to respectively add labels to the first service data of the multiple devices based on preset rules to obtain the first service data labels of the multiple devices.

Further, the first service data label obtaining submodule includes: a prediction rule detection unit and a first service data label obtaining unit, wherein:

The prediction rule detection unit is configured to respectively detect whether the first service data of the multiple devices meet the preset rule.

The first service data label obtaining unit is configured to add a first label to the first service data of a device that is detected to meet the preset rule, and to add a first label to the first service data of a device that does not meet the preset rule. The second label is to obtain the first service data label of multiple devices.

Further, the first service data label obtaining submodule includes: a first proportion obtaining unit, a second proportion obtaining unit, and a credibility threshold obtaining unit, wherein:

The first proportion obtaining unit is configured to obtain the proportion of the first business data satisfying the preset rule among the first business data of the multiple devices as the first proportion.

The second proportion acquiring unit is configured to acquire the proportion of the first service data that does not satisfy the preset rule among the first business data of the multiple devices as the second proportion.

The credibility threshold obtaining unit is configured to obtain a credibility threshold based on the first proportion and the second proportion as a preset credibility threshold.

The first training data set acquisition sub-module is configured to acquire a first training data set, the training data set including first service data labels of multiple devices, and function values corresponding to the first service data labels of multiple devices.

The first prediction model obtaining module is configured to use the first service data of the multiple devices as input data, and use the function values corresponding to the first service data of the multiple devices as output based on the first training data set Data is trained through a machine learning algorithm to obtain the first prediction model as the trained prediction model.

Further, the first prediction module obtaining module includes: a first prediction model obtaining sub-module, wherein:

The first prediction model obtaining sub-module is configured to perform Onehot processing on the first service data of the multiple devices as input data based on the first training data set, and use the first service data of the multiple devices The corresponding function value is used as the output data, and the first prediction model is obtained as the trained prediction model through training of the machine learning algorithm.

Further, the first prediction model obtaining sub-module includes: a first prediction model obtaining unit, wherein:

The first prediction model obtaining unit is configured to, based on the first training data set, perform Onehot processing on the first service data of the multiple devices as input data, and correspond to the first service data of the multiple devices The function value is used as the output data, and the first prediction model is obtained as the trained prediction model by training through the DeepFM algorithm.

Further, the business risk control processing device 200 further includes: a first detection result acquisition module, a second business data acquisition module, a second training data set acquisition module, and a second prediction model acquisition module, wherein:

The first detection result obtaining module is configured to obtain the detection result of the first service data of the multiple devices based on the function value corresponding to the first service data of the multiple devices and the preset credibility threshold.

The second business data acquisition module is configured to acquire when the detection result of the first business data of the multiple devices characterizes that the first business data of the target device in the first business data of the multiple devices is uncertain data The second service data of the target device.

The second training data set acquisition module is configured to acquire a second training data set, the second training data set includes the first service data of the multiple devices, and the function values corresponding to the first service data of the multiple devices , The second service data of the target device and the function value corresponding to the second service data of the target device.

The second prediction model obtaining module is configured to use the first service data of the multiple devices and the second service data of the target device as input data based on the second training data set, and the The function value corresponding to the first service data and the function value corresponding to the second service data of the target device are used as output data, and the second prediction model is obtained as the trained prediction model by training with a machine learning algorithm.

Those skilled in the art can clearly understand that, for the convenience and conciseness of the description, the specific working process of the device and module described above can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, the coupling between the modules may be electrical, mechanical or other forms of coupling.

In addition, the functional modules in the various embodiments of the present application may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or software functional modules.

Please refer to FIG. 12, which shows a structural block diagram of an electronic device 100 provided by an embodiment of the present application. The electronic device 100 may be an electronic device capable of running application programs, such as a smart phone, a tablet computer, or an e-book. The electronic device 100 in this application may include one or more of the following components: a processor 110, a memory 120, and one or more application programs, where one or more application programs may be stored in the memory 120 and configured to be composed of one Or multiple processors 110 execute, and one or more programs are configured to execute the method described in the foregoing method embodiment.

The processor 110 may include one or more processing cores. The processor 110 uses various interfaces and lines to connect various parts of the entire electronic device 100, and executes by running or executing instructions, programs, code sets, or instruction sets stored in the memory 120, and calling data stored in the memory 120. Various functions and processing data of the electronic device 100. Optionally, the processor 110 may adopt at least one of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). A kind of hardware form to realize. The processor 110 may be integrated with one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a modem, and the like. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is used for rendering and drawing the content to be displayed; the modem is used for processing wireless communication. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented by a communication chip alone.

The memory 120 may include random access memory (RAM) or read-only memory (Read-Only Memory). The memory 120 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 may include a program storage area and a data storage area, where the program storage area may store instructions for implementing the operating system and instructions for implementing at least one function (such as touch function, sound playback function, image playback function, etc.) , Instructions used to implement the following various method embodiments, etc. The storage data area can also store data (such as phone book, audio and video data, chat record data) created by the electronic device 100 during use.

Please refer to FIG. 13, which shows a structural block diagram of a computer-readable storage medium provided by an embodiment of the present application. The computer-readable medium 300 stores program code, and the program code can be invoked by a processor to execute the method described in the foregoing method embodiment.

The computer-readable storage medium 300 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM. Optionally, the computer-readable storage medium 300 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 300 has storage space for the program code 310 for executing any method steps in the above-mentioned methods. These program codes can be read from or written into one or more computer program products. The program code 310 may be compressed in a suitable form, for example.

In summary, the business risk control processing method, device, electronic device, and storage medium provided in the embodiments of the application obtain current business data of the device when the device performs current business access, and input the current business data into the trained prediction model , Obtain the current function value output by the trained prediction model, and obtain the current detection result of the current business data based on the current function value and the preset credibility threshold, where the current detection result is used to characterize whether the current business data is malicious data, Determine the current service access processing method for the device based on the current detection result, so as to determine whether the service data is malicious data through the function value output by the trained prediction model and the preset credibility threshold, and improve the credibility of malicious data judgment .

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions recorded in the foregoing embodiments are modified, or some of the technical features are equivalently replaced; these modifications or replacements do not drive the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

A business risk control processing method, characterized in that the method includes:

When the device is performing current business access, acquiring the current business data of the device;

Input the current business data into the trained prediction model, and obtain the current function value output by the trained prediction model;

Obtaining a current detection result of the current service data based on the current function value and a preset credibility threshold, where the current detection result is used to characterize whether the current service data is malicious data;

Based on the current detection result, a processing mode for the current service access to the device is determined.
The method according to claim 1, wherein the determining a processing mode for the current service access to the device based on the current detection result comprises:

When the current detection result characterizes that the current service data is malicious data, deny the current service access of the device;

When the current detection result characterizes that the current service data is non-malicious data, execute the current service access of the device.
The method according to claim 1 or 2, wherein the current detection result is further used to characterize that the current service data is uncertain data, and the current function value and a preset credibility threshold are based on After obtaining the current detection result of the current business data, it further includes:

When the current detection result characterizes that the current service data is uncertain data, acquiring other service data when the device is accessing other services;

Inputting the current business data and the other business data into the trained prediction model to obtain other function values output by the trained prediction model;

Based on the other function value and the preset credibility threshold, obtain the current service data and other detection results of the other service data, where the other detection results are used to characterize whether the current service data is Malicious data;

Determine the processing mode for the current service access of the device based on the other detection results.
The method according to claim 3, wherein, when the current detection result characterizes that the current service data is uncertain data, acquiring other service data of the device when accessing other services comprises:

When the current detection result characterizes that the current service data is uncertain data, acquiring the service type of the current service data;

When the service type of the current service data meets the preset service type, obtain other service data when the device is accessing other services.
The method according to claim 4, characterized in that, when the service type of the current service data meets the preset service type, acquiring other service data when the device is accessing other services comprises:

When the service type of the current service data satisfies the transaction type, obtain other service data when the device is accessing other services.
The method according to any one of claims 3-5, wherein said inputting said current business data and said other business data into said trained prediction model to obtain the output of said trained prediction model Other function values of, including:

Acquiring an intelligence score corresponding to other business data when the device is performing other business access, where the intelligence score is used to characterize the probability that the other business data is not non-malicious data;

Performing data enhancement processing on the other business data based on the intelligence score to obtain multiple other business data;

The current service data and the multiple other service data are input into the trained prediction model to obtain other function values output by the trained prediction model.
The method according to claim 6, wherein the performing data enhancement processing on the other business data based on the intelligence score to obtain multiple other business data comprises:

Acquiring the duration of other business data corresponding to the intelligence score when the device is performing other business access;

Perform data enhancement processing on the other business data based on the intelligence score and the duration to obtain multiple other business data.
The method according to claim 6 or 7, wherein the intelligence score is positively correlated with the multiple of the data enhancement.
The method according to any one of claims 3-8, wherein the method further comprises:

Obtain multiple first function values output by the trained prediction model in the first time period and multiple second function values output in the second time period, wherein the first time period and the The second time period is an adjacent time period;

Obtaining a plurality of first detection results based on the plurality of first function values and a preset credibility threshold, and obtaining a plurality of second detection results based on the plurality of second function values and the preset credibility threshold;

Acquiring a proportion of the plurality of first detection results that characterize business data as uncertain data as a first proportion, and acquiring a proportion of the plurality of second detection results that characterize business data as uncertain data as a second proportion;

When the difference between the first ratio and the second ratio is greater than a specified difference, the trained prediction model is retrained.
The method according to any one of claims 1-9, characterized in that, before acquiring the current service data of the device when the device is performing current service access, the method further comprises:

Acquiring a first training data set, where the first training data set includes first service data of multiple devices and function values corresponding to the first service data of the multiple devices;

Based on the first training data set, the first service data of the multiple devices are used as input data, and the function values corresponding to the first service data of the multiple devices are used as output data, which are obtained by training through a machine learning algorithm The first prediction model serves as the trained prediction model.
The method according to claim 10, characterized in that, based on the first training data set, the first service data of the multiple devices are used as input data, and the first service data of the multiple devices are used as input data. The corresponding function value is used as the output data, and after the first prediction model is obtained as the trained prediction model through training of the machine learning algorithm, it also includes:

Obtaining the detection result of the first service data of the multiple devices based on the function values corresponding to the first service data of the multiple devices and the preset credibility threshold;

When the detection result of the first service data of the multiple devices characterizes that the first service data of the target device in the first service data of the multiple devices is uncertain data, the second service data of the target device is acquired ；

Acquire a second training data set, where the second training data set includes first service data of the multiple devices, function values corresponding to the first service data of the multiple devices, and second service data of the target device And the function value corresponding to the second service data of the target device;

Based on the second training data set, the first service data of the multiple devices and the second service data of the target device are used as input data, and the function values corresponding to the first service data of the multiple devices are summed The function value corresponding to the second service data of the target device is used as output data, and the second prediction model is obtained as the trained prediction model by training with a machine learning algorithm.
The method according to claim 10 or 11, wherein the first training data set is obtained, and the first training data set includes first service data of multiple devices, and first service data of the multiple devices. The function value corresponding to the business data, including:

Acquiring first service data of the multiple devices;

Respectively adding tags to the first service data of the multiple devices based on preset rules to obtain the first service data tags of the multiple devices;

Acquire a first training data set, where the training data set includes first service data labels of multiple devices and function values corresponding to the first service data labels of multiple devices.
The method according to claim 12, wherein the respectively adding tags to the first service data of the multiple devices based on a preset rule to obtain the first service data tags of the multiple devices comprises:

Separately detecting whether the first service data of the multiple devices meets the preset rule;

Add a first tag to the first service data of a device that is detected to meet the preset rule, add a second tag to the first service data of a device that is detected to not meet the preset rule, and obtain the first data of multiple devices. Business data label.
The method according to claim 13, wherein after the detecting whether the first service data of the multiple devices meets the preset rule, the method further comprises:

Acquiring a proportion of the first business data satisfying the preset rule among the first business data of the multiple devices as the first proportion;

Acquiring a proportion of the first business data that does not meet the preset rule in the first business data of the multiple devices as a second proportion;

A credibility threshold is obtained based on the first proportion and the second proportion as a preset credibility threshold.
The method according to claim 13 or 14, wherein the first label represents that the service data is malicious data, and the second label represents that the service data is non-malicious data.
The method according to any one of claims 10-14, wherein, based on the first training data set, the first service data of the multiple devices are used as input data, and the multiple devices are The function value corresponding to the first business data is used as the output data, and the first prediction model is obtained as the trained prediction model through training of the machine learning algorithm, including:

Based on the first training data set, the first business data of the multiple devices are processed by Onehot as input data, and the function values corresponding to the first business data of the multiple devices are used as output data. The learning algorithm is trained to obtain the first prediction model as the trained prediction model.
The method according to claim 16, characterized in that, based on the first training data set, the first service data of the multiple devices are processed by Onehot as input data, and the data of the multiple devices The function value corresponding to the first business data is used as the output data, and the first prediction model is obtained as the trained prediction model through training of the machine learning algorithm, including:

Based on the first training data set, the first service data of the multiple devices are processed by Onehot as input data, and the function values corresponding to the first service data of the multiple devices are used as output data, using the DeepFM algorithm Perform training to obtain the first prediction model as the trained prediction model.
A business risk control processing device, characterized in that the device includes:

The current business data acquisition module is used to acquire the current business data of the device when the device performs current business access;

The current function value obtaining module, configured to input the current business data into the trained prediction model, and obtain the current function value output by the trained prediction model;

The current detection result obtaining module is configured to obtain the current detection result of the current service data based on the current function value and a preset credibility threshold, wherein the current detection result is used to characterize whether the current service data is Malicious data;

The processing mode determination module is configured to determine the processing mode for the current service access of the device based on the current detection result.
An electronic device, comprising a memory and a processor, the memory is coupled to the processor, the memory stores instructions, and the processor executes the instructions when the instructions are executed by the processor. The method of any one of 1-17 is required.
A computer-readable storage medium, wherein the computer-readable storage medium stores program code, and the program code can be called by a processor to execute the method according to any one of claims 1-17 .