Summary of the invention
The embodiment of the present invention provides a kind of Risk Identification Method and system, in the scene for providing a kind of line combination
Risk analysis scheme.
In order to achieve the above objectives, the embodiment of the present invention adopts the following technical scheme that
In a first aspect, the method that the embodiment of the present invention provides, comprising:
When receiving risk identification request message, determine that user to be detected is whole according to the risk identification request message
End, and obtains the behavioral data of corresponding user terminal, wherein receive time of the risk identification request message it is described to
The user terminal triggering operation system of detection starts before executing operation flow, and the behavioral data acquisition of the corresponding user terminal is certainly
The specified services link of the operation system;
According to the behavioral data to algorithmic system request algorithm model, and according to acquired algorithm model, from
The request of feature of risk library is transferred and the matched feature of risk data of the algorithm model, wherein the feature of risk data are gathered
At least one of class is simultaneously stored in the feature of risk library, and the feature tag of the cluster of each feature of risk data is corresponding
Algorithm model;
According to the algorithm model and with the matched feature of risk data of the algorithm model, to the corresponding user terminal
Behavioral data carry out risk analysis;
The result of risk analysis is sent to the operation system.
With reference to first aspect, in the first possible implementation of the first aspect, further includes:
The risk identification request message that the user terminal to be detected is sent is received, the risk identification request disappears
Breath is sent from the user terminal to be detected when sending service trigger request to the operation system.
With reference to first aspect, in the second possible implementation of the first aspect, further includes:
The risk identification request message that the operation system is sent is received, the risk identification request message is by institute
State what operation system was sent when receiving service trigger request, the service trigger request is by the user terminal to be detected
It is sent to the operation system.
First with reference to first aspect or two kind of possible implementation, it is in the third possible implementation, described
According to the behavioral data to algorithmic system request algorithm model, comprising:
Determine that business scenario identifies according to the behavioral data;
Business scenario mark is obtained, the business scenario mark includes the mark and the operation system of the operation system
Specified services link mark at least one of;
The algorithm model identified to the corresponding business scenario of algorithmic system inquiry.
With reference to first aspect, in a fourth possible implementation of the first aspect, described according to the behavioral data
Include: to algorithmic system request algorithm model
Model identification is determined according to the behavioral data;
Inquiry request is sent to the algorithmic system according to the model identification, the inquiry request is used for the algorithm system
System inquiry meets the algorithm model of the model identification.
The 4th kind of possible implementation with reference to first aspect, in a fifth possible implementation, the basis
The behavioral data determines model identification, comprising:
Detection obtains the user terminal and generates the operation system accessed when the behavioral data, and identifies that the user is whole
When end generates the behavioral data, the service link of the operation system execution;
Obtain the service link mark of the corresponding system banner of operation system of the access and the service link of the execution
Know, and as the model identification.
First or two kind of possible implementation with reference to first aspect is also wrapped in a sixth possible implementation
Include: when cashier system receives the order information of the corresponding user terminal to be detected, using the order information as
The service trigger request;The cashier system sends service crosswind danger before calling online payment tool, to detecting platform
Identify request message;Alternatively, after the user terminal to be detected sends the order information to the cashier system, to detecing
It surveys platform and sends user side risk identification request message.
Second aspect, the system that the embodiment of the present invention provides, comprising: detecting platform receives risk identification for working as
When request message, user terminal to be detected is determined according to the risk identification request message, obtains the row of corresponding user terminal
For data, and according to the behavioral data to algorithmic system request algorithm model, wherein receive the risk identification and ask
Ask the time of message before the user terminal triggering operation system to be detected starts to execute operation flow, the corresponding user
Specified services link of the behavioral data acquisition of terminal from the operation system;
The algorithmic system provides algorithm model for storing algorithm model, and according to the request of the detecting platform;
The detecting platform, is also used to according to acquired algorithm model, and from feature of risk library, request is transferred and the calculation
The feature of risk data of method Model Matching, wherein the feature of risk data are clustered and are stored in the feature of risk library,
At least one corresponding algorithm model of the feature tag of the cluster of each feature of risk data;
The feature of risk library, for clustering and storing the feature of risk data, and according to the algorithm model and with
The matched feature of risk data of algorithm model carry out risk analysis to the behavioral data of the corresponding user terminal;Again to
The operation system sends the result of risk analysis, wherein the feature tag pair of the cluster of each feature of risk data
Answer at least one algorithm model.
In conjunction with second aspect, in the first possible implementation of the second aspect, the user terminal to be detected,
For sending the risk identification request message when sending service trigger request to the operation system;The detecting platform,
It is also used to receive the risk identification request message that the user terminal to be detected is sent;
Alternatively, the operation system, for when receiving the user terminal to be detected and sending service trigger request,
The risk identification request message is sent to the detecting platform;The detecting platform is also used to receive the operation system hair
The risk identification request message sent.
In conjunction with second aspect, in a second possible implementation of the second aspect, the feature of risk library is specific to use
The operation system accessed when the user terminal generates the behavioral data is obtained in detection, and identifies that the user terminal generates
When the behavioral data, the service link of the operation system execution;And the corresponding system of operation system for obtaining the access
The service link of mark and the service link of execution mark, and as the model identification;
Inquiry request is sent to the algorithmic system further according to the model identification, the inquiry request is used for the algorithm
System queries meet the algorithm model of the model identification;
The algorithmic system is also used to the feature of risk library transmission algorithm update notification, the algorithm update notification
Include with updated algorithm model matched feature of risk data type;
The feature of risk library is also used to send request of data to big data platform, and the request of data is directed toward business system
System is alternatively, be directed toward the service link of operation system;
The feature of risk library is also used to generate request of data, and to described in big data platform transmission according to feature tag
Request of data, then feature of risk data are updated according to the daily record data that the big data platform is sent by the feature of risk library,
And updated feature of risk data are updated into feature tag;
The big data platform, for according to the request of data extract the request of data pointed by operation system or
The daily record data of person's service link, and data cleansing carried out to acquired daily record data according to data cleansing rule, and will be through
The daily record data of over cleaning is sent to the feature of risk library;
The algorithmic system, is also used to extract the intermediate parameters collection of corresponding each algorithm model, and by the intermediate parameters collection
It is sent to the big data platform, wherein the intermediate parameters collection of an algorithm model includes the algorithmic system operation and/instruction
Practice the associated intermediate parameters arrived when this algorithm model;
The big data platform is also used to update the data cleansing rule using the intermediate parameters collection.
Risk Identification Method provided in an embodiment of the present invention and system, it is real by deployment feature of risk library and algorithmic system
Real-time calling deployment, can dispose beta version trial operation and change in real time, to finally realize on the line of existing algorithm model
Real-time modeling set is disposed on line, the risk analysis scheme in a kind of scene of line combination is provided, to extenuate risk identification mould
The deployment of type is difficult to the problem of keeping up with increasing network behavior, can reduce operator backstage carry out risk analysis at
This.
Specific embodiment
Technical solution in order to enable those skilled in the art to better understand the present invention, with reference to the accompanying drawing and specific embodiment party
Present invention is further described in detail for formula.Embodiments of the present invention are described in more detail below, the embodiment is shown
Example is shown in the accompanying drawings, and in which the same or similar labels are throughly indicated same or similar element or has identical or class
Like the element of function.It is exemplary below with reference to the embodiment of attached drawing description, for explaining only the invention, and cannot
It is construed to limitation of the present invention.Those skilled in the art of the present technique are appreciated that unless expressly stated, odd number shape used herein
Formula " one ", "one", " described " and "the" may also comprise plural form.It is to be further understood that specification of the invention
Used in wording " comprising " refer to that there are the feature, integer, step, operation, element and/or component, but it is not excluded that
In the presence of or add other one or more features, integer, step, operation, element, component and/or their group.It should be understood that
When we say that an element is " connected " or " coupled " to another element, it can be directly connected or coupled to other elements, or
There may also be intermediary elements.In addition, " connection " used herein or " coupling " may include being wirelessly connected or coupling.Here make
Wording "and/or" includes one or more associated any cells for listing item and all combinations.The art
Technical staff is appreciated that unless otherwise defined all terms (including technical terms and scientific terms) used herein have
Meaning identical with the general understanding of the those of ordinary skill in fields of the present invention.It should also be understood that such as general
Those terms, which should be understood that, defined in dictionary has a meaning that is consistent with the meaning in the context of the prior art, and
Unless defined as here, it will not be explained in an idealized or overly formal meaning.
Method flow in the present embodiment can specifically execute in a kind of system as shown in Figure 1a, which includes:
Detect platform, algorithmic system, feature of risk library, big data platform and user terminal.Wherein:
Detecting platform can integrate in the application server, or with multiple application servers (in practical applications, if one
A application server is used for the operation of a certain operation system, which needs in the process of running using arriving and user's phase
Data of pass, such as account information, order information, logistics information, inventory information etc. can also then be substituted with " operation system "
" application server ", the i.e. application server are to carry the operation system to run the hardware device for being) it is connected, and detecting real-time passes through
The behavioral data sent by the user terminal that application server obtains, application server are mainly used for: (wherein, to user terminal
Often operation has the program or APP that visualized operation is carried out for trade company on the subscriber terminal, this kind of for being visualized
Perhaps APP is properly termed as the use in user terminal program the present embodiment for having run this class method or APP to the program of operation
Family terminal is referred to as user terminal) visual interface is provided, such as: trade company (is into the quotient for residing in e-commerce platform
Family) by operation user terminal, access in E-commerce platform system some operation systems (such as: freight charges, timeliness, object
Flow order, inventory system, declaration system etc.), and browser interface provided by the detecting platform for passing through the operation system carries out quotient
Product inquiry, file download, the operation such as importing/export report.
Algorithmic system, is specifically used for storage and more New Algorithm Model, these algorithm models can be the technology by operator
Personnel input algorithmic system, are also possible to through network share tool, by third party technology, personnel are uploaded to algorithmic system.
Feature of risk library is specifically used for storage feature of risk data, wherein the feature of risk data are clustered and store
In the feature of risk library, at least one of the feature tag of the cluster of each feature of risk data is corresponding algorithm mould
Type.
Big data platform is specifically used for the data to acquisition from types of applications server (or operation system), and is based on
Preset cleaning rule cleans data collected, then is clustered into feature of risk data.
Detecting platform, algorithmic system disclosed in the present embodiment, feature of risk library and big data platform, in hardware view
On specifically can be the equipment such as operation system, work station, supercomputer, or a kind of use being made of multiple hardware devices
In the operation system group system of data processing.
User terminal disclosed in the present embodiment can specifically be made into an independent device in fact, or be integrated in various differences
Media data playing device in, such as mobile phone, tablet computer (Tablet Personal Computer), electricity on knee
Brain (Laptop Computer), personal digital assistant (personal digital assistant, abbreviation PDA) etc..
The embodiment of the present invention provides a kind of Risk Identification Method, as shown in Figure 2, comprising:
S1, when receiving risk identification request message, use to be detected is determined according to the risk identification request message
Family terminal, and obtain the behavioral data of corresponding user terminal.
Wherein, the time of the risk identification request message is received in the user terminal triggering to be detected business system
System starts before executing operation flow, and the behavioral data of the corresponding user terminal acquires the specified services ring from the operation system
Section.Such as: behavioral data can specifically include: each operating process (or be service link) of the user in a business operation
The data of upper generation, such as: include log in, register, placing an order, paying etc. indicate user behavior data, and including the time,
The data of the expression User Status such as account, ID, bank's card number etc., IP address, device number.
Can specifically include in algorithm model: at least one algorithm model (is referred to as algorithm, model or algorithm
And model), algorithm model described in the present embodiment can according to function classification, such as:
Data mining model: such as decision tree, neural network etc..Each model is with independent component individualism.Data point
Analyse engineer use decision Tree algorithms or neural network algorithm, modeling generate can judge transaction whether risky algorithm.
In decision tree, comprising N tree, the leaf node of tree sets final result as this, and algorithm is according to each tree as a result, carrying out
It calculates, to obtain algorithm final result.
S2, according to the behavioral data to algorithmic system request algorithm model, and according to acquired algorithm model,
From feature of risk library, request is transferred and the matched feature of risk data of the algorithm model.
Wherein, the feature of risk data are clustered and are stored in the feature of risk library, each described risk is special
Levy at least one corresponding algorithm model of feature tag of the cluster of data.Such as: feature of risk data refer to various types of
The general designation of data pointed by risk labeling includes basic data, behavioral data, environmental data, statistical data, black name
It is single, white list, credible equipment, machine fingerprint, ox etc..Such as: transaction total amount of the user at nearest one day, transaction count
Deng.
Feature of risk data are clustered and are stored in the feature of risk library, each feature of risk data is gathered
At least one corresponding algorithm model of the feature tag of class.And it can constantly update, increase, checking under the feature tag of same cluster
Dangerous characteristic, so that feature of risk data keep dynamic to update, and synchronous with the update of algorithm model holding.
S3, according to the algorithm model and with the matched feature of risk data of the algorithm model, to the corresponding user
The behavioral data of terminal carries out risk analysis.
In the present embodiment, the concrete mode of risk analysis may include:
It in payment transaction, all kinds of service links such as places an order, purchase in advance, in thing, execute corresponding risk rule afterwards
It is analyzed, the specific engine tool for executing analysis architecturally includes feature tag, feature tag library, algorithm model, algorithm
Model version management, publication, deployment, trial operation, measurement, business check and accept and go into operation;And include risk rule, risk rule version
This management, publication, deployment, trial operation, measurement, business check and accept and go into operation;
Channel of the algorithmic system as detecting platform, detecting platform call algorithmic system to execute called system, detecting
Platform provides corresponding algorithm title to algorithmic system.Wherein, obtained arithmetic result is only one of the factor determined, may be used also
To include the parameter of other dimensions, for example possible dimension includes: arithmetic result, detecting rule, blacklist.
S4, the result that risk analysis is sent to the operation system.
Such as: to the user terminal execute feedback strategy include: limit user account access right, freeze account,
The operation system accessed to user terminal sends alarm information etc., sends a warning message to user terminal.
During anti-fraud, by constantly collecting behavioral data and storing data to big data platform, put down in big data
Feature of risk library is continued to optimize by off-line algorithm logic processing feature of risk library on platform and with the behavioral data of user habit
And risk rule and intelligent algorithm component, then it is outside by way of rule+algorithm combination real-time air control system
More good air control ability is provided.Such as: mobile phone is logged in the non-normal use time of the users such as morning, can then be called at this time
Algorithm detection risk;And algorithm detection risk is called in the case where consumption great number commodity suddenly.Since algorithm model needs
The feature of risk data volume used is big, for example a truthful data (is obtained, and this data can by first analysis up and down more than 100
Gradually to extend, so that providing one kind for certain primary transaction or other business conducts more accurately tests and analyzes model).This
In embodiment, by deployment feature of risk library, real-time calling deployment (existing needs) on the line of algorithm model is realized, it can portion
Administration's beta version trial operation simultaneously changes in real time, disposes to finally realize Real-time modeling set on line.And algorithm model operation
Effect data (such as intermediate parameters, result statistical data etc.) realizes reflux big data platform, so that feedback optimized big data is flat
The data cleansing rule of platform.
General service system needs to remodify system code logic after understanding business demand, by withdrawing business publication
Mode, update service logic again, the period is long, updates slow;And artificial intelligence system, after business change demand, Ke Yitong
Cross the mode for not restarting application, the new service logic of Dynamical Deployment can effectively shorten the development cycle, and can quickly more
Newly.
In the present embodiment, the risk identification request message is from the user terminal to be detected to the business system
It is sent when system transmission service trigger request, detecting platform receives the risk identification that the user terminal to be detected is sent
Request message.
Alternatively, the risk identification request message is the transmission when receiving service trigger request by the operation system
, the service trigger request is sent from the user terminal to be detected to the operation system, described in detecting platform reception
The risk identification request message that operation system is sent.
Specifically, it is described according to the behavioral data to algorithmic system request algorithm model, comprising:
Determine that business scenario identifies according to the behavioral data;And business scenario mark is obtained, then to the algorithmic system
The algorithm model of the corresponding business scenario mark of inquiry.
Wherein, the business scenario mark includes the mark of the operation system and the specified services ring of the operation system
At least one of in the mark of section.
For example, when cashier system receives the order information of the corresponding user terminal to be detected, by institute
Order information is stated as the service trigger request;The cashier system is before calling online payment tool, to detecting platform
Send service side risk identification request message;Alternatively, the user terminal to be detected is to described in cashier system transmission
After order information, user side risk identification request message is sent to detecting platform.Specifically, cashier is calling on-line payment work
Counsel requests are sent to detecting platform before tool, carry out anti-risk of fraud consulting, detecting platform calls the intelligent algorithm of bottom
System request acquisition algorithm model.
Detecting platform (also referred to as detecting system) places an order as platform of the payment transaction there are risk is judged in user
Link is paid with user, risk rule is executed and judges this order with the presence or absence of risk.Wherein, detecting platform obtains dependency number
According to, including order data;Wherein, the user behavior that event center (EPC) is collected from each operation system (logs in, registration, modification
Password, real-time geographical locations, time, the behavioral data of PC, the behavioral data of APP, purchase commodity, the payment request amount of money, consumption
Record etc.) after, the data of statistics;And process data is obtained from big data platform and real time data processing platform.
Algorithmic system detects the business conduct data and feature of risk data that platform provides, and the corresponding intelligent algorithm of operation is simultaneously
Return decision in the face of risk result is supplied to cashier and judges whether it is fraudulent trading.Feature of risk number is transferred according to algorithm model request
According to.
Feature of risk data in feature of risk library are classified at predetermined regular and stamp respective labels.
Big data platform obtains platform data from each dimension and is cleaned, trains to data, and the data cleaned are write
Enter risk feature database;Big data processed offline platform can collect more inside and outsides, multidimensional various data simultaneously, and be added
Work processing forms the distinctive feature of risk library for being directed to the means of payment.
Such as: user buys a household electrical appliances in shops, and submits to pay to the cashier of shops;
At user terminal (such as on smart phone of user), the password of personal account is inputted, smart phone is acknowledged a debt a
Number password be sent to the background system (undertaking the operation system of payment function) of cashier, and start call detecting platform;
Detecting platform obtains algorithm title, transmission algorithm title and pay invoice data according to request is received, according to business scenario, and
Call algorithmic system;Algorithmic system receives detecting platform call request, obtains algorithm title and pay invoice data, starts to adjust
Use algorithm;According to application risk feature is needed in algorithm, specific feature of risk is obtained from feature of risk library;Obtain feature of risk
Afterwards, algorithm is formally called;Algorithm implementing result is obtained, detecting platform is returned;Platform is detected according to arithmetic result, judges that transaction is
It is no that there are risks;Platform is detected by transaction risk judging result, and judging result is returned to the backstage of user equipment and cashier
System.
Risk Identification Method provided in an embodiment of the present invention realizes algorithm by deployment feature of risk library and algorithmic system
Real-time calling is disposed on the line of model, can be disposed beta version trial operation and be changed in real time, to finally realize real on line
Shi Jianmo deployment, provides the risk analysis scheme in a kind of scene of line combination, to extenuate the portion of risk identification model
Administration is difficult to the problem of keeping up with increasing network behavior, can reduce operator on backstage and carry out the cost of risk analysis.
In the present embodiment, it is described according to the behavioral data to algorithmic system request algorithm model include: basis
The behavioral data determines model identification, and sends inquiry request to the algorithmic system according to the model identification.
Specifically, described determine model identification according to the behavioral data, comprising:
Detection obtains the user terminal and generates the operation system accessed when the behavioral data, and identifies that the user is whole
When end generates the behavioral data, the service link of the operation system execution;
Obtain the service link mark of the corresponding system banner of operation system of the access and the service link of the execution
Know, and as the model identification.
Wherein, the inquiry request meets the algorithm model of the model identification for algorithmic system inquiry.
When underlying algorithm updates, generally require according to new risk by algorithm engineering Shi Chongxin modeling algorithm.If new
New feature of risk has been used in modeling, then also to update corresponding feature of risk data.The present embodiment also provides a kind of based on calculation
The mode of the update synchronized update feature of risk of method, specifically include: the algorithmic system is to feature of risk library transmission algorithm
Update notification, the algorithm update notification include with updated algorithm model matched feature of risk data type;
The feature of risk library sends request of data to the big data platform, the request of data be directed toward operation system or
Person is directed toward the service link of operation system.
Further, further includes:
The feature of risk library generates request of data according to feature tag, and sends the data to big data platform and ask
It asks;
The big data platform according to the request of data extract the request of data pointed by operation system or industry
The daily record data for link of being engaged in, and data cleansing is carried out to acquired daily record data according to data cleansing rule, and will be by clear
The daily record data washed is sent to the feature of risk library;
The feature of risk library updates feature of risk data according to the daily record data that the big data platform is sent, and will more
Feature of risk data after new update feature tag.
Feature of risk data be calculated as a result, calculate be based on original basic data etc., wind is calculated
The value of dangerous feature, cleaning rule obtain these basic datas for screening.In the present embodiment, it also provides and a kind of improves big data
The concrete mode of the cleaning rule of platform:
The algorithmic system extracts the intermediate parameters collection of corresponding each algorithm model, and by the intermediate parameters collection to described big
Data platform is sent, wherein the intermediate parameters collection of an algorithm model include algorithmic system operation and/training this
The associated intermediate parameters arrived when algorithm model;
The big data platform updates the data cleansing rule using the intermediate parameters collection.
In practical applications, it usually needs technical staff (such as algorithm engineering teacher) is according to the maintenance need of current business system
Want algorithm for design.And testing algorithm effect in corresponding system is deployed under line after designing good algorithm, having collected enough surveys
After trying data, then debugging algorithm again in disconnection mode.Again due to the differentiation of External Funtions means and technology, air control data
The limitation of not perfect and new business rapid development and existing anti-fake system, the offline design of algorithm model, debugging
It has been difficult to meet the development of new business in time.Experience is paid to affect certain customers, air control is finally brought and manually examines
Core cost and risk behavior in advance cannot effectively be intercepted.
At present in the same trade, air control system mainly all uses the scheme of artificial intelligence.The air control engine of artificial intelligence at present
It is only applied to the full-range risk management and control of risk of fraud, such as account, transaction, ox;Future can be using wind such as credit risks
Control related fields and scene, it is established that the risk management and control of whole process whole scene.
During anti-fraud, constantly collects behavioral data and store data to big data platform, in big data platform
By off-line algorithm logic process feature of risk library and with the behavioral data of user habit continue to optimize feature of risk library and
Risk rule and intelligent algorithm component, then be provided out by way of rule+algorithm combination real-time air control system
More good air control ability.Such as: mobile phone is logged in the non-normal use time of the users such as morning, can then call algorithm at this time
Detection risk;And algorithm detection risk is called in the case where consumption great number commodity suddenly.Since algorithm model needs are used
Feature of risk data volume it is big, for example (by the way that first analysis obtains up and down, and this data can be by for a truthful data more than 100
Step extension, to be directed to certain, once transaction or other business conducts provide a kind of more accurately detection and analysis model).This implementation
In example, by disposing feature of risk library, realizes real-time calling deployment (existing needs) on the line of algorithm model, survey can be disposed
This trial operation of test run simultaneously changes in real time, disposes to finally realize Real-time modeling set on line.And the effect of algorithm model operation
Data (such as intermediate parameters, result statistical data etc.) realize reflux big data platform, thus feedback optimized big data platform
Data cleansing rule.
General service system needs to remodify system code logic after understanding business demand, by withdrawing business publication
Mode, update service logic again, the period is long, updates slow;And artificial intelligence system, after business change demand, Ke Yitong
Cross the mode for not restarting application, the new service logic of Dynamical Deployment can effectively shorten the development cycle, and can quickly more
Newly.
The embodiment of the present invention also provides a kind of system as shown in Figure 1a, and respectively the interactive process between end can be in the system
With reference to Fig. 1 b, this includes:
Platform is detected, for being determined according to the risk identification request message when receiving risk identification request message
User terminal to be detected obtains the behavioral data of corresponding user terminal, and is requested according to the behavioral data to algorithmic system
Acquisition algorithm model, wherein the time for receiving the risk identification request message triggers in the user terminal to be detected
Operation system starts before executing operation flow, behavioral data acquisition the specifying from the operation system of the corresponding user terminal
Service link;
The algorithmic system provides algorithm model for storing algorithm model, and according to the request of the detecting platform;
The detecting platform, is also used to according to acquired algorithm model, and from feature of risk library, request is transferred and the calculation
The feature of risk data of method Model Matching, wherein the feature of risk data are clustered and are stored in the feature of risk library,
At least one corresponding algorithm model of the feature tag of the cluster of each feature of risk data;
The feature of risk library, for clustering and storing the feature of risk data, and according to the algorithm model and with
The matched feature of risk data of algorithm model carry out risk analysis to the behavioral data of the corresponding user terminal;Again to
The operation system sends the result of risk analysis, wherein the feature tag pair of the cluster of each feature of risk data
Answer at least one algorithm model.
The user terminal to be detected is used for when sending service trigger request to the operation system, described in transmission
Risk identification request message;The detecting platform is also used to receive the risk that the user terminal to be detected is sent and knows
Other request message;
Alternatively, the operation system, for when receiving the user terminal to be detected and sending service trigger request,
The risk identification request message is sent to the detecting platform;The detecting platform is also used to receive the operation system hair
The risk identification request message sent.
Specifically, the feature of risk library, when obtaining the user terminal generation behavioral data specifically for detection
The operation system of access, and when identifying that the user terminal generates the behavioral data, the business ring that the operation system executes
Section;And the service link of the corresponding system banner of operation system for obtaining the access and the service link of the execution identifies,
And as the model identification;
Inquiry request is sent to the algorithmic system further according to the model identification, the inquiry request is used for the algorithm
System queries meet the algorithm model of the model identification;
The algorithmic system is also used to the feature of risk library transmission algorithm update notification, the algorithm update notification
Include with updated algorithm model matched feature of risk data type;
The feature of risk library is also used to send request of data to big data platform, and the request of data is directed toward business system
System is alternatively, be directed toward the service link of operation system;
The feature of risk library is also used to generate request of data, and to described in big data platform transmission according to feature tag
Request of data, then feature of risk data are updated according to the daily record data that the big data platform is sent by the feature of risk library,
And updated feature of risk data are updated into feature tag;
The big data platform, for according to the request of data extract the request of data pointed by operation system or
The daily record data of person's service link, and data cleansing carried out to acquired daily record data according to data cleansing rule, and will be through
The daily record data of over cleaning is sent to the feature of risk library;
The algorithmic system, is also used to extract the intermediate parameters collection of corresponding each algorithm model, and by the intermediate parameters collection
It is sent to the big data platform, wherein the intermediate parameters collection of an algorithm model includes the algorithmic system operation and/instruction
Practice the associated intermediate parameters arrived when this algorithm model;
The big data platform is also used to update the data cleansing rule using the intermediate parameters collection.
In practical applications, it usually needs technical staff (such as algorithm engineering teacher) is according to the maintenance need of current business system
Want algorithm for design.And testing algorithm effect in corresponding system is deployed under line after designing good algorithm, having collected enough surveys
After trying data, then debugging algorithm again in disconnection mode.Again due to the differentiation of External Funtions means and technology, air control data
The limitation of not perfect and new business rapid development and existing anti-fake system, the offline design of algorithm model, debugging
It has been difficult to meet the development of new business in time.Experience is paid to affect certain customers, air control is finally brought and manually examines
Core cost and risk behavior in advance cannot effectively be intercepted.
At present in the same trade, air control system mainly all uses the scheme of artificial intelligence.The air control engine of artificial intelligence at present
It is only applied to the full-range risk management and control of risk of fraud, such as account, transaction, ox;Future can be using wind such as credit risks
Control related fields and scene, it is established that the risk management and control of whole process whole scene.
During anti-fraud, constantly collects behavioral data and store data to big data platform, in big data platform
By off-line algorithm logic process feature of risk library and with the behavioral data of user habit continue to optimize feature of risk library and
Risk rule and intelligent algorithm component, then be provided out by way of rule+algorithm combination real-time air control system
More good air control ability.Such as: mobile phone is logged in the non-normal use time of the users such as morning, can then call algorithm at this time
Detection risk;And algorithm detection risk is called in the case where consumption great number commodity suddenly.Since algorithm model needs are used
Feature of risk data volume it is big, for example (by the way that first analysis obtains up and down, and this data can be by for a truthful data more than 100
Step extension, to be directed to certain, once transaction or other business conducts provide a kind of more accurately detection and analysis model).This implementation
In example, by disposing feature of risk library, realizes real-time calling deployment (existing needs) on the line of algorithm model, survey can be disposed
This trial operation of test run simultaneously changes in real time, disposes to finally realize Real-time modeling set on line.And the effect of algorithm model operation
Data (such as intermediate parameters, result statistical data etc.) realize reflux big data platform, thus feedback optimized big data platform
Data cleansing rule.
General service system needs to remodify system code logic after understanding business demand, by withdrawing business publication
Mode, update service logic again, the period is long, updates slow;And artificial intelligence system, after business change demand, Ke Yitong
Cross the mode for not restarting application, the new service logic of Dynamical Deployment can effectively shorten the development cycle, and can quickly more
Newly.
All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodiment
Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for equipment reality
For applying example, since it is substantially similar to the method embodiment, so describing fairly simple, related place is referring to embodiment of the method
Part explanation.The above description is merely a specific embodiment, but protection scope of the present invention is not limited to
This, anyone skilled in the art in the technical scope disclosed by the present invention, the variation that can readily occur in or replaces
It changes, should be covered by the protection scope of the present invention.Therefore, protection scope of the present invention should be with the protection model of claim
Subject to enclosing.