Disclosure of Invention
The invention aims to provide a method, a device and a system for monitoring digital asset transaction abnormity, which are used for solving the problems of low coin-filling safety, malicious money laundering and the like in the digital asset transaction in the prior art.
In a first aspect, the present application provides a digital asset transaction anomaly monitoring method, applied to a server, the method including:
acquiring a coin charging request sent by a service end; the coin charging request comprises a coin charging address and a coin charging amount;
judging whether the coin charging request triggers a wind control rule or not;
if the wind control rule is triggered, processing the coin charging request;
judging whether the processed coin charging request is of a FAST (FAST open bank transaction) upper account type;
and if so, carrying out safe accounting according to the coin charging request.
Optionally, before the step of determining whether the coin charging request triggers the wind control rule, the method further includes:
judging whether the accumulated money-charging amount reaches the upper accounting amount or not; the accumulated money-charging amount is the sum of the money-charging amounts of at least one money-charging request sent by the same service end;
and if the accumulated money-charging amount does not reach the account-charging amount, the step of judging whether the money-charging request triggers the wind control rule is not executed.
Optionally, the determining whether the coin charging request triggers the wind control rule includes:
extracting a corresponding actual value in the coin charging request according to at least one wind control factor;
judging whether the actual value meets the reference value range or not;
and if the actual value extracted according to the wind control factor does not meet the reference value range, triggering the wind control rule.
Optionally, the wind control factor includes user identity information data, and the step of determining whether the actual value satisfies the reference value range includes:
calling user identity information data contained in the money charging request as an actual value;
establishing a money laundering blacklist as a reference value range;
and inquiring whether data matched with the user identity information data exist in the money laundering blacklist or not.
Optionally, the wind control factor includes user money charging information data, and the step of determining whether the actual value meets the reference value range includes:
calling user money charging information data contained in the money charging request as an actual value;
calculating historical coin charging information data of the same user within a preset time length to serve as a reference value range;
and judging whether the coin charging information data of the user falls into the range of the historical coin charging information data.
Optionally, the processing includes delayed account posting and large amount coin charging auditing, and the step of processing the coin charging request includes:
when the processing is delayed account uploading, freezing the coin charging request; after a preset delay time, the freezing of the coin charging request is released;
when the processing is large-amount money charging examination, obtaining an examination and approval instruction of a user; and if the approval instruction is passed, finishing the processing.
Optionally, the method further includes:
if the coin charging request is not of the FAST uploading type, counting the uploading times of the service end;
and when the account-checking times reach the preset times, performing safe account-checking.
In a second aspect, the present application further provides a digital asset transaction anomaly monitoring method, applied to a service end, where the method includes:
acquiring a coin charging order in the block chain, generating a coin charging request according to the coin charging order and sending the coin charging request to a server; the coin charging request comprises a coin charging address and a coin charging amount;
and correspondingly executing the freezing or unfreezing operation of the coin charging request according to the processing result of the server.
In a third aspect, the present application further provides a digital asset transaction anomaly monitoring device, applied to a server, the device including:
the acquisition unit is used for acquiring a coin charging request sent by a service end; the coin charging request comprises a coin charging address and a coin charging amount;
the judging unit is used for judging whether the coin charging request triggers a wind control rule or not;
the processing unit is used for processing the coin charging request when a wind control rule is triggered;
the judging unit is also used for judging whether the processed coin charging request is of a FAST (FAST open bank transaction) upper account type;
and the processing unit is also used for carrying out safety accounting according to the coin charging request.
Optionally, the judging unit is further configured to judge whether the accumulated money-filled amount reaches an upper accounting amount; the accumulated money-charging amount is the sum of the money-charging amounts of at least one money-charging request sent by the same service end.
Optionally, the determining unit includes:
the extracting subunit is used for extracting a corresponding actual value in the coin charging request according to at least one wind control factor;
the judgment execution subunit is used for judging whether the actual value meets the reference value range or not; and if the actual value extracted according to the wind control factor does not meet the reference value range, triggering the wind control rule.
Optionally, the extracting subunit is further configured to retrieve user identity information data included in the money charging request as an actual value;
the judgment execution subunit is also used for establishing a money laundering blacklist as a reference value range; and inquiring whether data matched with the user identity information data exist in the money laundering blacklist or not.
Optionally, the extracting subunit is further configured to retrieve user money charging information data included in the money charging request as an actual value;
the judgment execution subunit is also used for calculating historical coin charging information data of the same user within a preset time length as a reference value range; and judging whether the coin charging information data of the user falls into the range of the historical coin charging information data.
Optionally, the processing unit includes:
the freezing and unfreezing subunit is used for freezing the coin charging request when the delayed account charging is processed; after a preset delay time, the freezing of the coin charging request is released;
the manual approval subunit is used for acquiring an approval instruction of the user when the process is a large-amount money-charging approval; and if the approval instruction is passed, finishing the processing.
Optionally, the apparatus further comprises:
the counting unit is used for counting the account-up times of the service end when the coin-charging request is not of a FAST account-up type; and when the account-checking times reach preset times, sending a safe account-checking instruction to the processing unit.
In a fourth aspect, the present application further provides a digital asset transaction anomaly monitoring device, applied to a service end, where the device includes:
the request generation unit is used for acquiring a coin charging order in the block chain, generating a coin charging request according to the coin charging order and sending the coin charging request to the server; the coin charging request comprises a coin charging address and a coin charging amount;
and the execution unit is used for correspondingly executing the freezing or unfreezing operation of the coin charging request according to the processing result of the server.
In a fifth aspect, the present application further provides a digital asset transaction anomaly monitoring system, which includes a server and a service end, wherein the server is configured with the method of the first aspect; the service end is configured with the method of the second aspect.
The application provides a digital asset transaction abnormity monitoring method, device and system, which comprises the steps of obtaining a money charging request sent by a service end; the coin charging request comprises a coin charging address and a coin charging amount; judging whether the coin charging request triggers a wind control rule or not; if the wind control rule is triggered, processing the coin charging request; judging whether the processed coin charging request is of a FAST (FAST open bank transaction) upper account type; and if so, carrying out safe accounting according to the coin charging request. The method and the system have the advantages that regular configuration is carried out in the wind control system, wind control factors are applied to collected coin filling order data, coin filling source data, coin filling user relation map data, user basic data, user behavior data and other data to judge the coin filling risk, abnormal coin filling requests are responded in time through the system, corresponding processing is carried out, and the transaction safety is guaranteed; meanwhile, the established rules can be flexibly configured according to actual requirements, and the applicability and the processing efficiency for processing the abnormity are improved.
Detailed Description
The technical solutions in the embodiments of the present invention will be described clearly and completely with reference to the accompanying drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
Referring to fig. 1, a flow chart of a digital asset transaction anomaly monitoring method according to the present application is shown;
as can be seen from fig. 1, the present application provides a digital asset transaction anomaly monitoring method, which is applied to a server, and the method includes:
s100: acquiring a coin charging request sent by a service end;
in this embodiment, the service end refers to a terminal, such as a wallet, capable of providing a user with direct current and subsequent operations, and the user performs personal information verification at the service end, so that the service end can collect characteristics of money or transaction that the user wants to charge in combination with the user information, and thus, behaviors and characteristics of user account security, money laundering characteristics, abnormal money charge and the like are judged, and higher security of a transaction platform is ensured. The coin charging request is considered to be a set capable of containing all data which possibly express user information and user intention, and is not limited to include a coin charging address and a coin charging amount; the money charging address represents user source information, and the money charging amount represents transaction destination information; in addition, the money charging request may also include a user name, a transaction time record, IP location information, and the like, which is not limited herein.
In general, before sending a coin charging request, a service end needs to query a historical coin charging order of a current user, specifically, for example, a wallet may query whether a coin charging order belonging to a coin charging address of a transaction platform exists in a block chain in a polling manner, and a previous coin charging behavior of the user may be known from a query result, so as to collect user data.
S200: judging whether the coin charging request triggers a wind control rule or not;
in the solution provided in this embodiment, for a coin charging request sent by a service end, a specific wind control rule needs to be set to determine an attribute of the coin charging request, specifically, a wind control engine inside a wind control system (RC system) is used to perform rule configuration, apply a wind control factor, perform calculation, analysis and determination on a use behavior of a user, a coin charging and coin lifting behavior, and trigger a corresponding handling operation.
Specifically, as shown in fig. 2, in a possible embodiment, the step S20 can be decomposed as:
s210: extracting a corresponding actual value in the coin charging request according to at least one wind control factor; the wind control factors are set by a developer, and can be the black address of money washing from money filling sources, the accumulated number of money filling pens of the same currency of a user, the money filling amount of the user at this time/the average value of the money filling amount y% day before the same currency, the accumulated number of money filling of the same currency close to x% hours/the accumulated number of money filling of the same currency close to y% day or other factors, wherein the wind control factors can be one or more of the above, and when the wind control factors are multiple, corresponding actual values need to be extracted/calculated for each wind control factor. The actual value generally corresponds to the value corresponding to the information contained in the current coin refill request.
S220: judging whether the actual value meets the reference value range or not; in the present embodiment, the range of whether the reference value is satisfied includes a logical judgment of boolean (yes/no, Y/N), and also includes a judgment of whether it is larger than a certain minimum value, smaller than a certain maximum value, located between two values, and the like. The reference value range generally corresponds to the value corresponding to the information contained in the historical coin filling request.
S230: and if the actual value extracted according to the wind control factor does not meet the reference value range, triggering the wind control rule.
According to the judgment condition of S220, if the extracted actual value does not meet the reference value range, the abnormal condition of the coin charging request is shown, and the purpose of triggering the wind control rule at this time is to execute corresponding processing on the current coin charging request in time through a wind control means, so that the safety performance of the system is prevented from being reduced due to the abnormal condition.
Otherwise, if the extracted actual value meets the reference value range, which indicates that there is no abnormal condition in the coin-filling request, the subsequent operation steps of S400 and S500 can be directly executed without calling a subsequent wind control mechanism.
Further, according to different wind control factor selections, the step S200 may be decomposed in different forms, and in an embodiment shown in fig. 3, when the wind control factor includes user identity information data, the step S200 may be decomposed as:
s211: calling user identity information data contained in the money charging request as an actual value; the user identity information data can comprise information such as a coin charging source address, a coin charging user account number, a nickname and the like, and when judging whether a coin charging request triggers a wind control rule, the information can be extracted for inquiry;
s221: establishing a money laundering blacklist as a reference value range; the money washing blacklist comprises known money washing account information, wherein the information is not limited to account name, account address and the like, and the information is integrated to establish the money washing blacklist and is stored in the system in advance for providing a comparison reference database for the money filling request;
s231: inquiring whether data matched with the user identity information data exist in a money laundering blacklist or not; for example, if the same account address, account name, etc. as those in the money-washing blacklist exist, a determination result for triggering the wind control rule can be obtained.
Similarly, in another embodiment shown in fig. 4, when the wind control factor includes the user money charging information data, step S200 may be divided into:
s212: calling user money charging information data contained in the money charging request as an actual value; the user coin charging information data is not limited to the number of the charged coins, the number of times of charging the coins, the accumulated number of times of charging the coins, the types of the charged coins and the like;
s222: calculating historical coin charging information data of the same user within a preset time length to serve as a reference value range; the historical coin charging information data is not limited to data including accumulated coin charging strokes of the same currency of a user, the current coin charging amount of the user/average y% of the daily coin charging amount before the same currency, the accumulated coin charging amount of the same currency close to x% of the hour/the daily coin charging amount of the same currency close to y% of the day, and the like; the preset time duration is selected to be several days, several hours or several minutes and the like according to different types of historical coin charging information data;
s232: judging whether the user money charging information data falls into the range of the historical money charging information data; for example, when the current recharging amount of a certain user is 2BTC, and the accumulated recharging amount in the last 24 hours is greater than 30 in the wind control rule, the accumulated recharging amount (actual value) in the last 24 hours of the user is obtained to be 20BTC according to the recharging request, and the wind control rule is not triggered because the accumulated recharging amount does not fall into the data range of the historical recharging information, so that the subsequent operation of entering the account and the like can be directly executed.
In this application, the wind control factors may be multiple in the above embodiments, that is, multiple factors are used together as a judgment basis, and when one of the factors meets the trigger condition, a conclusion for triggering the wind control rule can be obtained, which can be specifically illustrated by the following examples:
if the source address of the user's own money is 19bvhzVFUe8 × 9YCMDy, the money charge is BTC, the money charge amount is 2BTC, the average value of the money charge per day in the previous 3 days is 2BTC, the cumulative value of 24 hours is 20BTC, and the cumulative number of the money charges in the same currency is 20 in 30 days. If the wind control rule is set as follows: the accumulated coin-charging number of the same currency is more than 30 within half a month or the accumulated coin-charging number of the same currency is more than 8 within nearly 24 hours of the same currency/the accumulated coin-charging number of the same currency is more than 8 within nearly 30 days of the same currency, and the accumulated coin-charging number is used as an account number to be frozen after meeting the wind control rule; for the user, although the number of the recharging pens in the actual value is less than 30 and does not fall into the reference value range, the ratio of the number of the recharging pens to the daily average number is 10 to 8, and the recharging pens fall into the reference value range, and the wind control rule is judged to be triggered based on the relation or the relation between two rules, namely one rule meets the requirement. It is therefore possible to conclude that the user is being handled, the handling action being account freezing.
Further, before step S200, the method further includes:
s150: judging whether the accumulated money-charging amount reaches the upper accounting amount or not; the accumulated money-charging amount is the sum of the money-charging amounts of at least one money-charging request sent by the same service end. The purpose of setting the credit limit is to reduce the increase of system load caused by the credit of the assets with small logarithmic amount for many times, intensively process the coin filling requests with small number of times and amount, and is favorable for increasing the processing efficiency. During specific operation, when the accumulated money-filled amount does not reach the upper accounting amount, the next money-filled request is waited without performing the next descending step, and the accumulated money-filled amount is continuously accumulated, so that the descending step is performed when the accumulated money-filled amount reaches the upper accounting amount.
According to the step S200, if the judgment result is that the wind control rule is triggered, the following steps are continuously executed;
s300: processing the coin charging request;
based on different abnormal levels and different types of coin charging requests, a plurality of processing modes are required, wherein the processing modes mainly comprise delayed account uploading and large-amount coin charging auditing.
The delayed account-up is directed at a money charging request with a not too high abnormal level, the time for delaying account-up is mainly set through an internal timer, the user can safely account up after the delayed account-up time is reached, the account is not immediately accounted, the set delayed account-up time can be matched, the money charging amount of the user can not be accounted up (namely, transaction or money lifting operation) in the delayed account-up time, and the state is automatically released until the time is reached or manually released by the user; therefore, the steps can be expressed as follows: when the processing is delayed account uploading, freezing the coin charging request; and after the preset delay time, releasing the freezing of the coin charging request.
The large-amount coin charging examination mainly aims at the coin charging requests with large amount and high abnormal level, and can be implemented by relevant personnel by sending the content to be examined to a manual examination system (MGT system), executing examination operation and inputting examination results; once entering the processing mode, the auditing process can not be cancelled through any operation executed by the service end; therefore, the steps can be expressed as follows: when the processing is large-amount money charging examination, obtaining an examination and approval instruction of a user; and if the approval instruction is passed, finishing the processing.
In addition, the processing mode also comprises the steps of sending a marking instruction or a freezing instruction to the service end, and correspondingly executing marking operation or freezing operation by the service end according to the received instruction;
specifically, when a marking instruction is sent, the marking instruction indicates that the user sending the money charging request is marked by the wind control system, but the marking is only to record the behavior of the user, does not affect the transaction process of the user, and is equivalent to a passing operation;
when a freezing instruction is sent, the instruction comprises the conditions of account freezing, currency extracting time limit freezing and the like, wherein the account freezing is that a user can normally upload accounts, but the account is frozen; the note picking operation is not performed, and the note picking operation is not performed, namely the note picking operation is performed; and (4) carrying out the note-picking time limit freezing, namely the user can normally check up the account, but the note-picking operation cannot be carried out within the limit time, and the note-picking operation can be normally carried out after the waiting time is up.
S400: judging whether the processed coin charging request is of a FAST (FAST open bank transaction) upper account type;
the account-checking type can be divided into two types of quick account-checking and safe account-checking, in an actual application scene, the asset rollback of a user is caused by the block chain rollback, so that huge loss is easily caused to a transaction platform, and in order to solve the problems, the account-checking operation can be executed by reasonably utilizing the two different account-checking types, so that the loss can be avoided as much as possible, and the user experience can be improved to the maximum extent; the FAST posting type is a new posting type preset by a developer, is between two existing types and is equivalent to an intermediate state, so that a user can trade own virtual assets, but cannot perform money extraction operation. Whether the coin charging request is of a FAST (FAST open mail protocol) posting type is judged in the application, which is equivalent to the last point clamping operation before the safe posting, because the block rollback probability in the quick posting is low, and the safe posting is not influenced by the block rollback, whether the quick posting time is reached can be judged through the confirmation times in a block chain, and specifically, if the coin charging request is not of the FAST posting type, the posting times of the service end are counted; and when the account-checking times reach the preset times, performing safe account-checking.
S500: and carrying out safe account uploading according to the coin charging request.
In this embodiment, the secure posting may include several situations, and on the one hand, when it is determined that the wind control rule is not triggered and the coin charging request is of a FAST posting type, the secure posting may be directly performed; secondly, when judging that the wind control rule is triggered, judging that the money charging request after wind control processing is of a FAST (FAST open bank transaction) account uploading type, and then carrying out safe account uploading; and thirdly, when judging that the wind control rule is triggered, judging that the money charging request after the wind control processing is not a FAST (FAST open bank account) posting type, and performing safe posting after waiting for the posting times.
According to the technical scheme, the method for monitoring the digital asset transaction abnormity comprises the steps of obtaining a money charging request sent by a service end; the coin charging request comprises a coin charging address and a coin charging amount; judging whether the coin charging request triggers a wind control rule or not; if the wind control rule is triggered, processing the coin charging request; judging whether the processed coin charging request is of a FAST (FAST open bank transaction) upper account type; and if so, carrying out safe accounting according to the coin charging request. According to the method and the system, the rule configuration is carried out in the wind control system, the wind control factors are applied to the collected coin filling order data, the coin filling source data, the coin filling user relation map data, the user basic data, the user behavior data and other data to judge the coin filling risk, corresponding processing is carried out on abnormal coin filling requests, and the transaction safety is guaranteed; meanwhile, the established rules can be flexibly configured according to actual requirements, and the applicability and the processing efficiency for processing the abnormity are improved.
As can be seen from fig. 5, corresponding to the above method, the present application also provides a digital asset transaction anomaly monitoring method, which is applied to a business end, and the method includes:
s800: acquiring a coin charging order in the block chain, generating a coin charging request according to the coin charging order and sending the coin charging request to a server; the coin charging request comprises a coin charging address and a coin charging amount;
s900: according to the processing result of the server, correspondingly executing the freezing or unfreezing operation of the coin charging request; it should be noted that, because the service end and the service end are always in a connection state in the whole transaction process, the service end can obtain state information in the current transaction or in the process of money charging and withdrawing in real time, for example, the judgment result in the service end execution method can be sent to the service end or displayed at the service end; when the user needs to unfreeze the frozen coin filling request, the method can be executed at the service end.
For other technical solutions related to the method described in this embodiment and the server, reference may be made to the foregoing description, and details are not described herein.
As can be seen from fig. 6, the present application further provides a digital asset transaction anomaly monitoring device corresponding to the method shown in fig. 1, including:
an obtaining unit 100, configured to obtain a coin charging request sent by a service end; the coin charging request comprises a coin charging address and a coin charging amount;
the judging unit 200 is used for judging whether the coin charging request triggers a wind control rule or not;
the processing unit 300 is used for processing the coin charging request when a wind control rule is triggered;
the judging unit 200 is further configured to judge whether the processed money charging request is of a FAST posting type;
the processing unit 300 is further configured to perform secure billing according to the coin charging request.
Further, the determining unit 200 is further configured to determine whether the accumulated money-filled amount reaches the credit amount; the accumulated money-charging amount is the sum of the money-charging amounts of at least one money-charging request sent by the same service end.
Further, as can be seen from fig. 7, the determining unit 200 includes:
an extracting subunit 210, configured to extract, according to at least one wind control factor, a corresponding actual value in the coin charging request;
a judgment execution subunit 220, configured to judge whether the actual value satisfies the reference value range; and if the actual value extracted according to the wind control factor does not meet the reference value range, triggering the wind control rule.
Further, in a feasible embodiment, the extracting subunit 210 is further configured to retrieve the user identity information data included in the money charging request as an actual value;
the judgment execution subunit 220 is further configured to establish a money laundering blacklist as a reference value range; and inquiring whether data matched with the user identity information data exist in the money laundering blacklist or not.
Further, in another possible embodiment, the extracting subunit 210 is further configured to retrieve the user money charging information data included in the money charging request as an actual value;
the judgment execution subunit 220 is further configured to calculate historical coin charging information data of the same user within a preset time period, as a reference value range; and judging whether the coin charging information data of the user falls into the range of the historical coin charging information data.
Further, as can be seen from fig. 8, the processing unit 300 includes:
a freezing and unfreezing subunit 310, configured to freeze the coin charging request when the processing is delayed credit uploading; after a preset delay time, the freezing of the coin charging request is released;
the manual approval subunit 320 is configured to, when the processing is checking for large-amount money charging, obtain an approval instruction of the user; and if the approval instruction is passed, finishing the processing.
Further, the apparatus further comprises:
a counting unit 400, configured to count the number of times of posting of the service end when the coin charging request is not of the FAST posting type; and when the account-checking times reach preset times, sending a safe account-checking instruction to the processing unit.
The functional role of each structural unit in the embodiment when executing the method is described in the method embodiment shown in fig. 1, and is not described herein again.
As can be seen from fig. 9, the present application further provides a digital asset transaction anomaly monitoring device corresponding to the method shown in fig. 5, including:
the request generating unit 800 is configured to obtain a coin charging order in the block chain, generate a coin charging request according to the coin charging order, and send the coin charging request to the server; the coin charging request comprises a coin charging address and a coin charging amount;
and the execution unit 900 is configured to correspondingly execute the freezing or unfreezing operation on the coin charging request according to the processing result of the server.
The functional role of each structural unit in the embodiment when executing the method described above is described in the method embodiment shown in fig. 5, and is not described herein again.
The application also provides a digital asset transaction anomaly monitoring system, including: a server and a service end, wherein the server configures the method shown in fig. 1; the service end is configured with the method shown in fig. 5, and for the functions and descriptions of the system, reference may be made to the foregoing discussion, and details are not described here.
Other embodiments of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the invention and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the invention being indicated by the following claims.
It will be understood that the invention is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the invention is limited only by the appended claims.