CN113344584A

CN113344584A - Data feedback method, device and system based on blacklist and storage medium

Info

Publication number: CN113344584A
Application number: CN202110616619.5A
Authority: CN
Inventors: 赵中芳; 李元华; 苗森; 李规化; 尉振锋
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2021-06-02
Filing date: 2021-06-02
Publication date: 2021-09-03

Abstract

The present disclosure provides a blacklist-based data feedback method, device, system and storage medium, which are applied to the field of financial technology, and include: acquiring delivery data and blacklist data, wherein the blacklist data is obtained by analyzing the delivery data received by a supervision mechanism every day; matching the delivery data with blacklist data to identify suspicious data in the delivery data; reversely acquiring an application system generating suspicious data based on the suspicious data; and checking whether the transaction rule of the application system generating the suspicious data has a vulnerability. According to the method, relevant business data are positioned by matching the submission data with the blacklist data, and the invalid transaction rule is tracked reversely according to the business transaction data, so that problems can be found and corrected timely in the first time, and the financial institution is prevented from being endowed with greater credit and fund risk.

Description

Data feedback method, device and system based on blacklist and storage medium

Technical Field

The present disclosure relates to the field of financial technology, and more particularly, to a blacklist-based data feedback method, apparatus, system and storage medium.

Background

In the financial field, in order to strengthen the monitoring and management of the overseas transaction of the bank card and maintain the overseas transaction order of the bank card, currently, various financial supervision organizations require the bank and other financial organizations to actively report the overseas presentation details of the bank card and the overseas consumption details data of the bank card on time. Meanwhile, the foreign exchange bureau issues bank card overseas illegal transaction information, namely blacklist data, to the financial institutions according to daily total amount, and requires each financial institution to forbid the blacklist customers from performing bank card cash-taking transaction overseas.

Under the complex environments that the current supervision requirement rules are increasingly strict, the iterative upgrade of application systems such as banks is increasingly accelerated, and the competition pressure of each financial institution is multiplied, an automatic device or system is urgently needed, the potential logic relation of the reported data and the blacklist data is mined, the failed transaction rules are reversely checked and positioned through the check of the reported data, and the self-checking and self-correction of the financial institution are timely completed if the reported data in the blacklist appears.

Disclosure of Invention

In view of the above, the present disclosure provides a blacklist-based data feedback method, apparatus, system and storage medium.

One aspect of the present disclosure provides a blacklist-based data feedback method, comprising: acquiring delivery data and blacklist data, wherein the blacklist data is obtained by analyzing the delivery data received by a supervision mechanism every day; matching the delivery data with the blacklist data to identify suspicious data in the delivery data; reversely acquiring an application system generating the suspicious data based on the suspicious data; and checking whether the transaction rule of the application system generating the suspicious data has a vulnerability.

According to an embodiment of the present disclosure, each of the submission data includes at least one source identification, and the application system for reversely obtaining the suspicious data based on the suspicious data includes: and inquiring a preset application system library based on the at least one source identifier to acquire application systems corresponding to the at least one source identifier.

According to an embodiment of the present disclosure, the verifying whether the transaction rule of the application system generating the suspicious data has a vulnerability includes: acquiring a flow for generating the suspicious data and acquiring transaction rules of all steps of the flow; and sequentially verifying each transaction rule and checking whether each transaction rule has a vulnerability.

According to an embodiment of the present disclosure, the acquiring the delivery data and the blacklist data includes: respectively storing the submission data and the blacklist data in a first file and a second file according to the same preset storage rule; the preset storage rule specifies the classification and block storage forms of the delivery data and the blacklist data.

According to an embodiment of the present disclosure, the matching the delivery data with the blacklist data to identify suspicious data in the delivery data includes: sequentially matching the data in the first file and the data in the second file according to data classification and blocking specified by the preset storage rule; and recording the matched data in the first file and the second file as the suspicious data.

According to an embodiment of the present disclosure, further comprising: judging whether the size of the first file is larger than the preset file size or not; when the size of the first file is larger than the preset file size, splitting the first file into a plurality of first subfiles, wherein the size of each first subfile is smaller than the preset file size.

According to an embodiment of the present disclosure, further comprising: and starting a plurality of threads, wherein each thread is used for processing the matching of one first subfile and the second file.

According to an embodiment of the present disclosure, further comprising: and when the transaction rule has a bug, repairing the transaction rule.

Another aspect of the disclosure provides a blacklist-based data feedback device, comprising: the data acquisition module is used for acquiring the submission data and the blacklist data; the data matching module is used for matching the delivery data with the blacklist data so as to identify suspicious data in the delivery data; a data feedback module for reversely acquiring an application system generating the suspicious data based on the suspicious data; and the rule verification module is used for checking whether the transaction rule of the suspicious data generated by the application system has a vulnerability.

Another aspect of the present disclosure provides a computer system, including: one or more processors; memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method of any of the first aspects.

Another aspect of the disclosure provides a computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to implement the method of any one of the first aspects.

According to the embodiment of the disclosure, relevant business data are positioned through matching of the report data and the blacklist data, and the invalid transaction rule is tracked reversely according to the business transaction data, so that problems can be found and corrected timely at the first time, greater credit and capital risks to financial institutions are avoided, and the blank of validity check of the blacklist control rule brought out by an overseas bank card is filled. The method deeply excavates the internal logic of the reported data, exerts the potential value of the data, realizes the built-in quality of a scientific and technological system and establishes a good ecological cycle of an application system.

Drawings

The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure with reference to the accompanying drawings, in which:

FIG. 1 schematically illustrates an exemplary system architecture to which the blacklist-based data feedback method and apparatus of the present disclosure may be applied;

FIG. 2 schematically illustrates a flow diagram of a blacklist-based data feedback method according to an embodiment of the present disclosure;

FIG. 3A schematically illustrates an implementation flow of a blacklist-based data feedback method according to an embodiment of the present disclosure;

FIG. 3B schematically shows a message data acquisition flow according to an embodiment of the disclosure;

FIG. 3C schematically illustrates a file splitting flow according to another embodiment of the present disclosure;

FIG. 3D schematically illustrates an implementation of a nursing home application system according to an embodiment of the present disclosure;

FIG. 4 schematically illustrates a block diagram of a blacklist-based data feedback device according to an embodiment of the present disclosure;

FIG. 5 schematically shows a block diagram of a data acquisition module according to an embodiment of the disclosure;

FIG. 6 schematically illustrates a block diagram of a data matching module according to an embodiment of the present disclosure;

FIG. 7 schematically illustrates a block diagram of a data acquisition module according to another embodiment of the present disclosure;

FIG. 8 schematically illustrates a block diagram of a data matching module according to another embodiment of the present disclosure;

FIG. 9 schematically illustrates a block diagram of a data feedback module in accordance with an embodiment of the present disclosure;

FIG. 10 schematically illustrates a block diagram of a rule validation module according to an embodiment of the present disclosure;

fig. 11 schematically illustrates a block diagram of a computer system 1100 suitable for implementing a robot in accordance with an embodiment of the disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is illustrative only and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It is noted that the terms used herein should be interpreted as having a meaning that is consistent with the context of this specification and should not be interpreted in an idealized or overly formal sense.

Where a convention analogous to "at least one of A, B and C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B and C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.). Where a convention analogous to "A, B or at least one of C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B or C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.).

Embodiments of the present disclosure provide a blacklist-based data feedback method and apparatus. The method comprises the steps of matching daily message data with black single data, reversely checking an application system generating the suspicious data according to the suspicious data obtained by matching, and checking whether the application system has a transaction rule loophole.

FIG. 1 schematically illustrates an exemplary system architecture 100 to which blacklist-based data feedback methods and apparatus may be applied, according to an embodiment of the present disclosure. It should be noted that fig. 1 is only an example of a system architecture to which the embodiments of the present disclosure may be applied to help those skilled in the art understand the technical content of the present disclosure, and does not mean that the embodiments of the present disclosure may not be applied to other devices, systems, environments or scenarios.

As shown in FIG. 1, the system architecture 100 in accordance with the embodiments can include

terminal devices

101, 102, 103, a network 104, and a server 105. The network 104 serves as a medium for providing communication links between the

terminal devices

101, 102, 103 and the server 105. Network 104 may include various connection types, such as wired and/or wireless communication links, and so forth.

The user may use the

terminal devices

101, 102, 103 to interact with the server 105 via the network 104 to receive or send messages or the like. The

terminal devices

101, 102, 103 may have installed thereon various communication client applications, such as a shopping-like application, a web browser application, a search-like application, an instant messaging tool, a mailbox client, and/or social platform software, etc. (by way of example only).

The

terminal devices

101, 102, 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop portable computers, desktop computers, and the like.

The server 105 may be a server providing various services, such as a background management server (for example only) providing support for websites browsed by users using the

terminal devices

101, 102, 103. The background management server may analyze and perform other processing on the received data such as the user request, and feed back a processing result (e.g., a webpage, information, or data obtained or generated according to the user request) to the terminal device.

It should be noted that the blacklist-based data feedback method provided by the embodiments of the present disclosure may be generally performed by the server 105. Accordingly, blacklist-based data feedback devices provided by embodiments of the present disclosure may be generally located in server 105. The blacklist based data feedback method provided by the embodiments of the present disclosure may also be performed by a server or a server cluster that is different from the server 105 and capable of communicating with the

terminal devices

101, 102, 103 and/or the server 105. Accordingly, blacklist-based data feedback devices provided by embodiments of the present disclosure may also be located in a server or server cluster that is different from server 105 and is capable of communicating with

terminal devices

101, 102, 103 and/or server 105. Alternatively, the blacklist-based data feedback method provided by the embodiment of the present disclosure may also be executed by the

terminal device

101, 102, or 103, or may also be executed by other terminal devices different from the

terminal device

101, 102, or 103. Accordingly, the blacklist-based data feedback device provided by the embodiment of the disclosure can be disposed in the

terminal equipment

101, 102 or 103, or disposed in other terminal equipment different from the

terminal equipment

101, 102 or 103.

For example, the message data may be originally stored in any one of the

terminal devices

101, 102, or 103 (for example, but not limited to, the terminal device 101), or may be stored on an external storage device and may be imported into the terminal device 101. Terminal device 101 may then execute the blacklist-based data forwarding method provided by embodiments of the present disclosure locally or send message data to other terminal devices, servers, or server clusters and execute the blacklist-based data forwarding method provided by embodiments of the present disclosure by other terminal devices, servers, or server clusters receiving the message data.

It should be understood that the number of terminal devices, networks, and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

FIG. 2 schematically illustrates a flow diagram of a blacklist-based data feedback method according to an embodiment of the present disclosure.

As shown in fig. 2, the method includes operations S201 to S204.

In operation S201, delivery data and blacklist data are obtained, wherein the blacklist data is obtained by analyzing, by a regulatory mechanism, the delivery data received every day.

In operation S202, the delivery data is matched with the blacklist data to identify suspicious data in the delivery data.

In operation S203, an application system generating the suspicious data is reversely acquired based on the suspicious data.

In operation S204, it is checked whether there is a vulnerability in the transaction rule of the application system that generated the suspicious data.

In the embodiment of the disclosure, the reported data is transaction detail data generated by financial institutions such as banks every day, specifically, the reported data can be foreign statement and foreign consumption detail data of bank cards, the foreign exchange issues foreign illegal transaction information of the bank cards, namely data of blacklists, to the financial institutions according to daily volume, and requires each financial institution to prohibit blacklist customers from performing foreign bank card discovery transactions, thereby maintaining foreign transaction order of the bank cards.

According to the method provided by the embodiment of the disclosure, the potential logical relationship between the reported data and the blacklist data is mined by using the blacklist provided by the supervision institution, so that the positioning self-check of the transaction rules of the application system is realized, the transaction rules with vulnerabilities are repaired in time, and the financial institution is prevented from being more creditworthiness and fund risk.

The implementation of this method will be described in further detail below with reference to fig. 3A-3D.

FIG. 3A schematically illustrates an implementation flow of a blacklist-based data feedback method according to an embodiment of the present disclosure.

As shown in FIG. 3A, the apparatus for performing the method mainly comprises a data acquisition module, a data matching module, a data feedback module and a rule verification module.

Firstly, the data acquisition module synchronously acquires the bank card foreign statement data file to be reported by each financial institution and the blacklist data file downloaded by the foreign exchange to the inspection catalog predefined by the system.

And then, the data matching module searches whether the report data file prepared by the data acquisition module relates to blacklist data downloaded by the foreign exchange office or not by adopting a data retrieval technology, and completes result output and display.

And thirdly, the data feedback module analyzes the blacklist check result, identifies an application system with control failure according to the predefined transaction rule characteristics of the system, and informs the system operation and maintenance monitoring personnel.

And finally, a rule verification module checks whether the transaction rule of the suspicious data generated by the application system has a vulnerability.

In the embodiment of the disclosure, when the transaction rule has a bug, the operation and maintenance personnel can be reported to repair the transaction rule.

Fig. 3B schematically shows a message data acquisition flow according to another embodiment of the present disclosure.

As shown in fig. 3B, the data obtaining module identifies an interface of the server that sends the delivery data, obtains the bank card foreign statement data file and the blacklist data file downloaded by the foreign exchange to a file directory predefined by the system according to the configuration information, generates a first file and a second file, and completes the file preparation work.

The step of obtaining the foreign currency data file of the bank card and the blacklist data file downloaded by the foreign exchange office into a file directory predefined by the system and performing data matching may include operations S301 to S303.

In operation S301, the submission data and the blacklist data are stored in a first file and a second file, respectively, according to a same preset storage rule.

In operation S302, the data in the first file and the data in the second file are sequentially matched according to the data classification and blocking specified by the preset storage rule.

In operation S303, the data matching the first file and the second file is recorded as the suspicious data.

The preset storage rule stipulates the classification and block storage modes of the report data and the blacklist data, and the data are classified and stored in blocks, so that the report data can be matched with the corresponding type of blacklist data conveniently, and the matching efficiency is improved.

Fig. 3C schematically illustrates a file splitting flow according to another embodiment of the present disclosure.

As shown in fig. 3C, after the data obtaining module obtains the delivery data and the blacklist data, in order to improve matching efficiency, the delivery data is split into a plurality of files, and the files are respectively matched with the blacklist data, so as to improve retrieval efficiency. Specifically, the method may include operations S304 to S307.

In operation S304, it is determined whether the size of the first file is larger than a preset file size.

In operation S305, when the size of the first file is larger than the preset file size, the first file is split into a plurality of first subfiles, and the size of each of the first subfiles is smaller than the preset file size.

In operation S306, each of the first subfiles is matched with data in a second file.

In operation S307, the data in each first subfile that matches the data in the second file is recorded as the suspicious data.

In the embodiment of the present disclosure, in order to improve the matching efficiency, the matching between each first subfile and the second file may be performed simultaneously, specifically, according to operation S308.

In operation S308, a plurality of threads are started, each thread being used for processing the matching of one of the first subfile and the second file.

After the matching is finished, the matching results can be collected and output to a result file, and real-time display is carried out.

Fig. 3D schematically illustrates an implementation process of a nursing home application system according to an embodiment of the present disclosure.

As shown in fig. 3D, the data feedback module tracks the application system of the failed transaction rule back according to the suspicious data and reports the same. In this embodiment, each delivery data includes at least one source identification identifier, a preset application system library is preset in the data feedback module, and a name of an application system performing the data delivery and at least one source identification identifier corresponding to the name are stored in the data feedback module, and specifically, the source identification identifier is suspicious of a bank clearing channel, a bank card type, and the like.

And based on the suspicious data, identifying source identifiers such as bank clearing channels, bank card types and the like, searching the application system, acquiring the application system corresponding to at least one source identifier, and then supervising a development center to repair the related program bugs through a result reporting module and an e-mail reporting system operation and maintenance monitoring personnel to finish the rectification at the first time.

Specifically, checking whether the transaction rule has a bug includes operations S309 to 311.

In operation S309, it is checked whether the transaction rule of the application system generating the suspicious data has a vulnerability.

In operation S310, a process of generating the suspicious data is obtained, and transaction rules of each step of the process are obtained.

In operation S311, each transaction rule is sequentially verified, and whether a vulnerability exists in each transaction rule is checked.

Therefore, the quick positioning of the transaction rule with the loophole can be quickly realized, and the operation and maintenance personnel can repair the loophole conveniently and timely.

FIG. 4 schematically illustrates a block diagram of a blacklist-based data feedback device according to an embodiment of the present disclosure.

As shown in fig. 4, a blacklist-based data feedback device 400 provided by an embodiment of the present disclosure includes: a data acquisition module 410, a data matching module 420, a data feedback module 430, and a rule verification module 440.

The data obtaining module 410 is configured to obtain the delivery data and the blacklist data.

A data matching module 420, configured to match the delivery data with the blacklist data to identify suspicious data in the delivery data.

A data back-feed module 430 for back-fetching an application system that generated the suspect data based on the suspect data.

The rule verification module 440 is configured to check whether there is a vulnerability in the transaction rule of the suspicious data generated by the application system.

FIG. 5 schematically shows a block diagram of a data acquisition module according to an embodiment of the disclosure.

As shown in fig. 5, the data acquisition module 410 includes: a data storage unit 411.

The data storage unit 411 is configured to store the delivery data and the blacklist data in a first file and a second file respectively according to the same preset storage rule; the preset storage rule specifies the classification and block storage forms of the delivery data and the blacklist data.

FIG. 6 schematically shows a block diagram of a data matching module according to an embodiment of the disclosure.

As shown in fig. 6, the data matching module 420 includes: a data matching unit 421 and a data recording unit 422.

And a data matching unit 421, configured to sequentially match the data in the first file and the data in the second file according to data classification and partitioning specified by the preset storage rule.

The data recording unit 422 is configured to record the data in the first file and the second file as the suspicious data.

Fig. 7 schematically illustrates a block diagram of a data acquisition module according to another embodiment of the present disclosure.

As shown in fig. 7, the data obtaining module 410 further includes: a file size determination unit 412, and a file splitting unit 413.

A file size determining unit 412, configured to determine whether the size of the first file is larger than a preset file size.

The file splitting unit 413 is configured to split the first file into a plurality of first subfiles when the size of the first file is larger than the preset file size, where the size of each first subfile is smaller than the preset file size.

FIG. 8 schematically illustrates a block diagram of a data matching module according to another embodiment of the present disclosure.

As shown in fig. 8, the data matching module 420 further includes: a multithread start unit 423.

A multithread starting unit 423, configured to start a plurality of threads, each thread being respectively configured to process matching of one of the first subfile and the second subfile.

FIG. 9 schematically shows a block diagram of a data feedback module in accordance with an embodiment of the present disclosure.

As shown in FIG. 9, data refluence module 430 includes: a source identification unit 431.

The source identification unit 431 is configured to query a preset application system library based on the at least one source identifier, and obtain application systems corresponding to the at least one source identifier.

Each of the delivery data includes at least one source identification identifier, and in the embodiment of the present disclosure, an application system library is preset, including various application systems that generate the delivery data and at least one source identification identifier corresponding to the application systems.

FIG. 10 schematically shows a block diagram of a rule validation module according to an embodiment of the disclosure.

As shown in fig. 10, the rule verification module 440 includes: a flow acquiring unit 441 and a rule verifying unit 442.

The process obtaining unit 441 is configured to obtain a process that generates the suspicious data, and obtain transaction rules of each step of the process.

The rule verification unit 442 is configured to sequentially verify each transaction rule and check whether each transaction rule has a bug.

Any number of modules, sub-modules, units, sub-units, or at least part of the functionality of any number thereof according to embodiments of the present disclosure may be implemented in one module. Any one or more of the modules, sub-modules, units, and sub-units according to the embodiments of the present disclosure may be implemented by being split into a plurality of modules. Any one or more of the modules, sub-modules, units, sub-units according to embodiments of the present disclosure may be implemented at least in part as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented in any other reasonable manner of hardware or firmware by integrating or packaging a circuit, or in any one of or a suitable combination of software, hardware, and firmware implementations. Alternatively, one or more of the modules, sub-modules, units, sub-units according to embodiments of the disclosure may be at least partially implemented as a computer program module, which when executed may perform the corresponding functions.

For example, any number of the data acquisition module 410, the data matching module 420, the data feedback module 430, and the rule verification module 440 may be combined into one module/unit/sub-unit for implementation, or any one of the modules/units/sub-units may be split into multiple modules/units/sub-units. Alternatively, at least part of the functionality of one or more of these modules/units/sub-units may be combined with at least part of the functionality of other modules/units/sub-units and implemented in one module/unit/sub-unit. According to an embodiment of the present disclosure, at least one of the data acquisition module 410, the data matching module 420, the data feedback module 430, and the rule verification module 440 may be implemented at least partially as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented in hardware or firmware in any other reasonable manner of integrating or packaging a circuit, or in any one of three implementations of software, hardware, and firmware, or in any suitable combination of any of them. Alternatively, at least one of the data acquisition module 410, the data matching module 420, the data feedback module 430, the rule verification module 440 may be implemented at least in part as a computer program module that, when executed, may perform corresponding functions.

It should be noted that the data feedback device part based on the blacklist in the embodiment of the present disclosure corresponds to the data feedback method part based on the blacklist in the embodiment of the present disclosure, and the description of the data feedback device part based on the blacklist specifically refers to the data feedback method part based on the blacklist, and is not repeated herein.

FIG. 11 schematically illustrates a block diagram of a computer system suitable for implementing the above-described method, according to an embodiment of the present disclosure. The computer system illustrated in FIG. 11 is only one example and should not impose any limitations on the scope of use or functionality of embodiments of the disclosure.

As shown in fig. 11, a computer system 1100 according to an embodiment of the present disclosure includes a processor 1101, which can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)1102 or a program loaded from a storage section 1108 into a Random Access Memory (RAM) 1103. The processor 1101 may comprise, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or associated chipset, and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), among others. The processor 1101 may also include on-board memory for caching purposes. The processor 1101 may comprise a single processing unit or a plurality of processing units for performing the different actions of the method flows according to the embodiments of the present disclosure.

In the RAM 1103, various programs and data necessary for the operation of the system 1100 are stored. The processor 1101, the ROM 1102, and the RAM 1103 are connected to each other by a bus 1104. The processor 1101 performs various operations of the method flow according to the embodiments of the present disclosure by executing programs in the ROM 1102 and/or the RAM 1103. It is noted that the programs may also be stored in one or more memories other than the ROM 1102 and RAM 1103. The processor 1101 may also perform various operations of the method flows according to the embodiments of the present disclosure by executing programs stored in the one or more memories.

System 1100 may also include an input/output (I/O) interface 1105, which input/output (I/O) interface 1105 is also connected to bus 1104, according to an embodiment of the present disclosure. The system 1100 may also include one or more of the following components connected to the I/O interface 1105: an input portion 1106 including a keyboard, mouse, and the like; an output portion 1107 including a signal output unit such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and a speaker; a storage section 1108 including a hard disk and the like; and a communication section 1109 including a network interface card such as a LAN card, a modem, or the like. The communication section 1109 performs communication processing via a network such as the internet. A driver 1110 is also connected to the I/O interface 1105 as necessary. A removable medium 1111 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 1110 as necessary, so that a computer program read out therefrom is mounted into the storage section 1108 as necessary.

According to embodiments of the present disclosure, method flows according to embodiments of the present disclosure may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable storage medium, the computer program containing program code for performing the method illustrated by the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication portion 1109 and/or installed from the removable medium 1111. The computer program, when executed by the processor 1101, performs the above-described functions defined in the system of the embodiment of the present disclosure. The systems, devices, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

The present disclosure also provides a computer-readable storage medium, which may be contained in the apparatus/device/system described in the above embodiments; or may exist separately and not be assembled into the device/apparatus/system. The computer-readable storage medium carries one or more programs which, when executed, implement the method according to an embodiment of the disclosure.

According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. Examples may include, but are not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

For example, according to embodiments of the present disclosure, a computer-readable storage medium may include the ROM 1102 and/or the RAM 1103 and/or one or more memories other than the ROM 1102 and the RAM 1103 described above.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Those skilled in the art will appreciate that various combinations and/or combinations of features recited in the various embodiments and/or claims of the present disclosure can be made, even if such combinations or combinations are not expressly recited in the present disclosure. In particular, various combinations and/or combinations of the features recited in the various embodiments and/or claims of the present disclosure may be made without departing from the spirit or teaching of the present disclosure. All such combinations and/or associations are within the scope of the present disclosure.

The embodiments of the present disclosure have been described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described separately above, this does not mean that the measures in the embodiments cannot be used in advantageous combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be devised by those skilled in the art without departing from the scope of the present disclosure, and such alternatives and modifications are intended to be within the scope of the present disclosure.

Claims

1. A blacklist-based data feedback method, comprising:

acquiring delivery data and blacklist data, wherein the blacklist data is obtained by analyzing the delivery data received by a supervision mechanism every day;

matching the delivery data with the blacklist data to identify suspicious data in the delivery data;

reversely acquiring an application system generating the suspicious data based on the suspicious data;

and checking whether the transaction rule of the application system generating the suspicious data has a vulnerability.

2. The method of claim 1, wherein each of the submission data includes at least one source identification, and wherein the reverse-obtaining the application system that generated the suspect data based on the suspect data includes:

and inquiring a preset application system library based on the at least one source identifier to acquire application systems corresponding to the at least one source identifier.

3. The method of claim 1, wherein verifying whether the transaction rule that the application system generated the suspicious data has a vulnerability comprises:

acquiring a flow for generating the suspicious data and acquiring transaction rules of all steps of the flow;

and sequentially verifying each transaction rule and checking whether each transaction rule has a vulnerability.

4. The method of claim 1, the obtaining delivery data and blacklist data comprising:

respectively storing the submission data and the blacklist data in a first file and a second file according to the same preset storage rule;

the preset storage rule specifies the classification and block storage forms of the delivery data and the blacklist data.

5. The method of claim 4, the matching the delivery data with the blacklist data to identify suspect data in the delivery data comprising:

sequentially matching the data in the first file and the data in the second file according to data classification and blocking specified by the preset storage rule;

and recording the matched data in the first file and the second file as the suspicious data.

6. The method of claim 5, further comprising:

judging whether the size of the first file is larger than the preset file size or not;

when the size of the first file is larger than the preset file size, splitting the first file into a plurality of first subfiles, wherein the size of each first subfile is smaller than the preset file size.

7. The method of claim 6, further comprising:

and starting a plurality of threads, wherein each thread is used for processing the matching of one first subfile and the second file.

8. The method of claim 1, further comprising:

and when the transaction rule has a bug, repairing the transaction rule.

9. A blacklist-based data feedback device, comprising:

the data acquisition module is used for acquiring the submission data and the blacklist data;

the data matching module is used for matching the delivery data with the blacklist data so as to identify suspicious data in the delivery data;

a data feedback module for reversely acquiring an application system generating the suspicious data based on the suspicious data;

and the rule verification module is used for checking whether the transaction rule of the suspicious data generated by the application system has a vulnerability.

10. A computer system, comprising:

one or more processors;

a memory for storing one or more programs,

wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method of any of claims 1-8.

11. A computer readable storage medium having stored thereon executable instructions which, when executed by a processor, cause the processor to carry out the method of any one of claims 1 to 8.