CN113538071A

CN113538071A - Method and device for improving wind control strategy effect

Info

Publication number: CN113538071A
Application number: CN202111078045.7A
Authority: CN
Inventors: 杜威; 张晓科; 陈树华
Original assignee: Beijing Dingxiang Technology Co ltd
Current assignee: Beijing Dingxiang Technology Co ltd
Priority date: 2021-09-15
Filing date: 2021-09-15
Publication date: 2021-10-22
Anticipated expiration: 2041-09-15
Also published as: CN113538071B

Abstract

The invention discloses a method and a device for improving the effect of a wind control strategy, wherein the method comprises the following steps: s1, a wind control manufacturer summarizes a corresponding security policy set aiming at a specific security scene based on own cloud service and data accumulation, and synchronizes the security policy set to a privatized user environment; s2, synchronizing a data sample considered as leakage prevention to a cloud end by a privatized user, wherein the leakage prevention data sample is used as black sample data; s3, the cloud service receives black sample data pushed by the privatized version, and the black sample data is analyzed by using a model in combination with accumulated data of the cloud service to obtain a rule for intercepting the black sample; and S4, the privatized wind control service system synchronously updates the rule from the cloud end regularly. The method and the system can optimize the strategy by combining with each risk data, so that the strategy optimization of a specific scene can be maximized.

Description

Method and device for improving wind control strategy effect

Technical Field

The invention relates to the field of computers and network communication, in particular to a method and a device for improving the effect of a wind control strategy.

Background

In the field of business security, wind control manufacturers mostly provide a scheme of privatized deployment decision engines, and identify various online risks such as anti-fraud marketing, anti-fraud transaction and the like through security strategies. After a general system is on line, a manufacturer can configure a strategy into the system, perform cold start, and then perform strategy tuning according to the actual on-line situation. This approach has a drawback that policy optimization can only rely on the mining of self-owned business data, and the gray-black product is a strictly work-oriented organization, which is just like the global operational advantage.

In the field of business security at present, security manufacturers mainly deploy a system to a customer environment, then configure security policies on the system, and perform policy optimization according to actual conditions of the security manufacturers at a later stage. This approach is essentially a separate war, with each family having their own deposited but not shared summarized security policies. When a certain company on the internet is attacked by black and gray products, other manufacturers are difficult to know the specific attack condition and adjust own strategies in time.

For the situation, the scheme is based on the situation, and provides a scheme which can optimize the strategy by combining with each risk data. This scheme mainly provides one kind and leaks through collecting each family and prevent data, feeds back to the high in the clouds in time. And the cloud model retrains the training and issues the optimization strategy to the privatization platform.

Disclosure of Invention

Aiming at the problems in the prior art, the invention mainly aims at the service risk prevention and control of a specific scene, can simultaneously collect the defense missing samples of a plurality of privatized clients, collects black sample data at the cloud and trains regularly, synchronizes a new rule to privatization, can realize joint defense joint control, realizes strategy real-time sharing, and can maximize the strategy optimization of the specific scene.

The invention provides a method for improving the effect of a wind control strategy, which is characterized by comprising the following steps of:

s1, a wind control manufacturer summarizes a corresponding security policy set aiming at a specific security scene based on own cloud service and data accumulation, and synchronizes the security policy set to a privatized user environment;

s2, the privatization user synchronizes the data samples considered as leakage prevention to the cloud end, and the leakage prevention data samples are used as black sample data;

s3, the cloud service receives the black sample data pushed by the privatized version, and the black sample data is analyzed by using a model to obtain a rule for intercepting the black sample in combination with the accumulated data of the cloud service;

and S4, the privatized wind control service system synchronously updates the rule from the cloud end regularly.

Further, in step S1, the specific security scenario is marketing anti-fraud; the input data related to the security policy set comprises user basic information, marketing scenario information, equipment information and characteristics generated through calculation of a wind control service.

Further, in step S1, when the wind control manufacturer provides the wind control service to the customer, a privately deployed wind control system is adopted; after the privatization system is deployed, importing a security policy set corresponding to a wind control scene into the privatization system, wherein when the privatization deployed wind control system is used for preventing and controlling the corresponding scene, related scene participation and policy participation are completely consistent with cloud service; and calling an interface of the wind control service system by the business system to identify risks, wherein data required by the risk identification of the wind control service system is input data of the strategy set.

Further, in step S2, after the privatization system is online, the user may find corresponding log data in the log system on the privatization version and synchronize the log data to the cloud when the occurrence accuracy of the policy set is reduced and the situation of missing defense occurs; the method for positioning the leakage prevention data is that after a business system analyzes business data, a situation of pulling wool is found and a loss occurs, and then suspicious data can be marked in a wind control system and uploaded as a black data sample.

Further, leakage prevention includes the following cases: after a red packet is captured in a marketing campaign, the behavior that a plurality of irrelevant account numbers transfer the red packet to the same account number occurs, or after a large number of irrelevant account numbers capture preferential commodities, the addresses of express delivery are the same.

Further, in step S3, the cloud service receives data pushed by the privatized version, and analyzes the data by using a model in combination with accumulated data of its own cloud service, where the model is used to train the black samples that are missed in defense, the model is a decision tree model, the data pushed by the cloud service is trained by using the decision tree model, and a rule corresponding to the positioning of the black samples is obtained.

Furthermore, spark is used for training the decision tree model, the language is python, the training process comprises the steps of sorting and importing data and calling python spark related api for training, after the training of the decision tree model is finished, a decision tree path based on a black sample can be output, and the expression form is a rule; wherein the black samples are feedback data from a plurality of privatized deployment systems.

Further, in step S4, the new rule obtained through the periodic training is synchronized to the cloud service in an update package manner, and the privatization system may directly pull the updated rule to the local, and issue the rule to the online after being audited.

Furthermore, the mode of synchronizing the black sample data from the privatization system to the cloud end can be synchronized by one key on the system, and can also be manually uploaded to the cloud end; the updated rules are downloaded in the form of an update package and can be synchronized back to the privatization system.

In another aspect, the present invention provides an apparatus for improving the effect of a wind control policy, the apparatus being configured to implement the method according to the present invention, and the apparatus including an internet terminal, a business system, and a wind control service system.

The invention has the advantages that: the method includes the steps that leakage prevention data of each family are collected and fed back to a cloud end in time. And the cloud model retrains the training and issues the optimization strategy to the privatization platform. The original strategy is obtained by wind control manufacturers through accumulation based on self cloud services and is synchronized to a privatized client environment. And the privatized user synchronizes the data sample considered as leakage prevention to the cloud. The cloud obtains a rule for intercepting the black sample by using model training through the collected black sample data and combining self cloud service data. The target index is mainly accuracy rate and does not relate to recall rate. And the privatized wind control is used for updating the rule synchronously from the cloud end at regular intervals, so that the strategy optimization of a specific scene can be maximized.

Drawings

Fig. 1 is a schematic workflow diagram illustrating a method and an apparatus for improving the effect of a wind control strategy according to the present invention;

FIG. 2 illustrates a workflow diagram for privatizing deployment and synchronizing policies from the cloud into a privatizing system in accordance with the present invention;

fig. 3 shows a workflow diagram of leak-proof sample feedback and periodic synchronization of rules for leak prevention in the method for improving the effect of a wind control strategy according to the present invention.

Detailed Description

The technical solutions of the present invention will be described clearly and completely with reference to the accompanying drawings, and it should be understood that the described embodiments are some, but not all embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicate orientations or positional relationships based on the orientations or positional relationships shown in the drawings, and are only for convenience of description and simplicity of description, but do not indicate or imply that the device or element being referred to must have a particular orientation, be constructed and operated in a particular orientation, and thus, should not be construed as limiting the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance.

In the description of the present invention, it should be noted that, unless otherwise explicitly specified or limited, the terms "mounted," "connected," and "connected" are to be construed broadly, e.g., as meaning either a fixed connection, a removable connection, or an integral connection; can be mechanically or electrically connected; they may be connected directly or indirectly through intervening media, or they may be interconnected between two elements. The specific meanings of the above terms in the present invention can be understood by those skilled in the art according to specific situations.

The following detailed description of embodiments of the invention refers to the accompanying drawings. It should be understood that the detailed description and specific examples, while indicating the present invention, are given by way of illustration and explanation only, not limitation.

As shown in fig. 1, the method and apparatus for improving the effect of the wind control policy according to the present invention includes an internet terminal 1, a business system 2, and a wind control service system 3, and the method includes the following steps:

s1, wind control manufacturers mainly refer to anti-fraud marketing aiming at specific security scenes based on own cloud service and data accumulation, and summarize corresponding security strategy sets. The policy set refers to a combination of a series of rules, and the rules can be interpreted as a judgment of one attribute, such as account registration time less than 1 hour, number of related accounts on equipment >3, and number of accesses in the last day > 5. The input data related to the strategy set comprises user basic information, marketing scene information, equipment information, characteristics generated through calculation of a wind control service, such as recent access times and recent equipment associated data.

And when the wind control manufacturer provides wind control service to the customer, the wind control manufacturer adopts privatized deployment. The privatized deployment is a wind control system, wherein the system refers to java application and is deployed on a linux server. The system is started in a docker container mode, an http interface is provided for the outside, and the service system calls a wind control interface to perform risk identification. The risk identification is performed by operating a relevant rule strategy in the wind control system, and in the process, as shown in fig. 2, the cloud service of a wind control manufacturer performs privatized deployment and strategy initialization on a plurality of users (user 1, user 2, and the like).

After the system deployment is completed, the security policy corresponding to the wind control scenario is imported into the privatization system, for example, a policy set for anti-fraud marketing is imported. When the privately deployed wind control system corresponds to scene prevention and control, related scene and strategy participation must be completely consistent with cloud services. And the business system calls an interface of the wind control to identify risks, and the data required by the wind control to identify the risks is input data of the strategy set. The aforementioned basic user information, marketing scenario information, device information, characteristics calculated by the wind control service, such as the number of recent accesses, and recent device association data.

S2, after the client privatization system is on line, if the accuracy rate of the strategy is reduced, the situation of missing prevention occurs (the situation of missing prevention needs to be analyzed by combining business data afterwards, for example, after a red packet is caught in a marketing activity, the behavior that a plurality of irrelevant account numbers transfer the red packet to the same account number occurs, or after a large number of irrelevant account numbers catch preferential commodities, addresses of express delivery are the same). Here, the leakage prevention data is located, in combination with a service condition of a general method, for example, when a service system finds out that there is a situation of wool in play and a loss occurs after analyzing the service data, the suspicious data may be tagged in a wind control system, and a privatization version supports one-key synchronization of log data to a cloud, where risk data of leakage prevention is synchronized to the cloud (desensitization can be performed on data related to user sensitivity in a synchronization process) (desensitization can be performed on sensitive data, such as a mobile phone number, since the data needs to be synchronized to the cloud, in order to avoid a risk of data leakage, desensitization can be performed on the sensitive data, for example, md5 is performed on the data). As shown in fig. 3, multiple users (user 1, user 2, etc.) feed back the defense leakage sample to the wind controller cloud service (i.e., cloud), and the wind controller cloud service synchronizes the rules for the defense leakage periodically.

S3, the cloud service receives data pushed by the privatized version, and analyzes the data by using a model (the model is mainly a decision tree model) in combination with accumulated data of the cloud service, the model is mainly a decision tree model (the model refers to the decision tree model and trains the pushed data by using the decision tree model), the purpose of the model is mainly to train the black samples which are leaked and defended (the training of the model uses spark, the language is python, the training process comprises the steps of sorting and importing the data and calling the pythonspeark related api to train the data), and the rules for positioning the black samples are obtained (after the training of the decision tree model is completed, the decision tree path based on the black samples can be output, the expression form is the rules, such as the number of the recent associated accounts of the equipment in the registration time, the rules are consistent with the form of the rules provided by the wind control manufacturer, and the rules can be understood as the rules for providing initialization for the wind control manufacturer, the optimization of the following rules is that a wind control manufacturer collects a leakage prevention sample reported and fed back by a customer, and uses a decision tree model to perform analysis training to obtain a rule capable of finding the leakage prevention sample, wherein the black sample is feedback from a plurality of privatized deployment systems (the black sample is a leakage prevention case in the wind control system, and the wind control system is called, and the wind control can record the situation of each prevention and control. The specific data content is the input data of the aforementioned policy set). Therefore, a wider black sample data source can be collected in time, and the model is trained regularly to obtain a special leakage prevention rule for the black sample.

And S4, synchronizing the new rule obtained by periodic training to the cloud service in an updating packet mode, and directly pulling the updated rule to the local by the privatization system and issuing the updated rule to the online after auditing.

The invention can simultaneously collect the defense missing samples of a plurality of privatized clients for the business risk prevention and control of a specific scene, and can maximize the strategy optimization of the specific scene. The data synchronized from the privatization environment to the cloud end is generally black sample data, so that the data leakage risk can be greatly reduced. And the collection and the periodic training of the cloud end synchronize new rules to privatization, joint defense joint control can be achieved, and real-time strategy sharing is achieved.

The original strategy is obtained by wind control manufacturers through accumulation based on self cloud services and is synchronized to a privatized client environment. And the privatized user synchronizes the data sample considered as leakage prevention to the cloud. The cloud obtains a rule for intercepting the black sample by using model training through the collected black sample data and combining self cloud service data. The target index is mainly accuracy rate and does not relate to recall rate. And the privatized wind control is used for synchronously updating the rules from the cloud end again regularly.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

Claims

1. A method for improving the effect of a wind control strategy is characterized by comprising the following steps:

2. The method for improving the effect of a wind control strategy according to claim 1, wherein in step S1, the specific security scenario is marketing anti-fraud; the input data related to the security policy set comprises user basic information, marketing scenario information, equipment information and characteristics generated through calculation of a wind control service.

3. The method for improving the effect of the wind control strategy according to claim 2, wherein in step S1, when the wind control manufacturer provides the wind control service to the customer, a privately deployed wind control system is adopted; after the privatization system is deployed, importing a security policy set corresponding to a wind control scene into the privatization system, wherein when the privatization deployed wind control system is used for preventing and controlling the corresponding scene, related scene participation and policy participation are completely consistent with cloud service; and calling an interface of the wind control service system by the business system to identify risks, wherein data required by the risk identification of the wind control service system is input data of the strategy set.

4. The method for improving the effect of the wind control strategy according to claim 3, wherein in step S2, after the privatization system is online, the user can find corresponding log data in the log system on the privatization version and synchronize the log data to the cloud under the condition that the accuracy of the strategy set is reduced and the situation of missing prevention occurs; the method for positioning the leakage prevention data is that after a business system analyzes business data, a situation of pulling wool is found and a loss occurs, and then suspicious data can be marked in a wind control system and uploaded as a black data sample.

5. The method for improving the effect of a wind control strategy according to claim 4, wherein the leakage prevention comprises the following conditions: after a red packet is captured in a marketing campaign, the behavior that a plurality of irrelevant account numbers transfer the red packet to the same account number occurs, or after a large number of irrelevant account numbers capture preferential commodities, the addresses of express delivery are the same.

6. The method for improving the effect of the wind control strategy according to any one of claims 1 to 5, wherein in step S3, the cloud service receives data pushed by a privatized version, and analyzes the data by using a model in combination with accumulated data of its own cloud service, the model is used for training black samples for missing defense, the model is a decision tree model, the data pushed by the decision tree model is trained, and a rule corresponding to the positioning of the black samples is obtained.

7. The method for improving the effect of the wind control strategy according to claim 6, wherein spark is used for training the decision tree model, the language is python, the training process comprises data sorting, importing and pythonspeark related api calling for training, the decision tree model can output a decision tree path based on black samples after the training is completed, and the expression form is a rule; wherein the black samples are feedback data from a plurality of privatized deployment systems.

8. The method for improving the effect of the wind control strategy according to claim 7, wherein in step S4, the new rule obtained through periodic training is synchronized to the cloud service in an update package manner, and the privatization system can directly pull the updated rule to the local and publish the updated rule to the online after being audited.

9. The method for improving the effect of the wind control strategy according to any one of claims 1 to 5, wherein black sample data can be synchronized by one key on the system in a manner of synchronizing from the privatization system to the cloud, and can also be manually uploaded to the cloud; the updated rules are downloaded in the form of an update package and can be synchronized back to the privatization system.

10. An apparatus for enhancing the effect of a wind control strategy, wherein the apparatus is used for implementing the method according to any one of claims 1 to 9, and the apparatus comprises an internet terminal, a business system and a wind control service system.