CN114663096A

CN114663096A - Resource transfer risk identification method and device, computer equipment and storage medium

Info

Publication number: CN114663096A
Application number: CN202210283688.3A
Authority: CN
Inventors: 曹拓
Original assignee: Weikun Shanghai Technology Service Co Ltd
Current assignee: Weikun Shanghai Technology Service Co Ltd
Priority date: 2022-03-22
Filing date: 2022-03-22
Publication date: 2022-06-24

Abstract

The application relates to a data processing technology and provides a resource transfer risk identification method and device, computer equipment and a storage medium. The method comprises the following steps: receiving a target resource transfer request which is sent by a calling party device and carries a device fingerprint, target resource transfer data and a resource transfer token; verifying the target resource transfer request according to the device fingerprint and the resource transfer token; if the verification is passed, identifying the risk level of the target resource transfer request according to the target service rule data and the target resource transfer data; the target business rule data is configured according to a manual auditing result of the historical resource transfer request and a system auditing result; if the risk level is suspicious, sending a target resource transfer request to an auditing terminal, and receiving a target auditing result including the target risk level fed back by the auditing terminal; responding the target resource transfer request according to the target risk level; and updating the target business rule data according to the target auditing result. The method can improve the security of resource transfer.

Description

Resource transfer risk identification method and device, computer equipment and storage medium

Technical Field

The present application relates to the field of data processing technologies, and in particular, to a resource transfer risk identification method, apparatus, computer device, and storage medium.

Background

The online resource transfer is a basic support link of key industries such as e-commerce, finance and transaction, the risk control of the online resource transfer is always the key and difficult point for avoiding transaction risk and ensuring the security of payment transaction, and the online resource transfer is also a foundation for business development and preventing systematic risk. Currently, online identification of risk for resource transfer requests is typically based on business rules that are refined and defined by human beings based on known risks. However, the risk identification method is limited by known risks and personal experiences, so that the accuracy of the business rules is low, and therefore, when risk identification is performed based on the business rules with low accuracy, the problem of low accuracy exists, and the problem of low safety exists in online resource transfer.

Disclosure of Invention

In view of the foregoing, it is desirable to provide a resource transfer risk identification method, device, computer apparatus, and storage medium capable of improving resource transfer security.

A resource transfer risk identification method, the method comprising:

receiving a target resource transfer request sent by calling party equipment; the target resource transfer request carries the device fingerprint of the calling device, target resource transfer data and a resource transfer token; the resource transfer token is pre-assigned to the caller device based on the device fingerprint;

verifying the target resource transfer request according to the device fingerprint and the resource transfer token;

when the target resource transfer request passes the verification, identifying the risk level of the target resource transfer request according to the target resource transfer data according to pre-configured target service rule data; the target business rule data is configured in advance according to a manual auditing result and a system auditing result corresponding to the historical resource transfer request;

when the risk level of the target resource transfer request is identified to be suspicious, sending the target resource transfer request to an auditing terminal for manual auditing, and receiving a target auditing result correspondingly fed back by the auditing terminal; the target auditing result comprises a target risk level of the target resource transfer request;

responding the target resource transfer request according to the target risk level;

and updating the target business rule data according to the target auditing result.

In one embodiment, the step of pre-configuring the target business rule data includes:

acquiring a historical resource transfer request;

iteratively updating initialized candidate service rule data according to a manual auditing result and a system auditing result corresponding to the historical resource transfer request to obtain preconfigured target service rule data; and the system audit result is an audit result obtained by auditing the historical resource transfer request according to the candidate service rule data obtained by the previous iteration update.

In one embodiment, the historical resource transfer request includes historical resource transfer data; the step of iteratively updating the initialized candidate service rule data according to the manual auditing result and the system auditing result corresponding to the historical resource transfer request to obtain the pre-configured target service rule data comprises the following steps:

according to the initialized candidate service rule data, auditing the historical resource transfer request to obtain a corresponding system audit result; the system auditing result comprises a first risk level corresponding to the historical resource transferring request and a first feature label corresponding to each resource transferring feature in the historical resource transferring data;

sending the historical resource transfer request to an auditing terminal for manual auditing to obtain a corresponding manual auditing result; the manual review result comprises a second risk level corresponding to the historical resource transfer request and a second feature tag corresponding to each resource transfer feature;

and updating the candidate service rule data according to the system auditing result and the manual auditing result, returning to the candidate service rule data according to initialization, and continuously executing the step of auditing the historical resource transfer request to obtain the corresponding system auditing result until an iteration stop condition is met, wherein the updated candidate service rule data is used as the pre-configured target service rule data.

In one embodiment, the updating the candidate business rule data according to the system review result and the manual review result includes:

determining a label error rate corresponding to each resource transfer characteristic according to a first characteristic label and a second characteristic label corresponding to each resource transfer characteristic in each historical resource transfer data;

when the label error rate is larger than or equal to a first error rate, updating a characteristic label judgment parameter of a corresponding resource transfer characteristic in the candidate business rule data;

determining a risk level error rate according to a first risk level and a second risk level corresponding to each historical resource transfer request;

and when the risk level error rate is greater than or equal to a second error rate, updating a weight parameter corresponding to each resource transfer characteristic in the candidate business rule data.

In one embodiment, the determining a tag error rate corresponding to each resource transfer characteristic according to the first feature tag and the second feature tag corresponding to each resource transfer characteristic in each historical resource transfer data includes:

respectively matching a first characteristic label and a second characteristic label corresponding to each resource transfer characteristic in the historical resource transfer data to obtain a corresponding label matching result; the label matching result comprises matching success and matching failure;

clustering the label matching results corresponding to the resource transfer characteristics respectively to obtain the label matching success times and the label matching failure times corresponding to each resource transfer characteristic;

and respectively obtaining corresponding label error rates according to the label matching success times and the label matching failure times corresponding to the resource transfer characteristics.

In one embodiment, the target audit result further includes a target feature tag corresponding to each resource transfer feature in the target resource transfer data; the updating the target business rule data according to the target auditing result comprises the following steps:

updating the target business rule data according to the target risk level and the target feature labels corresponding to the target resource transfer features; or the like, or a combination thereof,

and sending the target auditing result, the target business rule data and the target resource transfer request to the auditing terminal, and updating the target business rule data according to the feedback data of the auditing terminal.

In one embodiment, the step of allocating the resource transfer token includes:

receiving a token acquisition request sent by calling party equipment; the token acquisition request carries an encrypted fingerprint obtained by asymmetrically encrypting the device fingerprint of the calling party device;

decrypting the encrypted fingerprint to obtain a decrypted fingerprint;

verifying the calling party equipment according to the decrypted fingerprint;

and when the verification is passed, generating and feeding back the resource transfer token.

A resource transfer risk identification apparatus, the apparatus comprising:

the receiving module is used for receiving a target resource transfer request sent by calling party equipment; the target resource transfer request carries the device fingerprint of the calling device, target resource transfer data and a resource transfer token; the resource transfer token is pre-assigned to the caller device based on the device fingerprint;

a verification module for verifying the target resource transfer request according to the device fingerprint and the resource transfer token;

the identification module is used for identifying the risk level of the target resource transfer request according to pre-configured target service rule data and the target resource transfer data when the target resource transfer request passes the verification; the target business rule data is configured in advance according to a manual auditing result and a system auditing result corresponding to the historical resource transfer request;

the identification module is further used for sending the target resource transfer request to an auditing terminal for manual auditing and receiving a target auditing result correspondingly fed back by the auditing terminal when the risk level of the target resource transfer request is identified as suspicious; the target auditing result comprises a target risk level of the target resource transfer request;

the response module is used for responding the target resource transfer request according to the target risk level;

and the updating module is used for updating the target business rule data according to the target auditing result.

A computer device comprising a memory storing a computer program and a processor implementing the steps in the method embodiments when the processor executes the computer program.

A computer storage medium on which a computer program is stored which, when being executed by a processor, carries out the steps of the method embodiments.

The resource transfer risk identification method, the device, the computer equipment and the storage medium are used for pre-configuring target service rule data with higher accuracy according to a manual audit result and a system audit result corresponding to a historical resource transfer request, verifying the target resource transfer request based on a resource transfer token and an equipment fingerprint in the target resource transfer request when risk identification needs to be carried out on online resource transfer operation so as to ensure the safety of online resource transfer, identifying the risk level of the target resource transfer request according to the target service rule data with higher accuracy and the target resource transfer data in the target resource transfer request when the verification is passed so as to further improve the safety of resource transfer, and further determining the target audit result corresponding to the target resource transfer request in a manual audit mode when the risk level of the target resource transfer request is identified as suspicious, and responding the target resource transfer request according to the target auditing result so as to further improve the security of resource transfer, and updating the target business rule data according to the target auditing result so as to further improve the accuracy of risk identification when identifying the risk level of the received target resource transfer request according to the updated target business rule data, thereby further improving the security of resource transfer.

Drawings

FIG. 1 is a diagram illustrating an exemplary scenario for implementing a resource transfer risk identification method;

FIG. 2 is a flowchart illustrating a resource transfer risk identification method according to an embodiment;

FIG. 3 is a flow diagram illustrating the steps of pre-configuring target business rule data in one embodiment;

FIG. 4 is a schematic diagram of a resource transfer risk identification method in one embodiment;

FIG. 5 is a block diagram of an apparatus for risk identification of resource transfer according to an embodiment;

FIG. 6 is a diagram illustrating an internal structure of a computer device according to an embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.

The resource transfer risk identification method provided by the application can be applied to the application environment shown in fig. 1. The caller device 102 and the audit terminal 104 are both in communication with the server 106 through a network. The server 106 receives a target resource transfer request sent by the caller device 102, verifies the target resource transfer request according to a device fingerprint and a resource transfer token in the target resource transfer request, identifies a risk level of the target resource transfer request according to pre-configured target business rule data and target resource transfer data in the target resource transfer request when the verification is passed, wherein the target business rule data is pre-configured according to a manual auditing result and a system auditing result corresponding to a historical resource transfer request, sends the target resource transfer request to the auditing terminal 104 for manual auditing when the risk level of the target resource transfer request is identified as suspicious, receives a target auditing result including a target risk level correspondingly fed back by the auditing terminal 104, and responds to the target resource transfer request according to the target risk level, and updating the target business rule data according to the target auditing result. The caller device 102 and the terminal 104 may be, but not limited to, various personal computers, laptops, smartphones, tablets and portable wearable devices, and the server 106 may be implemented by an independent server or a server cluster composed of a plurality of servers.

In one embodiment, as shown in fig. 2, a resource transfer risk identification method is provided, which is described by taking the method as an example applied to the server in fig. 1, and includes the following steps:

step 202, receiving a target resource transfer request sent by a caller device; the target resource transfer request carries the device fingerprint of the calling device, target resource transfer data and a resource transfer token; the resource transfer token is pre-assigned to the caller device based on the device fingerprint.

The target resource transfer request is a credential/basis for the caller device to request transfer of the resource, and may specifically include a device fingerprint of the caller device, target resource transfer data, and a resource transfer token. The device fingerprint is used for uniquely identifying the caller device, and specifically may be a hardware unique identifier of the caller device. The target resource transfer data comprises a plurality of resource transfer characteristics in resource transfer amount, a resource transfer-out account, a resource transfer-in account, a resource transfer-out user identifier, a resource transfer-in user identifier, a resource transfer-out item, resource transfer-out times, login times in a preset time period, retry times, a time interval, a network address of calling side equipment and the like. The resource transfer token is a pass for the caller device to request the resource transfer, and may be specifically assigned to the caller device by the server in advance based on the device fingerprint of the caller device.

Specifically, the server pre-allocates a resource transfer token to the caller device based on the device fingerprint of the caller device. When the caller device detects a resource transfer operation triggered by a user, the caller device acquires corresponding target resource transfer data, generates a target resource transfer request according to the acquired target resource transfer data, the device fingerprint of the caller device and the resource transfer token, and sends the generated target resource transfer request to the server. Accordingly, the server receives the target resource transfer request sent by the caller device.

Step 204, the target resource transfer request is verified according to the device fingerprint and the resource transfer token.

Specifically, the server analyzes the received target resource transfer request to obtain a device fingerprint, target resource transfer data and a resource transfer token of the caller device, locally queries a correspondingly stored resource transfer token according to the device fingerprint, and compares the queried resource transfer token with the analyzed resource transfer token to check the legality of the target resource transfer request, and when the device fingerprint and the resource transfer token are consistent, the check result of the target resource transfer request is judged to be passed, otherwise, the check result is judged to be failed.

In an embodiment, the server may further perform structural pattern recognition on the target resource transfer request to check the integrity of the target resource transfer request, and when it is determined that both the validity and the integrity of the target resource transfer request are checked, it is determined that the check result of the target resource transfer request is checked to be passed.

In one embodiment, when the target resource transfer request check fails, the server rejects/intercepts the target resource transfer request, records the target resource transfer request, and feeds back corresponding prompt information to the caller device. It will be appreciated that one or more of the fingerprint repository, blacklist and target business rule data may be updated in accordance with a recorded target resource transfer request.

Step 206, when the target resource transfer request passes the verification, identifying the risk level of the target resource transfer request according to the target resource transfer data according to the pre-configured target service rule data; and the target business rule data is configured in advance according to the manual auditing result and the system auditing result corresponding to the historical resource transfer request.

The target business rule data comprises feature label judgment parameters and weight parameters corresponding to the resource transfer features, and can also comprise score intervals corresponding to risk grades. The feature tag determination parameter is a basis for determining a feature tag corresponding to the resource transfer feature according to the feature value of the resource transfer feature. The feature score for the respective resource transfer feature can also be determined based on the feature tag decision parameter. The risk level includes high risk, low risk and suspicious, and the score interval corresponding to each of them can be customized, such as [0,50], (50,70) and [70,100], respectively.

For example, taking the resource transfer characteristic as the resource transfer amount as an example, the characteristic tag determination parameter includes: if the resource transfer amount is less than or equal to 5 ten thousand, the corresponding feature label and feature score are respectively low resource transfer and 100 points, if the resource transfer amount is greater than 5 ten thousand and less than or equal to 20 ten thousand, the corresponding feature label and feature score are respectively medium resource transfer and 80 points, if the resource transfer amount is greater than 20 ten thousand and less than or equal to 100 ten thousand, the corresponding feature label and feature score are respectively high resource transfer and 70 points, and if the resource transfer amount is greater than 100 ten thousand, the corresponding feature label and feature score are respectively ultrahigh resource transfer and 60 points.

Specifically, in the configuration stage of the business rule data, the server obtains a plurality of historical resource transfer requests, and configures in advance according to the manual review result and the system review result corresponding to each historical resource transfer request to obtain the target business rule data. In the practical application process of resource transfer risk identification, when the received target resource transfer request passes the verification, the server identifies the risk level of the target resource transfer request according to the target resource transfer data in the target resource transfer request according to the pre-configured target service rule data.

In one embodiment, the server determines, according to preconfigured target service rule data and according to target resource transfer data, a feature score corresponding to each resource transfer feature in the target resource transfer data, obtains a total score corresponding to the target resource transfer request according to a weight parameter and the feature score corresponding to each resource transfer feature, and determines a risk level corresponding to a score interval in which the total score is located as a risk level identified corresponding to the target resource transfer request.

Step 208, when the risk level of the target resource transfer request is identified to be suspicious, sending the target resource transfer request to an auditing terminal for manual auditing, and receiving a target auditing result correspondingly fed back by the auditing terminal; the target auditing result comprises a target risk level of the target resource transfer request.

The target auditing result is obtained by manually auditing target resource transfer data in the target resource transfer request, and comprises a target risk level of the target resource transfer request, and also comprises a target characteristic score and a target characteristic label corresponding to each resource transfer characteristic in the target resource transfer data.

Specifically, when the risk level of the target resource transfer request is identified as suspicious according to the target service rule data, it indicates that a response mode of the target resource transfer request cannot be determined based on the preconfigured target service rule data, that is, whether the target resource transfer request passes through or is rejected/intercepted cannot be determined, so that the server sends the target resource transfer request to an auditing terminal for manual auditing, and receives a target auditing result correspondingly fed back by the auditing terminal for the target resource transfer request.

In one embodiment, the risk level identified for the target resource transfer request according to the preconfigured target business rule data is used as a candidate risk level of the target resource transfer request. And if the candidate risk level is suspicious, the server determines the target risk level of the target resource transfer request in a manual review mode. And if the candidate risk level is high risk or low risk, the server determines the candidate risk level as a target risk level so as to respond to the target resource transfer request according to the target risk level.

Step 210, responding to the target resource transfer request according to the target risk level.

Specifically, if the target risk level is high risk, the server rejects/intercepts the target resource transfer request, and if the target risk level is low risk, the server passes the target resource transfer request. It is to be understood that if it is determined that the target resource transfer request passes based on the target risk level, the server performs the subsequent resource transfer process based on the target resource transfer request, or the server instructs the other computer device to perform the subsequent resource transfer process based on the target resource transfer request, and the other computer device is the computer device for performing the resource transfer process.

And step 212, updating the target business rule data according to the target auditing result.

Specifically, the server can automatically learn and perfect the preconfigured target business rule data according to the target auditing result and the target resource transfer data. The server can also send the target auditing result, the target service rule data and the target resource transfer request to the auditing terminal, and update the target service rule data according to the feedback data of the auditing terminal.

The resource transfer risk identification method is characterized in that target business rule data with higher accuracy are obtained in advance according to a manual audit result and a system audit result corresponding to a historical resource transfer request, when risk identification is required to be carried out on online resource transfer operation, the target resource transfer request is verified based on a resource transfer token and a device fingerprint in the target resource transfer request so as to ensure the safety of online resource transfer, when the verification is passed, the risk level of the target resource transfer request is identified according to the target resource transfer data in the target resource transfer request according to the target business rule data with higher accuracy so as to further improve the safety of resource transfer, when the risk level of the target resource transfer request is identified to be suspicious, the target audit result corresponding to the target resource transfer request is further determined in a manual audit mode, and responding the target resource transfer request according to the target auditing result so as to further improve the security of resource transfer, and updating the target business rule data according to the target auditing result so as to further improve the accuracy of risk identification when identifying the risk level of the received target resource transfer request according to the updated target business rule data, thereby further improving the security of resource transfer.

In one embodiment, the step of pre-configuring the target business rule data comprises: acquiring a historical resource transfer request; iteratively updating the initialized candidate service rule data according to the manual auditing result and the system auditing result corresponding to the historical resource transfer request to obtain pre-configured target service rule data; the system auditing result is obtained by auditing the historical resource transfer request according to the candidate service rule data obtained by previous iteration updating.

In one embodiment, the server obtains a plurality of sample resource transfer requests, verifies the corresponding sample resource transfer request according to the device fingerprint and the resource transfer token in each sample resource transfer request, and screens the historical resource transfer request passing the verification from the sample resource transfer requests according to the verification result.

In the above embodiment, the initialized candidate business rule data is updated iteratively according to the manual audit result and the system audit result corresponding to the historical resource transfer request, so that the target business rule data is obtained by rapid and accurate pre-configuration, and the accuracy of risk identification can be improved when resource transfer risk identification is performed based on the target business rule data.

In one embodiment, the historical resource transfer request includes historical resource transfer data; iteratively updating the initialized candidate service rule data according to the manual auditing result and the system auditing result corresponding to the historical resource transfer request to obtain preconfigured target service rule data, wherein the method comprises the following steps: according to the initialized candidate service rule data, auditing the historical resource transfer request to obtain a corresponding system audit result; the system auditing result comprises a first risk level corresponding to the historical resource transferring request and a first characteristic label corresponding to each resource transferring characteristic in the historical resource transferring data; sending the historical resource transfer request to an auditing terminal for manual auditing to obtain a corresponding manual auditing result; the manual review result comprises a second risk level corresponding to the historical resource transfer request and a second feature label corresponding to each resource transfer feature; and updating the candidate service rule data according to the system audit result and the manual audit result, returning to the step of auditing the historical resource transfer request according to the initialized candidate service rule data to obtain the corresponding system audit result, continuing to execute the step until the iteration stop condition is met, and taking the updated candidate service rule data as the pre-configured target service rule data.

In particular, the historical resource transfer request includes historical resource transfer data. In the process of updating initialized candidate service rule data in an iteration mode, the server audits each historical resource transfer request according to the candidate service rule data obtained by previous iteration updating to obtain a corresponding system audit result, and sends each historical resource transfer request to an audit terminal to audit to obtain a corresponding manual audit result, wherein the system audit result comprises a first risk level corresponding to the historical resource transfer request and a first feature tag corresponding to each resource transfer feature in the historical resource transfer data, and the manual audit result comprises a second risk level corresponding to the historical resource transfer request and a second feature tag corresponding to each resource transfer feature.

And further, updating candidate business rule data according to the first risk grade and the first characteristic label in each system audit result and the second risk grade and the second characteristic label in each manual audit result, if the iteration stop condition is met, taking the updated candidate business rule data as target business rule data to be pre-configured locally, if the iteration stop condition is not met, returning to the candidate business rule data obtained according to the previous iteration update, and continuously executing the step of auditing each historical resource transfer request to obtain the corresponding system audit result until the iteration stop condition is met. It can be understood that, in the first iteration process, the server performs auditing on each historical resource transfer request based on the initialized candidate service rule data to obtain a corresponding system auditing result.

In an embodiment, the server may automatically learn and update the candidate service rule data according to the system audit result and the manual audit result corresponding to each historical resource transfer request, or may send the system audit result and the manual audit result corresponding to each historical resource transfer request to the audit terminal, and update the candidate service rule data according to the feedback data of the audit terminal.

In the above embodiment, the candidate business rule data obtained by the previous iteration update is updated according to the second risk level and the second feature tag in each manual audit result and the first risk level and the first feature tag in each system audit result, so as to quickly and accurately obtain the target business rule data, so that when resource transfer risk identification is performed based on the target business rule data, accuracy of risk identification can be improved.

In one embodiment, updating candidate business rule data according to the system audit result and the manual audit result includes: determining a label error rate corresponding to each resource transfer characteristic according to a first characteristic label and a second characteristic label corresponding to each resource transfer characteristic in each historical resource transfer data; when the label error rate is larger than or equal to the first error rate, updating the characteristic label judgment parameters of the corresponding resource transfer characteristics in the candidate business rule data; determining a risk level error rate according to a first risk level and a second risk level corresponding to each historical resource transfer request; and when the risk level error rate is greater than or equal to the second error rate, updating the weight parameters corresponding to the resource transfer characteristics in the candidate business rule data.

Wherein the iteration stop condition comprises that the tag error rate is less than the first error rate and the risk level error rate is less than the second error rate. The label error rate is used for representing the matching degree between the second feature label determined by manual review and the corresponding first feature label determined by system review, namely, the matching degree is used for representing the accuracy of the corresponding feature label judgment parameter in the candidate service rule data obtained by previous iteration updating, and the lower the label error rate of the resource transfer feature is, the higher the accuracy of the corresponding feature label judgment parameter in the candidate service rule data obtained by previous iteration updating of the resource transfer feature is. The risk level error rate is used for representing the matching degree between the second risk level determined by manual review and the corresponding first risk level determined by system review, namely for representing the accuracy of each weight parameter in the candidate service rule data obtained by previous iteration update, and the lower the risk level error rate is, the higher the accuracy of the corresponding weight parameter in the candidate service rule data obtained by previous iteration update of each resource transfer characteristic is.

In one embodiment, if the tag error rate of the resource transfer feature is less than the first error rate, the feature tag determination parameter corresponding to the resource transfer feature is kept unchanged, and if the risk level error rate is less than the second error rate, the weight parameter corresponding to each resource transfer feature is kept unchanged. And when the label error rate is smaller than the first error rate and the risk level error rate is smaller than the second error rate, judging that the iteration stop condition is met, and obtaining a target business rule parameter according to the feature label judgment parameter and the weight parameter corresponding to each resource transfer feature obtained by current iteration updating and the score interval corresponding to each risk level.

In the above embodiment, if the tag error rate corresponding to the resource transfer feature is greater than or equal to the first error rate, the feature tag determination parameter corresponding to the resource transfer feature in the candidate service rule data is updated, and if the risk level error rate is greater than or equal to the second error rate, the weight parameter corresponding to each resource transfer feature in the candidate service rule data is updated to obtain updated candidate service rule data, and each historical resource transfer request is re-checked according to the updated candidate service rule data until the tag error rate is less than the first error rate and the risk level error rate is less than the second error rate, and the iteration is stopped to obtain the preconfigured target service rule data.

In one embodiment, determining a tag error rate corresponding to each resource transfer feature according to a first feature tag and a second feature tag corresponding to each resource transfer feature in each historical resource transfer data includes: respectively matching a first characteristic label and a second characteristic label corresponding to each resource transfer characteristic in each historical resource transfer data to obtain a corresponding label matching result; the label matching result comprises matching success and matching failure; clustering the label matching results corresponding to the resource transfer characteristics respectively to obtain the label matching success times and the label matching failure times corresponding to the resource transfer characteristics; and respectively obtaining corresponding label error rates according to the label matching success times and the label matching failure times corresponding to the resource transfer characteristics.

Specifically, for the historical resource transfer data in each historical resource transfer request, the server matches the first feature tag and the second feature tag corresponding to each resource transfer feature, if the first feature tag and the second feature tag are matched, the matching result of the corresponding tag is determined to be successful, and if the first feature tag and the second feature tag are not matched, the matching result of the corresponding tag is determined to be failed. Further, for each resource transfer characteristic, the server clusters the corresponding label matching results of the resource transfer characteristic under each historical resource transfer request to obtain cluster clusters with matching success and matching failure respectively, counts the number of the label matching results in each cluster to obtain the number of label matching success and label matching failure corresponding to the resource transfer characteristic, sums the number of label matching success and label matching failure corresponding to the resource transfer characteristic to obtain the total number of label matching results, and divides the number of label matching failure by the total number of label matching results to obtain the corresponding label error rate.

In the above embodiment, the resource transfer characteristics are taken as a unit, and the corresponding tag error rates are obtained by clustering based on the first feature tags and the second feature tags corresponding to the resource transfer characteristics in the historical resource transfer data, so as to update the corresponding feature tag determination parameters in the candidate business rule data based on the tag error rates.

In one embodiment, the target auditing result further includes a target feature tag corresponding to each resource transfer feature in the target resource transfer data; step 212, comprising: updating target business rule data according to target feature labels corresponding to the target risk levels and the target resource transfer features; or, the target auditing result, the target business rule data and the target resource transfer request are sent to the auditing terminal, and the target business rule data are updated according to the feedback data of the auditing terminal.

Specifically, the target auditing result includes a target risk level corresponding to the target resource transfer request and a target feature tag corresponding to each resource transfer feature in the target resource transfer data. The server can automatically learn and update the pre-configured target business rule data according to the target risk level of the target resource transfer request and the target feature labels corresponding to the resource transfer features in the target resource transfer data. The server can also send the target auditing result, the preconfigured target service rule data and the target resource transfer request to the auditing terminal, and update the locally preconfigured target service rule data according to the feedback data of the auditing terminal. It is to be understood that the feedback data may be updated target business rule data, and may also be updated business rule parameters (feature tag decision parameters and/or weight parameters) in the target business rule data.

In one embodiment, the server records the target auditing results and the corresponding target resource transfer requests in local, counts the number of the target resource transfer requests recorded in local, and updates the target business rule data based on the target resource transfer requests recorded in local and the target auditing results recorded in corresponding when the counted number is greater than or equal to a preset number. Specifically, the server can automatically update the target service rule data according to the locally recorded target resource transfer request and the corresponding target audit result, and can also send the locally recorded target resource transfer request and the corresponding target audit result to the audit terminal, and update the target service rule data according to the feedback data of the audit terminal.

In the above embodiment, the preconfigured target service rule data is dynamically updated according to the target auditing result corresponding to the target resource transfer request, so that when resource transfer risk identification is performed based on the updated target service rule data, accuracy of risk identification can be improved.

In one embodiment, the step of allocating the resource transfer token comprises: receiving a token acquisition request sent by calling party equipment; the token acquisition request carries an encrypted fingerprint obtained by asymmetrically encrypting the device fingerprint of the calling party device; decrypting the decrypted fingerprint to obtain a decrypted fingerprint; verifying the calling party equipment according to the encrypted fingerprint; and when the verification is passed, generating and feeding back the resource transfer token.

The encrypted fingerprint is obtained by asymmetrically encrypting the device fingerprint of the caller device through an asymmetric encryption algorithm, which includes but is not limited to RSA _ SHA 256. The resource transfer token may be a random number or may be data dynamically generated based on the device fingerprint.

Specifically, the caller device encrypts a device fingerprint of the caller device through an asymmetric encryption algorithm to obtain an encrypted fingerprint, generates a token acquisition request carrying the encrypted fingerprint, and sends the generated token acquisition request to the server. The server receives a token acquisition request sent by the caller equipment, analyzes the token acquisition request to obtain an encrypted fingerprint, decrypts the encrypted fingerprint to obtain a decrypted fingerprint, verifies the authority of the caller equipment according to the decrypted fingerprint, generates a resource transfer token when the authority verification passes, and sends the generated resource transfer token to the caller equipment. It will be appreciated that the server also stores the resource transfer token locally in correspondence with the device fingerprint of the caller device.

In one embodiment, the server matches the decrypted fingerprint with a device fingerprint in a pre-configured fingerprint library, and if the device fingerprint matched with the decrypted fingerprint exists in the fingerprint library, the authority verification of the calling device is judged to be passed. The fingerprint library includes device fingerprints of caller devices with legal call permissions.

In one embodiment, the server matches the decrypted fingerprint with the device fingerprint in the blacklist, and if the decrypted fingerprint is matched with any device fingerprint in the blacklist, it is determined that the caller device does not have a legal call permission, and a resource transfer token is not allocated to the caller device, so that target resource transfer requests initiated based on the caller device are intercepted, and therefore, the security of resource transfer can be improved.

In the above embodiment, the authority of the caller device is verified based on the device fingerprint of the caller device, the resource transfer token is allocated to the caller device that passes the verification, and the resource transfer token is not allocated to the caller device that fails the verification, so that the security of resource transfer can be improved.

Fig. 3 is a step of pre-configuration of target traffic rule data in one embodiment. Referring to fig. 3, the step of pre-configuring the target service rule data specifically includes the following steps:

step 302, obtaining a history resource transfer request; the historical resource transfer request includes historical resource transfer data.

Step 304, according to the initialized candidate service rule data, auditing the historical resource transfer request to obtain a corresponding system audit result; the system auditing result comprises a first risk level corresponding to the historical resource transferring request and a first feature label corresponding to each resource transferring feature in the historical resource transferring data.

Step 306, sending the historical resource transfer request to an auditing terminal for manual auditing to obtain a corresponding manual auditing result; the manual review result comprises a second risk level corresponding to the historical resource transfer request and a second feature label corresponding to each resource transfer feature.

Step 308, matching the first feature tag and the second feature tag corresponding to each resource transfer feature in each historical resource transfer data respectively to obtain corresponding tag matching results; the label matching result comprises matching success and matching failure.

And 310, clustering the label matching results corresponding to the resource transfer characteristics respectively to obtain the label matching success times and the label matching failure times corresponding to each resource transfer characteristic.

And step 312, obtaining corresponding label error rates respectively according to the label matching success times and the label matching failure times corresponding to the resource transfer characteristics.

In step 314, when the tag error rate is greater than or equal to the first error rate, the feature tag determination parameter of the corresponding resource transfer feature in the candidate business rule data is updated.

And step 316, determining a risk level error rate according to the first risk level and the second risk level corresponding to each historical resource transfer request.

Step 318, when the risk level error rate is greater than or equal to the second error rate, updating the weight parameter corresponding to each resource transfer characteristic in the candidate service rule data.

And returning to the step 304 to continue the execution until the label error rate is less than the first error rate and the risk level error rate is less than the second error rate, and taking the updated candidate business rule data as the pre-configured target business rule data.

In the embodiment, the target business rule data is extracted and configured in a mode of combining the artificial intelligence algorithm and the artificial auditing, so that the configuration efficiency and accuracy of the target business rule data can be improved, the configuration time can be saved, and the configuration accuracy can be improved.

It can be understood that, in one or more embodiments of the present application, in each iterative update process, the corresponding feature tag determination parameter may be updated according to a tag error rate corresponding to each resource transfer feature, and the weight parameter corresponding to each resource transfer feature may be updated synchronously according to a risk level error rate, or after the tag error rates corresponding to all resource transfer features are greater than a first error rate through an iterative update mode, the weight parameter corresponding to each resource transfer feature may be updated synchronously according to the risk level error rate.

FIG. 4 is a schematic diagram illustrating a resource transfer risk identification method according to an embodiment. Referring to fig. 4, a token obtaining request carrying an encrypted fingerprint is obtained, the encrypted fingerprint is obtained by asymmetrically encrypting a device fingerprint of a caller device, the authority of the caller device is verified based on the encrypted fingerprint, if the authority passes the verification, a resource transfer token is fed back, a target resource transfer request carrying the device fingerprint, the resource transfer token and target resource transfer data sent by the caller device is received, the validity and integrity of the target resource transfer request are verified, if the authority fails the verification, a risk record (the target resource transfer request which fails the verification) is recorded, prompt information is fed back to the caller device to prompt a user, if the authority passes the verification, a candidate feature tag corresponding to each resource transfer feature in the target resource transfer data is determined based on a feature tag determination parameter in the target service rule data, a weight parameter based on each candidate feature tag and each resource transfer feature in the target service rule data is determined, determining the total value of the target resource transfer request, judging the risk level of the target resource transfer request based on the total value, if the risk level is low risk, passing the target resource transfer request, if the risk level is high risk, rejecting the target resource transfer request, if the risk level is suspicious, sending the target resource transfer request to an auditing terminal for manual auditing, receiving a target auditing result fed back by the auditing terminal, responding to the target resource transfer request according to the target risk level in the target auditing result, and updating target business rule data according to the target auditing result.

It can be understood that, in the above embodiment, the server may also store/record the target resource transfer request and the corresponding target audit result in a local location, and determine whether to update the target service rule data based on the locally recorded target resource transfer request number, if the locally recorded target resource transfer request number is greater than the preset number, update the target service rule data, otherwise, maintain the target service rule data unchanged.

In one embodiment, the operations performed by the caller device in one or more embodiments of the present application may be performed by a client running on the caller device, and the client may specifically be implemented by an SDK (software development kit).

It should be understood that although the various steps in the flow diagrams of fig. 2-4 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least some of the steps in fig. 2-4 may include multiple sub-steps or multiple stages that are not necessarily performed at the same time, but may be performed at different times, and the order of performance of the sub-steps or stages is not necessarily sequential, but may be performed in turn or alternating with other steps or at least some of the sub-steps or stages of other steps.

In one embodiment, as shown in fig. 5, there is provided a resource transfer risk identification apparatus 500, including: a receiving module 501, a checking module 502, an identifying module 503, a responding module 504 and an updating module 505, wherein:

a receiving module 501, configured to receive a target resource transfer request sent by a caller device; the target resource transfer request carries a device fingerprint of the calling device, target resource transfer data and a resource transfer token; the resource transfer token is pre-assigned to the caller device based on the device fingerprint;

a verification module 502, configured to verify the target resource transfer request according to the device fingerprint and the resource transfer token;

the identifying module 503 is configured to identify a risk level of the target resource transfer request according to the target resource transfer data and according to the preconfigured target service rule data when the target resource transfer request passes the verification; target business rule data are configured in advance according to a manual auditing result and a system auditing result corresponding to the historical resource transfer request;

the identification module 503 is further configured to send the target resource transfer request to an audit terminal for manual audit when the risk level of the target resource transfer request is identified as suspicious, and receive a target audit result correspondingly fed back by the audit terminal; the target auditing result comprises a target risk level of the target resource transfer request;

a response module 504, configured to respond to the target resource transfer request according to the target risk level;

and the updating module 505 is configured to update the target business rule data according to the target auditing result.

In an embodiment, the resource transfer risk identification apparatus 500 further includes a configuration module, configured to obtain a historical resource transfer request; iteratively updating the initialized candidate service rule data according to the manual auditing result and the system auditing result corresponding to the historical resource transfer request to obtain pre-configured target service rule data; and the system audit result is an audit result obtained by auditing the historical resource transfer request according to the candidate service rule data obtained by the previous iteration update.

In one embodiment, the historical resource transfer request includes historical resource transfer data; the configuration module is further used for auditing the historical resource transfer request according to the initialized candidate service rule data to obtain a corresponding system audit result; the system auditing result comprises a first risk level corresponding to the historical resource transferring request and a first characteristic label corresponding to each resource transferring characteristic in the historical resource transferring data; sending the historical resource transfer request to an auditing terminal for manual auditing to obtain a corresponding manual auditing result; the manual review result comprises a second risk level corresponding to the historical resource transfer request and a second feature label corresponding to each resource transfer feature; and updating the candidate service rule data according to the system audit result and the manual audit result, returning to the initialized candidate service rule data, auditing the historical resource transfer request to obtain a corresponding system audit result until the iteration stop condition is met, and taking the updated candidate service rule data as the pre-configured target service rule data.

In one embodiment, the configuration module is further configured to determine a tag error rate corresponding to each resource transfer characteristic according to a first feature tag and a second feature tag corresponding to each resource transfer characteristic in each historical resource transfer data; when the label error rate is larger than or equal to the first error rate, updating the characteristic label judgment parameters of the corresponding resource transfer characteristics in the candidate business rule data; determining a risk level error rate according to a first risk level and a second risk level corresponding to each historical resource transfer request; and when the risk level error rate is greater than or equal to the second error rate, updating the weight parameters corresponding to the resource transfer characteristics in the candidate business rule data.

In one embodiment, the configuration module is further configured to match a first feature tag and a second feature tag corresponding to each resource transfer feature in each historical resource transfer data, respectively, to obtain a corresponding tag matching result; the label matching result comprises matching success and matching failure; clustering the label matching results corresponding to the resource transfer characteristics respectively to obtain the label matching success times and the label matching failure times corresponding to the resource transfer characteristics; and respectively obtaining corresponding label error rates according to the label matching success times and the label matching failure times corresponding to the resource transfer characteristics.

In one embodiment, the updating module 505 is further configured to update the target business rule data according to the target feature tags corresponding to the target risk levels and the target resource transfer features; or, the target auditing result, the target business rule data and the target resource transfer request are sent to the auditing terminal, and the target business rule data are updated according to the feedback data of the auditing terminal.

In an embodiment, the receiving module 501 is further configured to receive a token obtaining request sent by a caller device; the token acquisition request carries an encrypted fingerprint obtained by asymmetrically encrypting the device fingerprint of the calling party device; decrypting the encrypted fingerprint to obtain a decrypted fingerprint; verifying the calling party equipment according to the decrypted fingerprint; and when the verification is passed, generating and feeding back the resource transfer token.

For specific limitations of the resource transfer risk identification device, reference may be made to the above limitations of the resource transfer risk identification method, which are not described herein again. The modules in the resource transfer risk identification device can be wholly or partially implemented by software, hardware and a combination thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.

In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as shown in fig. 6. The computer device includes a processor, a memory, a network interface, and a database connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operating system and the computer program to run on the non-volatile storage medium. The database of the computer device is used for storing pre-configured target business rule data. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a resource transfer risk identification method.

Those skilled in the art will appreciate that the architecture shown in fig. 6 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.

In one embodiment, a computer device is provided comprising a memory storing a computer program and a processor implementing the steps in the method embodiments when the processor executes the computer program.

In one embodiment, a computer storage medium is provided, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method embodiments.

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

All possible combinations of the technical features in the above embodiments may not be described for the sake of brevity, but should be considered as being within the scope of the present disclosure as long as there is no contradiction between the combinations of the technical features.

The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent application shall be subject to the appended claims.

Claims

1. A resource transfer risk identification method, the method comprising:

2. The method of claim 1, wherein the step of pre-configuring the target traffic rule data comprises:

acquiring a historical resource transfer request;

iteratively updating initialized candidate service rule data according to a manual auditing result and a system auditing result corresponding to the historical resource transfer request to obtain preconfigured target service rule data; and the system auditing result is obtained by auditing the historical resource transfer request according to the candidate service rule data obtained by previous iteration updating.

3. The method of claim 2, wherein the historical resource transfer request comprises historical resource transfer data; the iteratively updating the initialized candidate service rule data according to the manual audit result and the system audit result corresponding to the historical resource transfer request to obtain the preconfigured target service rule data includes:

and updating the candidate service rule data according to the system audit result and the manual audit result, returning to the initialized candidate service rule data, and continuously executing the step of auditing the historical resource transfer request to obtain a corresponding system audit result until an iteration stop condition is met, and taking the updated candidate service rule data as pre-configured target service rule data.

4. The method of claim 3, wherein updating the candidate business rule data according to the system review result and the manual review result comprises:

5. The method of claim 4, wherein determining a tag error rate for each resource transfer characteristic based on the first and second feature tags for each resource transfer characteristic in each historical resource transfer data comprises:

6. The method according to any one of claims 1 to 5, wherein the target audit result further includes a target feature tag corresponding to each resource transfer feature in the target resource transfer data; the updating the target business rule data according to the target auditing result comprises the following steps:

updating the target business rule data according to the target risk level and the target feature labels corresponding to the target resource transfer features; or the like, or, alternatively,

7. The method of claim 6, wherein the step of allocating the resource transfer token comprises:

decrypting the encrypted fingerprint to obtain a decrypted fingerprint;

verifying the caller equipment according to the decrypted fingerprint;

8. An apparatus for identifying risk of resource transfer, the apparatus comprising:

the identification module is used for identifying the risk level of the target resource transfer request according to the target resource transfer data and pre-configured target service rule data when the target resource transfer request passes the verification; the target business rule data is configured in advance according to a manual auditing result and a system auditing result corresponding to the historical resource transfer request;

9. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor, when executing the computer program, implements the steps of the method of any of claims 1 to 7.

10. A computer storage medium on which a computer program is stored, characterized in that the computer program, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 7.