CN116523289A - Real-time wind control method and system based on intelligent threshold and rule engine - Google Patents
Real-time wind control method and system based on intelligent threshold and rule engine Download PDFInfo
- Publication number
- CN116523289A CN116523289A CN202211719453.0A CN202211719453A CN116523289A CN 116523289 A CN116523289 A CN 116523289A CN 202211719453 A CN202211719453 A CN 202211719453A CN 116523289 A CN116523289 A CN 116523289A
- Authority
- CN
- China
- Prior art keywords
- behavior
- individual
- threshold
- data
- user
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 56
- 230000006399 behavior Effects 0.000 claims abstract description 188
- 230000002159 abnormal effect Effects 0.000 claims abstract description 20
- 238000011156 evaluation Methods 0.000 claims abstract description 14
- 238000004422 calculation algorithm Methods 0.000 claims description 15
- 238000005065 mining Methods 0.000 claims description 12
- 230000014509 gene expression Effects 0.000 claims description 11
- 230000002265 prevention Effects 0.000 claims description 6
- 238000010586 diagram Methods 0.000 description 11
- 230000007246 mechanism Effects 0.000 description 10
- 238000004590 computer program Methods 0.000 description 7
- 238000012545 processing Methods 0.000 description 7
- 238000012549 training Methods 0.000 description 6
- 230000006870 function Effects 0.000 description 5
- 238000012986 modification Methods 0.000 description 4
- 230000004048 modification Effects 0.000 description 4
- 238000007405 data analysis Methods 0.000 description 3
- 238000007726 management method Methods 0.000 description 3
- 230000008569 process Effects 0.000 description 3
- 238000003860 storage Methods 0.000 description 3
- 238000012935 Averaging Methods 0.000 description 2
- 238000012300 Sequence Analysis Methods 0.000 description 2
- 230000004075 alteration Effects 0.000 description 2
- 238000013145 classification model Methods 0.000 description 2
- 238000002790 cross-validation Methods 0.000 description 2
- 238000012954 risk control Methods 0.000 description 2
- 238000012216 screening Methods 0.000 description 2
- 101100295776 Drosophila melanogaster onecut gene Proteins 0.000 description 1
- 238000012550 audit Methods 0.000 description 1
- 230000003542 behavioural effect Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000007621 cluster analysis Methods 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000011217 control strategy Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000007613 environmental effect Effects 0.000 description 1
- 238000009499 grossing Methods 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 238000002372 labelling Methods 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000007637 random forest analysis Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000005728 strengthening Methods 0.000 description 1
- 230000001360 synchronised effect Effects 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0635—Risk analysis of enterprise or organisation activities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0639—Performance analysis of employees; Performance analysis of enterprise or organisation operations
- G06Q10/06393—Score-carding, benchmarking or key performance indicator [KPI] analysis
Landscapes
- Business, Economics & Management (AREA)
- Human Resources & Organizations (AREA)
- Engineering & Computer Science (AREA)
- Strategic Management (AREA)
- Entrepreneurship & Innovation (AREA)
- Economics (AREA)
- Development Economics (AREA)
- Educational Administration (AREA)
- Operations Research (AREA)
- Marketing (AREA)
- Game Theory and Decision Science (AREA)
- Quality & Reliability (AREA)
- Tourism & Hospitality (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention discloses a real-time wind control method and a system based on an intelligent threshold and a rule engine, which are used for acquiring initial data; based on the initial data, constructing a user behavior representation, comprising: individual behavior portraits and group behavior portraits; setting a label for the user behavior portrait; based on the threshold evaluation system and the historical data, calculating a future prediction threshold of the wind control index; performing real-time wind control through the user behavior portraits, comparing the labels of the individual behavior portraits with the labels of the group behavior portraits, judging that the individual behaviors are abnormal when the difference between the labels of the individual behavior portraits and the labels of the group behavior portraits exceeds a threshold value, and performing risk grading on the individual behaviors based on a preset rule engine; and performing off-line wind control through the operation behavior data of the individual, comparing the operation behavior data of the individual with a corresponding future prediction threshold, and judging that the individual behavior is abnormal when the operation behavior data of the individual exceeds the future prediction threshold.
Description
Technical Field
The invention relates to the technical field of business risk control, in particular to a method and a system for real-time wind control based on intelligent threshold and rule engine.
Background
Based on the early warning of the threshold value, operation and maintenance personnel or wind control post service personnel are required to set the threshold value by themselves according to knowledge and experience of the service field and knowledge of service performance, but in practice, certain knowledge limitation exists in the threshold value, and reasonable prediction of the threshold value cannot always be achieved.
In the prior art, (application number: 202010586787X) provides a method and a system for realizing structured wind control based on a stream computing engine, and the wind control service realization model is open and structured, so that the service realization difficulty is reduced, and the method and the system are beneficial to enabling service personnel unfamiliar with programming to participate in the realization of the wind control service more deeply. The prior art is based on a stream computing engine CEP, and is executed by a CEP rule engine through writing a SQL-like script language so as to complete the computation control of various wind control indexes.
However, the prior art cannot objectively and accurately prevent and control various business risks.
Disclosure of Invention
The technical scheme of the invention provides a real-time wind control method and a real-time wind control system based on an intelligent threshold and a rule engine, which are used for solving the problem of how to conduct real-time wind control based on the intelligent threshold and the rule engine.
In order to solve the above problems, the present invention provides a real-time wind control method based on intelligent threshold and rule engine, the method comprising:
collecting initial data, the initial data comprising: buried point log data, service data and user environment data;
constructing a user behavior representation based on the initial data, the user behavior representation comprising: individual behavior portraits and group behavior portraits; setting a label for the user behavior portrait;
based on the threshold evaluation system and the historical data, calculating a future prediction threshold of the wind control index;
performing real-time wind control through the user behavior portraits, comparing the labels of the individual behavior portraits with the labels of the group behavior portraits, judging that the individual behaviors are abnormal when the difference between the labels of the individual behavior portraits and the labels of the group behavior portraits exceeds a threshold value, and performing risk grading on the individual behaviors based on a preset rule engine;
performing off-line wind control through the operation behavior data of the individual, comparing the operation behavior data of the individual with a corresponding future prediction threshold, judging that the individual behavior is abnormal when the operation behavior data of the individual exceeds the future prediction threshold, and performing risk grading on the individual behavior based on a preset rule engine;
and performing risk prevention and control based on the risk grading.
Preferably, the method further comprises:
and visually displaying the individual behavior portraits and the group behavior portraits in a form of a chart.
Preferably, the rule engine comprises:
the method comprises the steps that 1 rule combination service is corresponding to 1 business scene;
the rule combination service comprises 1 or more models, wherein the models are arranged based on a logic relationship;
the model includes 1 or more rule terms expressed by conditional expressions, in which various types of data variables are referenced.
Preferably, the threshold evaluation system includes: expert threshold, dynamic threshold based on user behavior, dynamic threshold based on time series;
the expert threshold is determined by a query method for a single index threshold.
Preferably, the method for generating the dynamic threshold of the user behavior comprises the following steps:
based on user behaviors, taking a user as a main key, and carrying out user classification and feature mining through a depth model by utilizing equipment fingerprints and historical wind control requests;
based on user classification and feature mining, constructing a risk rating system of the user, and distributing different risk grades to each group;
and calculating the sample through the trained model parameters, so as to realize personalized intelligent wind control.
Preferably, the dynamic threshold value based on time sequence includes:
the dynamic threshold is calculated based on a moving average algorithm.
Based on another aspect of the present invention, the present invention provides a real-time wind control system based on intelligent threshold and rule engine, the system comprising:
the acquisition unit is used for acquiring initial data, wherein the initial data comprises: buried point log data, service data and user environment data;
a portrayal unit for constructing a user behavior portrayal based on the initial data, the user behavior portrayal comprising: individual behavior portraits and group behavior portraits; setting a label for the user behavior portrait;
the preset unit is used for calculating a future prediction threshold value of the wind control index based on the threshold value evaluation system and the historical data;
the wind control unit is used for carrying out real-time wind control through the user behavior portraits, comparing the labels of the individual behavior portraits with the labels of the group behavior portraits, judging that the individual behaviors are abnormal when the difference between the labels of the individual behavior portraits and the labels of the group behavior portraits exceeds a threshold value, and carrying out risk grading on the individual behaviors based on a preset rule engine; performing off-line wind control through the operation behavior data of the individual, comparing the operation behavior data of the individual with a corresponding future prediction threshold, judging that the individual behavior is abnormal when the operation behavior data of the individual exceeds the future prediction threshold, and performing risk grading on the individual behavior based on a preset rule engine; and performing risk prevention and control based on the risk grading.
Preferably, the display unit is further included for:
and visually displaying the individual behavior portraits and the group behavior portraits in a form of a chart.
Preferably, the rule engine comprises:
the method comprises the steps that 1 rule combination service is corresponding to 1 business scene;
the rule combination service comprises 1 or more models, wherein the models are arranged based on a logic relationship;
the model includes 1 or more rule terms expressed by conditional expressions, in which various types of data variables are referenced.
Preferably, the threshold evaluation system includes: expert threshold, dynamic threshold based on user behavior, dynamic threshold based on time series;
the expert threshold is determined by a query method for a single index threshold.
Preferably, the method for generating the dynamic threshold of the user behavior comprises the following steps:
based on user behaviors, taking a user as a main key, and carrying out user classification and feature mining through a depth model by utilizing equipment fingerprints and historical wind control requests;
based on user classification and feature mining, constructing a risk rating system of the user, and distributing different risk grades to each group;
and calculating the sample through the trained model parameters, so as to realize personalized intelligent wind control.
Preferably, the dynamic threshold value based on time sequence includes:
the dynamic threshold is calculated based on a moving average algorithm.
The technical scheme of the invention provides a real-time wind control method and a system based on an intelligent threshold and a rule engine, wherein the method comprises the following steps: collecting initial data, the initial data comprising: buried point log data, service data and user environment data; constructing a user behavior representation based on the initial data, the user behavior representation comprising: individual behavior portraits and group behavior portraits; setting a label for the user behavior portrait; based on the threshold evaluation system and the historical data, calculating a future prediction threshold of the wind control index; performing real-time wind control through the user behavior portraits, comparing the labels of the individual behavior portraits with the labels of the group behavior portraits, judging that the individual behaviors are abnormal when the difference between the labels of the individual behavior portraits and the labels of the group behavior portraits exceeds a threshold value, and performing risk grading on the individual behaviors based on a preset rule engine; and performing off-line wind control through the operation behavior data of the individual, comparing the operation behavior data of the individual with a corresponding future prediction threshold, judging that the individual behavior is abnormal when the operation behavior data of the individual exceeds the future prediction threshold, and performing risk grading on the individual behavior based on a preset rule engine. The technical scheme of the invention is focused on introducing an image and intelligent threshold system into a real-time wind control system, and utilizing the technical advantages of big data analysis and algorithm, providing a construction image based on historical log data, comparing the real-time log data with the image data, and realizing early warning of abnormal access. Meanwhile, a user behavior scoring mechanism and a time sequence scoring mechanism are added on the basis of expert thresholds, and a dynamic adjustment part of the thresholds is added from three dimensions of users, devices and time. The threshold system mainly solves the defect caused by threshold one-cut in the traditional wind control system, and based on a scoring mechanism, the invention utilizes the technical advantages of big data analysis and algorithm, proposes to construct portraits based on historical log data, compares real-time log data with portraits data, and realizes early warning of abnormal access.
Drawings
Exemplary embodiments of the present invention may be more completely understood in consideration of the following drawings:
FIG. 1 is a flow chart of a real-time wind control method based on intelligent thresholds and a rules engine in accordance with a preferred embodiment of the present invention;
FIG. 2 is a block diagram of a real-time business air control system based on a rule engine in accordance with a preferred embodiment of the present invention;
FIG. 3 is a logic diagram of a rules engine in accordance with a preferred embodiment of the present invention;
FIG. 4 is a flowchart of an implementation of a user risk rating model in accordance with a preferred embodiment of the present invention; and
FIG. 5 is a block diagram of a real-time wind control system based on intelligent thresholds and rules engine in accordance with a preferred embodiment of the present invention.
Detailed Description
The exemplary embodiments of the present invention will now be described with reference to the accompanying drawings, however, the present invention may be embodied in many different forms and is not limited to the examples described herein, which are provided to fully and completely disclose the present invention and fully convey the scope of the invention to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the accompanying drawings is not intended to be limiting of the invention. In the drawings, like elements/components are referred to by like reference numerals.
Unless otherwise indicated, terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art. In addition, it will be understood that terms defined in commonly used dictionaries should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an idealized or overly formal sense.
FIG. 1 is a flow chart of a real-time wind control method based on intelligent thresholds and a rules engine in accordance with a preferred embodiment of the present invention. Embodiments of the present invention are illustrated in a real-time wind control system of a unified identity management platform deployed on a messenger cloud, and the system software framework of the present invention is shown in fig. 2.
As shown in fig. 1, the present invention provides a real-time wind control method based on intelligent threshold and rule engine, the method comprising:
step 101: collecting initial data, wherein the initial data comprises: buried point log data, service data and user environment data;
the invention firstly performs data acquisition. And collecting data, serving as a data base for auditing user behaviors, and storing the data into a data warehouse. The collected data comprises buried point log data, business data and user environment data of each service.
Buried point log data: in the program of the business system, the collection of various event data is carried out through a log plug-in (tool code), and the collection is a main data source for auditing user behaviors.
Service data: the traffic data (mainly rights data) of each micro service is synchronized from tdsql to hive by ETL tool.
User environment data: environmental data, such as device information, that is important to monitor the tax payer is collected by the integration sdk.
Step 102: based on the initial data, constructing a user behavior representation, the user behavior representation comprising: individual behavior portraits and group behavior portraits; setting a label for the user behavior portrait;
the present invention models behavioral portraits. User behavior portraits are constructed based on the tags, including individual behavior portraits and group behavior portraits. The core of the behavior portrayal is to construct a tag library, and tag scores in the tag library are statistical tags and algorithm tags. The statistical tag associates the tag with a specific SQL expression through the management terminal, and the SQL expression is periodically executed to update the tag, such as users with daily login times greater than 100 in the last 30 days. The algorithm label is obtained through long-term training based on a complex intelligent algorithm, such as behavior habit data of user login of common IP, common equipment and the like. After classifying and screening the individual portrait tags, forming group portrait tags, wherein the common time period of more than 90% of users in certain bureau of Guangdong province is 8: 30-17:30.
And forming a user portrait. And performing association mapping on the multidimensional individual portrait tags and the group portrait tags and the individuals or groups to form final user behavior portraits and group behavior portraits. For example, zhang san, age 18, the unit of which is Guangdong tax bureau, which logs in the system once every 7 days on average, the average number of continuous failures of each login is 2, and the common login time is nine to ten am. Here, 5 labels are used to identify three sheets, forming an individual representation of three sheets.
Step 103: based on the threshold evaluation system and the historical data, calculating a future prediction threshold of the wind control index;
preferably, the threshold evaluation system comprises: expert threshold, dynamic threshold based on user behavior, dynamic threshold based on time series;
the expert threshold is determined by a query method for a single index threshold.
Preferably, the method for generating the dynamic threshold of the user behavior comprises the following steps:
based on user behaviors, taking a user as a main key, and carrying out user classification and feature mining through a depth model by utilizing equipment fingerprints and historical wind control requests;
based on user classification and feature mining, constructing a risk rating system of the user, and distributing different risk grades to each group;
and calculating the sample through the trained model parameters, so as to realize personalized intelligent wind control.
Preferably, the dynamic threshold based on the time sequence comprises:
the dynamic threshold is calculated based on a moving average algorithm.
The intelligent threshold system of the invention is based on historical data, and analyzes a future prediction threshold of a certain index through an intelligent algorithm.
The threshold system in the invention is based on a scoring mechanism, and has three modules in total. On the basis of expert threshold, a user behavior scoring mechanism and a time sequence scoring mechanism are added, and a dynamic adjustment part of the threshold is added from three dimensions of a user, equipment and time.
Expert threshold:
because the daily pneumatic control request amount is huge in an actual business system, an expert threshold value is determined based on expert experience to perform primary screening. And aiming at the data with obvious risk behaviors, setting a static threshold according to indexes of multiple dimensions, and executing corresponding wind control measures. The expert threshold value is determined one by one based on the expert query method, and the final agreement is achieved, so that the method has a certain objectivity and representativeness.
Dynamic threshold based on user behavior:
the user behavior model is a comprehensive method for dynamically adjusting the threshold value based on the user behavior. A technical path flow diagram of this module is shown in figure 1. The method comprises the following three steps: (1) Based on user behaviors, taking a user as a primary key, utilizing the characteristics of equipment fingerprints, historical wind control requests and the like, and adopting depth models such as cluster analysis, random forests and the like to classify the user and mine the characteristics; (2) Constructing a risk rating system of a user, wherein the implementation logic is to calculate model results and allocate different risk grades to each group; (3) And calculating the sample by using the trained model parameters on the online edge, so as to realize high-availability personalized intelligent wind control. The shallow model mode is adopted on the line for judgment and matching, so that the operation pressure is reduced and the efficiency is improved.
The feature engineering is derived from an offline feature library of the wind control system. The depth model is used for model training in an offline environment and comprises an unsupervised model for feature exploration and a supervised model for risk probability prediction, and the output result is predicted risk probability. The system is designed according to the wind control strategy according to the service line, so that the universality of risk identification among different services and the quick portability during use are required to be considered. For example, different traffic lines, the risk request frequency may differ by orders of magnitude due to the different traffic types. Thus, risk rating by user groups meets the above need for overall risk management across business systems. The feature system is divided into the following major classes:
(1) Risk of user identity angle definition: such as whether the user is active, whether the zombie user is suddenly active, whether the password has been changed in the last two weeks, etc.
(2) In the off-line feature engineering stage, a qualitative and quantitative combined method is utilized to calculate the feature vector. The sample labels required by the classification model are formed by labeling the samples based on qualitative wind control rules to form classification labels of training samples. In the training process of the classification model, in order to prevent the test sample and the training sample from being sampled and extracted once, so that errors exist in the model result, K-fold cross validation (K-cross validation) is adopted, K times of training are repeated, and finally, the model parameter with the best average value of the performance index is obtained.
Dynamic threshold based on time series:
a time series is a sequence of ordered data recorded in the order of time. The time sequence is observed, researched and found out the rule of development change of the user, the future trend of the user is predicted to be time sequence analysis, and the time sequence analysis method is only suitable for the prediction of the recent period and the short period.
The traditional time sequence prediction method comprises the following steps: simple averaging, moving averaging, exponential smoothing, etc. In the threshold calculation of the present invention, we use the moving average method (moving average) which will be formulated as follows, if y=sma (X, N, M), f then y= [ M x+ (N-M) Y ') ]/n=m/N x+ (N-M)/N Y '), where Y ' represents the last period Y value. Note that when M/N is greater than/equal to/less than 1/2, the weight given to the observed value X changes accordingly.
Step 104: performing real-time wind control through the user behavior portraits, comparing the labels of the individual behavior portraits with the labels of the group behavior portraits, judging that the individual behaviors are abnormal when the difference between the labels of the individual behavior portraits and the labels of the group behavior portraits exceeds a threshold value, and performing risk grading on the individual behaviors based on a preset rule engine;
preferably, the rule engine comprises:
the method comprises the steps that 1 rule combination service is corresponding to 1 business scene;
the rule combination service comprises 1 or more models, and the models are arranged based on a logic relation;
the model includes 1 or more rule terms expressed by conditional expressions, in which various types of data variables are referenced.
As shown in fig. 3, the logic of the rule engine of the present invention is as follows:
1. the 1 traffic scenario corresponds to 1 rule combination service. For example, login authentication is a business scenario, and when login authentication is performed, risk control in the event is performed, corresponding to an independent real-time wind control service.
2. A rule combination service may consist of 1 or more rules/models, organized in logical relationships. The real-time wind control service such as login authentication consists of the models corresponding to 1-13 in the table above.
3. A model consists of 1 or more specific rule terms. For example, if the user logs in the region, the login time period, the login device, the login IP, the login browser and the like according with the rule of the very-used device and meets the rule items corresponding to the very-used region and the very-used login time period, the risk level is orange risk, and the corresponding processing measure is reminding and strengthening authentication. The above very common equipment rules are single rule items, and the corresponding risk level results and processing measures are result expressions.
4. Each specific rule term is expressed by a conditional expression. Such as a very common region, the conditional expression is that the current login region is not within the range of the common region (not in).
5. Various types of data variables referenced in rule items. And calculating a rule term result formula and depending input.
Step 105: and performing off-line wind control through the operation behavior data of the individual, comparing the operation behavior data of the individual with a corresponding future prediction threshold, judging that the individual behavior is abnormal when the operation behavior data of the individual exceeds the future prediction threshold, and performing risk grading on the individual behavior based on a preset rule engine.
And performing risk prevention and control based on the risk classification.
Preferably, the method further comprises:
the individual behavior image and the group behavior image are visually displayed in the form of a chart.
The risk audit in the invention comprises two business scenes of real-time wind control and off-line wind control. The real-time wind control is mainly used for comparing individual behavior portrait tags with the same dimension with group behavior portrait tags, when the difference between the individual characteristics and the overall characteristics is large, the individual behaviors are considered to be abnormal, and risk grading and corresponding treatment are carried out based on a rule engine. If all users of a certain unit operate in a certain time period, the analyzed person considers that the person possibly has risk behaviors without the time period, and when logging in, a short message is sent to remind or improve the authentication level.
In the off-line wind control process, the operation behavior data and the dynamic threshold value which is intelligently analyzed by big data are compared, and if the operation behavior data exceeds the dynamic threshold value, corresponding early warning processing is carried out according to rules defined in a rule engine. As shown in fig. 4.
The invention utilizes the advantages of tbds big data analysis and related algorithms, builds portraits based on the historical buried point log data on the basis of conventional real-time wind control, including user behavior portraits and interface portraits, and realizes real-time abnormal access early warning.
The invention adds an intelligent threshold mechanism in the rule engine, and plans three modules based on a scoring mechanism. On the basis of expert threshold, a user behavior scoring mechanism and a time sequence scoring mechanism are added, and a dynamic adjustment part of the threshold is added from three dimensions of a user, equipment and time.
The invention constructs a real-time business wind control system based on intelligent threshold and rule engine, optimizes and reforms the existing rule engine and the real-time wind control system, and provides a dynamic threshold function based on expert experience, artificial intelligent algorithm and time sequence algorithm, so that the rule of the wind control system is more accurate, and potential threats can be found and intercepted more accurately when dealing with various business risks.
FIG. 5 is a block diagram of a real-time wind control system based on intelligent thresholds and rules engine in accordance with a preferred embodiment of the present invention.
As shown in fig. 5, the present invention provides a real-time wind control system based on intelligent thresholds and a rules engine, the system comprising:
an acquisition unit 501, configured to acquire initial data, where the initial data includes: buried point log data, service data and user environment data;
a portrayal unit 502 for constructing a user behavior portrayal based on said initial data, said user behavior portrayal comprising: individual behavior portraits and group behavior portraits; setting a label for the user behavior portrait;
a preset unit 503, configured to calculate a future prediction threshold of the wind control indicator based on the threshold evaluation system and the historical data;
preferably, the threshold evaluation system includes: expert threshold, dynamic threshold based on user behavior, dynamic threshold based on time series;
the expert threshold is determined by a query method for a single index threshold.
Preferably, the method for generating the dynamic threshold of the user behavior comprises the following steps:
based on user behaviors, taking a user as a main key, and carrying out user classification and feature mining through a depth model by utilizing equipment fingerprints and historical wind control requests;
based on user classification and feature mining, constructing a risk rating system of the user, and distributing different risk grades to each group;
and calculating the sample through the trained model parameters, so as to realize personalized intelligent wind control.
Preferably, the dynamic threshold value based on time sequence includes:
the dynamic threshold is calculated based on a moving average algorithm.
A wind control unit 504, configured to perform real-time wind control through the user behavior portraits, compare the labels of the individual behavior portraits with the labels of the group behavior portraits, and determine that the individual behavior is abnormal when the difference between the labels of the individual behavior portraits and the labels of the group behavior portraits exceeds a threshold value, and perform risk classification on the individual behavior based on a preset rule engine; performing off-line wind control through the operation behavior data of the individual, comparing the operation behavior data of the individual with a corresponding future prediction threshold, judging that the individual behavior is abnormal when the operation behavior data of the individual exceeds the future prediction threshold, and performing risk grading on the individual behavior based on a preset rule engine; and performing risk prevention and control based on the risk classification.
Preferably, the rule engine comprises:
the method comprises the steps that 1 rule combination service is corresponding to 1 business scene;
the rule combination service comprises 1 or more models, wherein the models are arranged based on a logic relationship;
the model includes 1 or more rule terms expressed by conditional expressions, in which various types of data variables are referenced.
Preferably, the system further comprises a display unit for:
and visually displaying the individual behavior portraits and the group behavior portraits in a form of a chart.
It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein. The scheme in the embodiment of the invention can be realized by adopting various computer languages, such as object-oriented programming language Java, an transliteration script language JavaScript and the like.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
While preferred embodiments of the present invention have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. It is therefore intended that the following claims be interpreted as including the preferred embodiments and all such alterations and modifications as fall within the scope of the invention.
It will be apparent to those skilled in the art that various modifications and variations can be made to the present invention without departing from the spirit or scope of the invention. Thus, it is intended that the present invention also include such modifications and alterations insofar as they come within the scope of the appended claims or the equivalents thereof.
The invention has been described with reference to a few embodiments. However, as is well known to those skilled in the art, other embodiments than the above disclosed invention are equally possible within the scope of the invention, as defined by the appended patent claims.
Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise therein. All references to "a/an/the [ means, component, etc. ]" are to be interpreted openly as referring to at least one instance of said means, component, etc., unless explicitly stated otherwise. The steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated.
Claims (12)
1. A real-time wind control method based on intelligent thresholds and a rules engine, the method comprising:
collecting initial data, the initial data comprising: buried point log data, service data and user environment data;
constructing a user behavior representation based on the initial data, the user behavior representation comprising: individual behavior portraits and group behavior portraits; setting a label for the user behavior portrait;
based on the threshold evaluation system and the historical data, calculating a future prediction threshold of the wind control index;
performing real-time wind control through the user behavior portraits, comparing the labels of the individual behavior portraits with the labels of the group behavior portraits, judging that the individual behaviors are abnormal when the difference between the labels of the individual behavior portraits and the labels of the group behavior portraits exceeds a threshold value, and performing risk grading on the individual behaviors based on a preset rule engine;
performing off-line wind control through the operation behavior data of the individual, comparing the operation behavior data of the individual with a corresponding future prediction threshold, judging that the individual behavior is abnormal when the operation behavior data of the individual exceeds the future prediction threshold, and performing risk grading on the individual behavior based on a preset rule engine;
and performing risk prevention and control based on the risk grading.
2. The method of claim 1, further comprising:
and visually displaying the individual behavior portraits and the group behavior portraits in a form of a chart.
3. The method of claim 1, the rules engine comprising:
the method comprises the steps that 1 rule combination service is corresponding to 1 business scene;
the rule combination service comprises 1 or more models, wherein the models are arranged based on a logic relationship;
the model includes 1 or more rule terms expressed by conditional expressions, in which various types of data variables are referenced.
4. The method of claim 1, the threshold evaluation system comprising: expert threshold, dynamic threshold based on user behavior, dynamic threshold based on time series;
the expert threshold is determined by a query method for a single index threshold.
5. The method of claim 4, the method of dynamic threshold generation of user behavior comprising:
based on user behaviors, taking a user as a main key, and carrying out user classification and feature mining through a depth model by utilizing equipment fingerprints and historical wind control requests;
based on user classification and feature mining, constructing a risk rating system of the user, and distributing different risk grades to each group;
and calculating the sample through the trained model parameters, so as to realize personalized intelligent wind control.
6. The method of claim 4, the time series based dynamic threshold, comprising:
the dynamic threshold is calculated based on a moving average algorithm.
7. A real-time wind control system based on intelligent thresholds and a rules engine, the system comprising:
the acquisition unit is used for acquiring initial data, wherein the initial data comprises: buried point log data, service data and user environment data;
a portrayal unit for constructing a user behavior portrayal based on the initial data, the user behavior portrayal comprising: individual behavior portraits and group behavior portraits; setting a label for the user behavior portrait;
the preset unit is used for calculating a future prediction threshold value of the wind control index based on the threshold value evaluation system and the historical data;
the wind control unit is used for carrying out real-time wind control through the user behavior portraits, comparing the labels of the individual behavior portraits with the labels of the group behavior portraits, judging that the individual behaviors are abnormal when the difference between the labels of the individual behavior portraits and the labels of the group behavior portraits exceeds a threshold value, and carrying out risk grading on the individual behaviors based on a preset rule engine; performing off-line wind control through the operation behavior data of the individual, comparing the operation behavior data of the individual with a corresponding future prediction threshold, judging that the individual behavior is abnormal when the operation behavior data of the individual exceeds the future prediction threshold, and performing risk grading on the individual behavior based on a preset rule engine; and performing risk prevention and control based on the risk grading.
8. The system of claim 7, further comprising a display unit to:
and visually displaying the individual behavior portraits and the group behavior portraits in a form of a chart.
9. The system of claim 7, the rules engine comprising:
the method comprises the steps that 1 rule combination service is corresponding to 1 business scene;
the rule combination service comprises 1 or more models, wherein the models are arranged based on a logic relationship;
the model includes 1 or more rule terms expressed by conditional expressions, in which various types of data variables are referenced.
10. The system of claim 7, the threshold evaluation system comprising: expert threshold, dynamic threshold based on user behavior, dynamic threshold based on time series;
the expert threshold is determined by a query method for a single index threshold.
11. The system of claim 10, the method of dynamic threshold generation of user behavior comprising:
based on user behaviors, taking a user as a main key, and carrying out user classification and feature mining through a depth model by utilizing equipment fingerprints and historical wind control requests;
based on user classification and feature mining, constructing a risk rating system of the user, and distributing different risk grades to each group;
and calculating the sample through the trained model parameters, so as to realize personalized intelligent wind control.
12. The system of claim 10, the time series based dynamic threshold, comprising:
the dynamic threshold is calculated based on a moving average algorithm.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211719453.0A CN116523289A (en) | 2022-12-30 | 2022-12-30 | Real-time wind control method and system based on intelligent threshold and rule engine |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211719453.0A CN116523289A (en) | 2022-12-30 | 2022-12-30 | Real-time wind control method and system based on intelligent threshold and rule engine |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116523289A true CN116523289A (en) | 2023-08-01 |
Family
ID=87406978
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211719453.0A Pending CN116523289A (en) | 2022-12-30 | 2022-12-30 | Real-time wind control method and system based on intelligent threshold and rule engine |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116523289A (en) |
-
2022
- 2022-12-30 CN CN202211719453.0A patent/CN116523289A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111475804B (en) | Alarm prediction method and system | |
| US10592838B2 (en) | Risk simulation and assessment tool | |
| CN110390465A (en) | Air control analysis and processing method, device and the computer equipment of business datum | |
| CN110163647B (en) | Data processing method and device | |
| JP2021504789A (en) | ESG-based corporate evaluation execution device and its operation method | |
| CN111652280B (en) | Behavior-based target object data analysis method, device and storage medium | |
| CN113222149B (en) | Model training method, device, equipment and storage medium | |
| KR102087959B1 (en) | Artificial intelligence operations system of telecommunication network, and operating method thereof | |
| KR102105319B1 (en) | Esg based enterprise assessment device and operating method thereof | |
| WO2024067387A1 (en) | User portrait generation method based on characteristic variable scoring, device, vehicle, and storage medium | |
| CN109408574B (en) | Complaint responsibility confirmation system based on text mining technology | |
| CN110310012B (en) | Data analysis method, device, equipment and computer readable storage medium | |
| CN113971527A (en) | Data risk assessment method and device based on machine learning | |
| CN116485020B (en) | Supply chain risk identification early warning method, system and medium based on big data | |
| CN112598443A (en) | Online channel business data processing method and system based on deep learning | |
| CN113807728A (en) | Performance assessment method, device, equipment and storage medium based on neural network | |
| CN115545103A (en) | Abnormal data identification method, label identification method and abnormal data identification device | |
| CN117172721B (en) | Data flow supervision early warning method and system for financing service | |
| CN111784360B (en) | Anti-fraud prediction method and system based on network link backtracking | |
| Garcia de Alford et al. | Reducing age bias in machine learning: An algorithmic approach | |
| Cao | Design and optimization of a decision support system for sports training based on data mining technology | |
| CN116843395A (en) | Alarm classification method, device, equipment and storage medium of service system | |
| CN113642669B (en) | Feature analysis-based fraud prevention detection method, device, equipment and storage medium | |
| CN112506930B (en) | Data insight system based on machine learning technology | |
| CN116523289A (en) | Real-time wind control method and system based on intelligent threshold and rule engine |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |