CN116578955A

CN116578955A - Risk control method, device and equipment based on identity verification

Info

Publication number: CN116578955A
Application number: CN202310524140.8A
Authority: CN
Inventors: 万莹莹; 赵华; 朱通
Original assignee: Advanced New Technologies Co Ltd
Current assignee: Advanced New Technologies Co Ltd
Priority date: 2019-05-28
Filing date: 2019-05-28
Publication date: 2023-08-11
Also published as: CN110276178A; CN110276178B

Abstract

The embodiment of the specification discloses a risk control method, a risk control device and risk control equipment based on identity verification. The scheme comprises the following steps: acquiring identity verification information submitted by a first user; determining first risk characteristic information of the first user according to the identity verification information; determining the information leakage level of the first user according to the first risk characteristic information; and performing risk control on the operation of the first user according to the information leakage level.

Description

Risk control method, device and equipment based on identity verification

Technical Field

The present application relates to the field of computer technologies, and in particular, to a risk control method, apparatus, and device based on identity verification.

Background

In the prior art, in risk prevention and control of identity theft, for identifying a transaction with non-personal operation, a wind control system performs risk prevention and control by outputting user identity verification, and users with easy active information leakage often provide identity verification information for other people due to various reasons such as cheating, so that the conventional wind control system cannot perform prevention and control under the condition.

Disclosure of Invention

In view of the above, the embodiments of the present application provide a risk control method, apparatus and device based on authentication, which are used for improving security of user accounts and funds.

In order to solve the above technical problems, the embodiments of the present specification are implemented as follows:

the risk control method based on identity verification provided by the embodiment of the specification comprises the following steps:

acquiring identity verification information submitted by a first user;

determining first risk characteristic information of the first user according to the identity verification information;

determining the information leakage level of the first user according to the first risk characteristic information;

and performing risk control on the operation of the first user according to the information leakage level.

The embodiment of the specification provides a risk control device based on identity verification, which comprises:

the identity verification information acquisition module is used for acquiring identity verification information submitted by a first user;

the first risk characteristic information determining module is used for determining first risk characteristic information of the first user according to the identity verification information;

the information leakage grade determining module is used for determining the information leakage grade of the first user according to the first risk characteristic information;

And the risk control module is used for performing risk control on the operation of the first user according to the information leakage level.

at least one processor; the method comprises the steps of,

a memory communicatively coupled to the at least one processor; wherein, the liquid crystal display device comprises a liquid crystal display device,

the memory stores instructions executable by the at least one processor to enable the at least one processor to:

acquiring identity verification information submitted by a first user;

The above-mentioned at least one technical scheme that this description embodiment adopted can reach following beneficial effect:

according to the embodiment of the specification, the first risk characteristic information of the user is determined by acquiring the identity verification information submitted by the user; and then determining the information leakage level of the user according to the first risk characteristic information, judging whether the user is the user easy to actively leak information, and performing risk control on the operation of the user according to the information leakage level. According to the invention, the user easy to actively leak information is identified, and then risk control is carried out on the user, so that the safety of user accounts and funds is improved.

Drawings

The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the application and do not constitute a limitation on the application. In the drawings:

fig. 1 is a schematic flow chart of a risk control method based on identity verification according to an embodiment of the present disclosure;

fig. 2 is a schematic structural diagram of an authentication-based risk control device corresponding to fig. 1 according to an embodiment of the present disclosure;

fig. 3 is a schematic structural diagram of an authentication-based risk control device corresponding to fig. 1 according to an embodiment of the present disclosure.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the technical solutions of the present application will be clearly and completely described below with reference to specific embodiments of the present application and corresponding drawings. It will be apparent that the described embodiments are only some, but not all, embodiments of the application. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.

And (3) identity authentication: the method is also called as verification and authentication, and means that the user identity is confirmed by a certain means.

Public password: simpler passwords used by a large population, such as password, 123456, 111222, etc.

Easy leakage verification: the verification that the user is easy to actively reveal is referred to as short message verification codes, identity document numbers, security answers and the like.

The network black product refers to illegal actions which take the Internet as a medium and take the network technology as a main means to bring potential threats (major potential safety hazards) to the safety of a computer information system and the network space management order, and even national safety and social stability.

Risk control refers to the risk manager taking various measures and methods to eliminate or reduce various possibilities of occurrence of risk events, or to reduce losses caused by occurrence of risk events.

In the theft risk prevention and control, the wind control system performs risk prevention and control by outputting user identity verification for identifying the transaction with non-personal operation, and users with easy active information leakage often cooperate with black products to provide identity verification information due to various reasons such as cheating, which is a difficulty of wind control. The invention protects the safety of user accounts and funds by identifying users easy to actively leak information and outputting identity verification which is not easy to leak.

The following describes in detail the technical solutions provided by the embodiments of the present application with reference to the accompanying drawings.

Fig. 1 is a schematic flow chart of a risk control method based on identity verification according to an embodiment of the present disclosure. From the program perspective, the execution subject of the flow may be a program or an application client that is installed on an application server.

As shown in fig. 1, the process may include the steps of:

step 101: and acquiring authentication information submitted by the first user.

In the embodiment of the present disclosure, the authentication information may be authentication information of the user when the user logs in to the account, or may be authentication information of the user when the user makes payment. The information can be password information, an identity document number and security information. In addition, the authentication information may include device terminal information used by the user to submit the authentication information, in addition to the authentication information described above.

In the embodiment of the present disclosure, the first user submits the authentication information by using a device terminal, which may be a mobile phone, a tablet computer, a smart watch, or the like. The terminal can be equipment frequently used by a user, or can be equipment which is logged in temporarily, such as mobile phones of relatives and friends for emergency operation.

Step 102: and determining first risk characteristic information of the first user according to the identity verification information.

In the embodiment of the present disclosure, the authentication information submitted by the user is obtained, and some other information of the user may be obtained according to the authentication information, for example, whether the account password is a public password or not, and whether the account password is related to the own certificate number or not. The account information of the user, such as some operation habits, preference, equipment which is frequently logged in and group conditions of the user joining, can also be obtained according to the authentication information. Some other information, such as the degree of education, may also be obtained based on the user's account registration information.

In this embodiment of the present disclosure, the first risk feature information may be information related to information disclosure that is easy to actively leak by a user and is screened out according to some preset rules. If the user uses public passwords, whether the login device is an unreliable device or a high-risk device, whether the login device is a high-risk organization, whether the account passes through easy-leakage verification in a non-trusted environment in different places, whether the account is operated alternately with the non-trusted device in a short time, and the like. If the user's login device is an untrusted device, the user's account may be stolen. The high-risk equipment can be understood as that illegal people use the equipment to steal accounts of other people. A high risk organization may be understood as a group related to a swipe, credit card transaction, etc.

Step 103: and determining the information leakage level of the first user according to the first risk characteristic information.

In the embodiment of the present specification, the information leakage level represents a level at which the first user is liable to active information leakage. The information leakage level may be classified into an easy-to-active information leakage level and a difficult-to-active information leakage level, and may have a level intermediate the easy-to-active information leakage level and the difficult-to-active information leakage level. An information leakage score can be obtained based on the first risk characteristic information, and then the information leakage grade to which the first user belongs is judged according to a preset score.

In this embodiment of the present disclosure, determining the information leakage level of the first user according to the first risk feature information may employ a plurality of methods, for example, the first risk feature information may be compared with feature information of a user who is prone to active information leakage, and then the first risk feature information is evaluated according to a comparison result, so as to determine the information leakage level of the first user. Characteristic information of a user who is prone to active information leakage can be extracted from the report data. Wherein the account for which the report data is directed is stolen by the implementation of the relevant departments.

In this embodiment of the present disclosure, determining the information leakage level of the first user according to the first risk feature information may further obtain an information leakage risk level model by using a method of performing big data training based on historical data, and then obtain the information leakage level of the user based on the model and the first risk feature information.

Step 104: and performing risk control on the operation of the first user according to the information leakage level.

In the embodiment of the present disclosure, after obtaining the information leakage level of the first user, the server may formulate different risk control policies for different information leakage levels. Risk control refers to the risk manager taking various measures and methods to eliminate or reduce various possibilities of occurrence of risk events, or to reduce losses caused by occurrence of risk events. If the information leakage level of the first user indicates that the risk of the first user that the active information is easy to leak is relatively small, that is, the history data is not stolen by the account even if various operations of the first user are normal, risk control is not required. If the information leakage level of the first user indicates that the risk of easily active information leakage of the first user is relatively high, if the first user possibly does not log on a trusted device and adopts a public password and the like, secondary identity authentication is needed for the user, and the safety of accounts and properties is protected. The secondary identity authentication can also adopt different authentication modes according to different conditions, if the login equipment is not a trusted equipment, a biological authentication method can be adopted to replace a general authentication method, such as face brushing or fingerprint acquisition is adopted to replace authentication codes sent to mobile phone numbers, and the like. The embodiment avoids the illegal action by adopting an identity verification method which is not suitable for transmission and transmitting the verification code to an illegal molecule by the actual user of the user.

The method in FIG. 1, by acquiring authentication information submitted by a user, determines first risk characteristic information of the user; and then determining the information leakage level of the user according to the first risk characteristic information, judging whether the user is the user easy to actively leak information, and performing risk control on the operation of the user according to the information leakage level. According to the invention, the user easy to actively leak information is identified, and then risk control is carried out on the user, so that the safety of user accounts and funds is improved.

Based on the method of fig. 1, the examples of the present specification also provide some specific implementations of the method, as described below.

Optionally, the performing risk control on the operation of the first user according to the information leakage level may specifically include:

judging whether the information leakage level is lower than a first risk level or not to obtain a first judgment result;

and when the first judgment result shows that the information leakage level is higher than or equal to the first risk level, acquiring biological information of the first user for secondary identity verification.

In the embodiment of the present specification, a first risk level is set up, and if the information leakage level is higher than or equal to the first risk level, it is indicated whether the user is a user who is prone to leakage. If the information leakage level exceeds the first risk level, there is a great risk that the user has active information leakage, and it is possible that the authentication information previously obtained is not the user's own operation. In this case, secondary authentication is required for the user, and the method adopted for the secondary authentication is required to achieve the effect of unfavorable transfer. This is to avoid the occurrence that the user sends the received authentication information to the phishing person without knowledge, thereby breaking through the secondary authentication. In the embodiment of the present specification, the biological verification method is adopted, so that the occurrence of the above situation is avoided.

Optionally, when the first judgment result indicates that the information leakage level is lower than the first risk level, judging whether the information leakage level is lower than a second risk level, and obtaining a second judgment result, wherein the second risk level is lower than the first risk level;

acquiring operation equipment information of the first user when the second judgment result indicates that the information leakage level is higher than or equal to the second risk level;

judging whether the operation equipment corresponding to the operation equipment information is the trusted equipment of the first user or not, and obtaining a third judgment result;

and when the third judging result shows that the operation device is not the trusted device of the first user, performing secondary identity verification on the first user.

In the embodiment of the present specification, if the information leakage level of the user is relatively low, it is explained that the user is a user who is not liable to active information leakage. However, the information disclosure level is higher than the second risk level, which means that although the user does not belong to the group of people with active information disclosure, information disclosure still exists, such as a payment password and other websites, and when the behavior of checking the payment password at one stage occurs on the non-trusted device, the risk is higher than that of the normal user, so that the risk management and control force needs to be improved correspondingly. Therefore, in this case, it is also necessary to acquire terminal device information used by the user, and then determine whether the terminal device used by the user is a usual device, i.e., an available device, based on the terminal device information. If the terminal device used by the user is not a trusted device, there is also a situation that this account is stolen to some extent, and thus, secondary authentication of the user is still required.

In the embodiment of the present specification, the secondary authentication may be phone number authentication, identity document number authentication or security problem authentication, or may be biometric information authentication, which is not limited herein.

In the embodiment of the specification, in order to improve the effectiveness of the secondary identity authentication, the time for inputting the authentication information by the user can be shortened, and the user is prevented from forwarding the authentication information to other people, so that the meaning of the secondary identity authentication is lost. For example, the time for inputting authentication information is normally 2 minutes, which can be shortened to 1 minute in the embodiment of the present specification.

Optionally, the determining the information leakage level of the first user according to the risk feature information specifically includes:

constructing an information leakage risk level model;

and inputting the first risk characteristic information into the information leakage risk level model, and outputting the information leakage level of the first user.

In this embodiment of the present disclosure, the information leakage risk level model may be constructed by setting a preset rule to score the behavior of the user after analysis is performed according to a large amount of historical data, different risk feature information may be given different scores, and then a calculation formula is obtained, and then the information leakage level of the first user is determined according to the calculation formula. Different information leakage levels correspond to different score segments, and corresponding information leakage levels can be obtained according to corresponding scores.

In the embodiment of the present disclosure, an information leakage risk level model may be constructed, or a large amount of historical data may be trained by using an unsupervised classification model or a supervised classification model, so as to finally generate the information leakage risk level model.

In the embodiment of the present disclosure, an information leakage risk level model may be constructed, or a large amount of historical data may be trained by using a supervised classification model or a supervised classification model, to finally generate the information leakage risk level model. The adoption of the supervised model requires the setting of labels for the historical data, and the supervised model is carried out according to different labels of the historical data. This approach requires a large amount of tagged data to coordinate to improve the accuracy of the identification.

Optionally, the constructing the information leakage risk level model specifically includes:

acquiring a plurality of historical data;

screening black samples in the plurality of historical data;

extracting second risk characteristic information of each historical data;

and performing supervised learning on the plurality of historical data according to the black sample and the second risk characteristic information to generate an information leakage risk level model.

In the embodiment of the specification, a supervised learning model is provided, a black sample and a white sample are determined by dividing historical data, then supervised learning is performed, and finally an information leakage risk level model is generated. The black sample indicates that the history data is operation data of a user who has determined that the active information is liable to leak, and the white sample indicates that the history data is operation data of a user who is not liable to leak.

In the embodiment of the present disclosure, a plurality of methods may be used to determine whether the history data is a black sample, other information of the history data may be obtained while the history data is obtained, for example, whether the history data is report data, and whether the history data is a black sample may be determined according to some service rules.

In the embodiments of the present disclosure, the supervised learning model may use GBDT to generate the supervised model, or other supervised learning methods, such as DNN, etc.

According to the embodiment of the specification, the historical data is classified, whether the historical data is a black sample or a white sample is determined, and then supervised learning is carried out to generate an information leakage risk level model. Compared with an unsupervised model, the supervised model is adopted to train historical data, so that the accuracy of model prediction is improved.

Optionally, the screening the black samples in the plurality of historical data may specifically include:

judging whether the historical data is report data or not to obtain a fourth judging result;

and when the fourth judging result shows that the historical data is report data, determining that the historical data is a black sample.

In an embodiment of the present specification, a method of determining whether historical data is a black sample is provided. In actual operation, some report data will be in the history data, and the report data may indicate that the user corresponding to the history data belongs to the crowd who is prone to active information leakage. Therefore, if the history data is confirmed to be the report data, it can be judged that the history data is a black sample. According to the embodiment of the specification, the report data is used as the black sample, so that the accuracy of the model is improved, and the determination time of the black sample is also reduced.

Optionally, when the fourth judgment result indicates that the historical data is not the report data, judging whether the historical data accords with a preset rule, and obtaining a fifth judgment result;

and when the fifth judging result shows that the historical data accords with the preset rule, determining that the historical data is a black sample.

In the present embodiment, since the newspaper data is limited, it is not sufficient to use only the newspaper data as a black sample. In order to increase the number of black samples, the present embodiment provides another method of screening black samples. In consideration of the fact that not all users with easy active information leakage can be successfully stolen from the account, all users with easy active information leakage have certain commonalities, such as simple password setting, low education level, account information logging in unsafe environments frequently, and the like, so that rules can be formulated according to the commonalities, high-risk unlabeled historical data can be screened through the rules, and then black samples can be screened according to expert scoring. Expert scoring can be used as a supplementary measure of preset rules to improve screening accuracy. Expert scoring can be achieved by a preset program or manually. According to the embodiment, the high-risk unlabeled samples are screened out according to the high-risk rule of the business experience for unlabeled historical data, and then the black samples are screened out through expert scoring, so that the problem that the number of the black samples is too small is solved, and the prediction accuracy of the model is improved.

Optionally, the extracting the second risk characteristic information of each history data may specifically include:

determining, for each history data, second user information of the history data;

and determining user portrait risk features, account behavior risk features and/or social behavior risk features of the second user according to the second user information.

In the present description embodiment, risk features are generated from three dimensions:

a) User portrayal risk features, i.e. risk features generated based on user portrayal, such as: whether the user uses public passwords, whether the user installs high-risk software and the like, wherein the high-risk software can be software such as P2P, small loan and the like.

In the embodiment of the present specification, if a password set by a user is too simple, it is extremely easy to decrypt. In another case, in order to facilitate memorizing, all passwords, such as a bank card password, a social APP password and a financial APP password, are set to be the same password, so that information leakage can be caused, and if one password is known unintentionally, other passwords can be unlocked. Therefore, setting all passwords to be the same also belongs to the behavior of easy active information leakage. Some users can set the password as their own or relatives' birthday, and the birthday has great correlation with the identity document number, which is a relatively low-privacy information, and lawbreakers tend to easily obtain the information. Therefore, setting the password as a birthday also belongs to a behavior of easily leaking active information.

b) Account behavior risk characteristics, i.e., risk indicators generated based on account behavior, such as: and checking whether the account passes the easy-leakage check on the non-trusted environment in different places, whether the account is operated by high-risk equipment, whether the account is operated alternately by trusted equipment and non-trusted equipment in a short time, and the like.

In the embodiments of the present disclosure, an untrusted environment may be understood as a public place, a non-private environment, or a place where the user himself or herself rarely goes, which is outside the range of motion of the user. If Wifi in public places is used for surfing the internet, the method belongs to a behavior of easily active information leakage. The public places can be internet bars, hotels, parking lots and the like. The high risk device may be a terminal device understood to be associated with the entry data, or a terminal logged into multiple accounts. Because there is a greater risk of leakage of the easy-to-actuate information if there is a corresponding operation on such a device. The account is alternately operated by the trusted device and the non-trusted device in a short time, which also indicates that the account may be stolen.

c) Social behavior risk features, i.e., risk indicators generated based on social information, such as: whether the user issues excessive high-risk information, whether the user joins a high-risk circle/group, whether the user is added as a friend by the high-risk user, whether the user actively adds the high-risk/unassociated user as a friend, and the like.

In the present embodiments, high risk may be understood as actions or operations related to polling loans, swiping bills, credit card transactions, etc. There are also some actions that are prone to active information leakage in social actions. If the user issues high-risk information such as consultation loan, bill swiping, credit card handling and the like, the information can be utilized by some lawbreakers. Also if the user joins a circle or group like loan, swipe, credit card transaction, the risk is also presented. In addition, if the user actively adds some high risk users, the above risk also exists.

According to the embodiment, account behaviors and social data are simultaneously introduced as model input, so that the prediction accuracy and instantaneity are improved.

Optionally, after performing supervised learning on the plurality of historical data according to the black sample and the second risk characteristic information to generate an information leakage risk level model, the method may further include:

judging whether the information leakage risk level model meets a preset standard or not to obtain a sixth judging result;

and when the sixth judgment result shows that the information leakage risk level model does not meet the preset standard, correcting the information leakage risk level model until the information leakage risk level model meets the preset standard.

In the embodiment of the present disclosure, the prediction accuracy of the information leakage risk level model generated for the first time may not reach the standard, and then the information leakage risk level model needs to be corrected. This may be due to various reasons, such as insufficient number of black samples, or unreasonable selection of risk features, so that more black samples may be supplemented on the basis of the original black samples, and risk feature information may be adjusted until the information leakage risk level model meets the expectations.

In the embodiment of the present specification, the operation data predicted by the information leakage risk level model may also be added to the history data, and the number of black samples and white samples in the history data may be continuously supplemented. And correcting the information leakage risk level model to improve the prediction accuracy of the model.

Optionally, the determining the first risk feature information of the first user according to the authentication information may specifically include:

determining account information of the first user according to the identity verification information;

the historical operation information corresponding to the account information is called;

and determining first risk characteristic information of the first user according to the historical operation information.

In the embodiment of the present specification, the authentication information of the user may include account information and authentication information of an account, and the account information of the first user may be determined according to the authentication information. The account information can include an account name and an account secret; registration information of the user, such as name, identification number, mobile phone number, academic, professional information, usual address, may also be included. In addition, some other information may be invoked based on the name of the user. And information of other platforms with association relation or binding relation with the current platform can be called according to the account information.

In the embodiment of the present disclosure, the invoking of the historical operation information corresponding to the account information may include login device information, payment information, social information of the user, and some comments or status information posted in the social circle. These historical operating information are then combined to determine first risk profile information for the user.

According to the embodiment of the specification, the first risk characteristic information of the user is represented by various information, so that evaluation is more comprehensive, and judgment on whether the user is easy to active information leakage is more accurate.

Optionally, the determining the first risk feature information of the first user according to the historical operation information specifically includes:

And determining user portrait risk features, account behavior risk features and/or social behavior risk features of the first user according to the historical operation information.

In this description embodiment, the first risk feature information may include a plurality of different forms of information, user portrait risk features, account behavioral risk features, and/or social behavioral risk features.

The user portrait risk feature is a risk feature generated based on the user portrait. User portrayal, also known as user role, is an effective tool for outlining target users, contacting user appeal and design direction. The user representation links the user's attributes, behaviors and expectations with the most superficial and life-proximate utterances during the actual operation. As a virtual representation of an actual user, the user image is formed in a user character that is not built off the product and market, and the formed user character is required to have a primary audience and target group representing the performance representative product. User portraits are initially applied in the field of electronic commerce, and under the background of big data age, user information is filled in a network, each specific information of a user is abstracted into labels, and the user portraits are materialized by utilizing the labels, so that targeted services are provided for the user.

In the embodiment of the present specification, the user portrait risk feature may include: whether the user uses a public password, whether the password is consistent with the passwords on other platforms, whether the user installs high-risk software, and the like, such as P2P and small loan.

In the embodiment of the specification, the account behavior risk feature may be information based on account behavior, such as whether the account passes through easy-leakage verification in a non-trusted environment in different places, whether the account has high-risk device operation, whether the account has alternative operation of trusted devices and non-trusted devices in a short time, and the like.

In this embodiment of the present disclosure, social behavior risk features may be based on social information of the user, such as whether the user issues high risk information, whether the user joins a high risk circle/group, whether the user is added as a friend by the high risk user, whether the user actively adds a high risk/unassociated user as a friend, and so on.

Based on the same thought, the embodiment of the specification also provides a device corresponding to the method. Fig. 2 is a schematic structural diagram of an authentication-based risk control device corresponding to fig. 1 according to an embodiment of the present disclosure. As shown in fig. 2, the apparatus may include:

an authentication information obtaining module 201, configured to obtain authentication information submitted by a first user;

A first risk feature information determining module 202, configured to determine first risk feature information of the first user according to the authentication information;

an information leakage level determining module 203, configured to determine an information leakage level of the first user according to the first risk feature information;

and the risk control module 204 is configured to perform risk control on the operation of the first user according to the information leakage level.

In the device provided in the embodiment of the present disclosure, the authentication information submitted by the user is obtained by the authentication information obtaining module 201, and the first risk feature information determining module 202 determines the first risk feature information of the user; then, the information leakage level determining module 203 determines an information leakage level of the user according to the first risk feature information, determines whether the user is a user easy to actively leak information, and then the risk control module 204 performs risk control on the operation of the user according to the information leakage level. According to the embodiment of the specification, the safety of the user account and funds is improved by identifying the user easy to actively leak information and then performing risk control on the user.

Optionally, the risk control module 204 may specifically include:

The first result judging sub-module is used for judging whether the information leakage level is lower than a first risk level or not to obtain a first judging result;

and the first identity verification sub-module is used for acquiring the biological information of the first user for secondary identity verification when the first judgment result shows that the information leakage level is higher than or equal to the first risk level.

Optionally, the risk control module 204 may further include:

a second result judging sub-module, configured to judge whether the information leakage level is lower than a second risk level when the first judgment result indicates that the information leakage level is lower than the first risk level, to obtain a second judgment result, where the second risk level is lower than the first risk level;

an operation device information obtaining sub-module, configured to obtain operation device information of the first user when the second determination result indicates that the information leakage level is higher than or equal to the second risk level;

a third result judging sub-module, configured to judge whether the operation device corresponding to the operation device information is a trusted device of the first user, so as to obtain a third judging result;

and the second identity verification sub-module is used for carrying out secondary identity verification on the first user when the third judging result indicates that the operation device is not the trusted device of the first user.

Optionally, the first risk feature information determining module 202 may specifically include:

an account information determining sub-module, configured to determine account information of the first user according to the authentication information;

the historical operation information calling sub-module is used for calling the historical operation information corresponding to the account information;

and the first risk characteristic information determining submodule is used for determining first risk characteristic information of the first user according to the historical operation information.

Optionally, the first risk feature information determining submodule is specifically configured to determine a user portrait risk feature, an account behavior risk feature and/or a social behavior risk feature of the first user according to the historical operation information.

Optionally, the information leakage level determining module 203 may specifically include:

the information leakage risk level model construction submodule is used for constructing an information leakage risk level model;

and the information leakage grade output sub-module is used for inputting the first risk characteristic information into the information leakage risk grade model and outputting the information leakage grade of the first user.

Optionally, the information leakage risk level model building sub-module may specifically include:

A plurality of history data acquisition units configured to acquire a plurality of history data;

a black sample screening unit for screening black samples in the plurality of history data;

a second risk feature information extracting unit configured to extract second risk feature information of each of the history data;

and the information leakage risk level model generation unit is used for performing supervised learning on the plurality of historical data according to the black sample and the second risk characteristic information to generate an information leakage risk level model.

Optionally, the black sample screening unit may specifically include:

a fourth result judging subunit, configured to judge whether the history data is report data, so as to obtain a fourth judging result;

and the first black sample determining subunit is used for determining that the historical data is a black sample when the fourth judging result indicates that the historical data is report data.

Optionally, the black sample screening unit may further include:

a fifth result judging subunit, configured to judge whether the history data accords with a preset rule when the fourth judging result indicates that the history data is not report data, so as to obtain a fifth judging result;

and the second black sample determining subunit is configured to determine that the historical data is a black sample when the fifth judging result indicates that the historical data accords with the preset rule.

Optionally, the second risk feature information extracting unit may specifically include:

a second user information determination subunit configured to determine, for each history data, second user information of the history data;

and the second risk characteristic information determining subunit is used for determining user portrait risk characteristics, account behavior risk characteristics and/or social behavior risk characteristics of the second user according to the second user information.

Optionally, the information leakage risk level model building sub-module may further include:

a sixth result judging unit, configured to judge whether the information leakage risk level model meets a preset standard, to obtain a sixth judging result;

and the correction unit is used for correcting the information leakage risk level model until the information leakage risk level model meets the preset standard when the sixth judgment result shows that the information leakage risk level model does not meet the preset standard.

Based on the same thought, the embodiment of the specification also provides equipment corresponding to the method.

Fig. 3 is a schematic structural diagram of an authentication-based risk control device corresponding to fig. 1 according to an embodiment of the present disclosure. As shown in fig. 3, the apparatus 300 may include:

At least one processor 310; the method comprises the steps of,

a memory 330 communicatively coupled to the at least one processor; wherein, the liquid crystal display device comprises a liquid crystal display device,

the memory 330 stores instructions 320 executable by the at least one processor 310, the instructions being executable by the at least one processor 310 to enable the at least one processor 310 to:

acquiring identity verification information submitted by a first user;

The device provided by the embodiment of the specification determines the first risk characteristic information of the user by acquiring the identity verification information submitted by the user; and then determining the information leakage level of the user according to the first risk characteristic information, judging whether the user is the user easy to actively leak information, and performing risk control on the operation of the user according to the information leakage level. According to the invention, the user easy to actively leak information is identified, and then risk control is carried out on the user, so that the safety of user accounts and funds is improved.

In the 90 s of the 20 th century, improvements to one technology could clearly be distinguished as improvements in hardware (e.g., improvements to circuit structures such as diodes, transistors, switches, etc.) or software (improvements to the process flow). However, with the development of technology, many improvements of the current method flows can be regarded as direct improvements of hardware circuit structures. Designers almost always obtain corresponding hardware circuit structures by programming improved method flows into hardware circuits. Therefore, an improvement of a method flow cannot be said to be realized by a hardware entity module. For example, a Programmable logic device (Programmable LogicDevice, PLD), such as a field Programmable gate array (FieldProgrammableGateArray, FPGA), is an integrated circuit whose logic function is determined by the programming of the device by a user. A designer programs to "integrate" a digital system onto a PLD without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Moreover, nowadays, instead of manually manufacturing integrated circuit chips, such programming is mostly implemented by using "logic compiler" software, which is similar to the software compiler used in program development and writing, and the original code before the compiling is also written in a specific programming language, which is called hardware description language (HardwareDescription Language, HDL), but HDL is not just one, but a plurality of kinds, such as ABEL (Advanced BooleanExpressionLanguage), AHDL (AlteraHardwareDescriptionLanguage), confluence, CUPL (cornellunignyiProgrammingLangage), HDcal, jHDL (javahard script language), lava, lola, myHDL, PALASM, RHDL (rubyHardwareDescriptionLangLange) and the like, and VHDL (Very-High-speededdie hard script DescriptionLange) and Verilog are most commonly used at present. It will also be apparent to those skilled in the art that a hardware circuit implementing the logic method flow can be readily obtained by merely slightly programming the method flow into an integrated circuit using several of the hardware description languages described above.

The controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, application specific integrated circuits (application specific IntegratedCircuit, ASIC), programmable logic controllers, and embedded microcontrollers, examples of controllers include, but are not limited to, the following microcontrollers: ARC625D, atmelAT91SAM, microchip PIC18F26K20, and silicalabsc 8051F320, the memory controller may also be implemented as part of the control logic of the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller in a pure computer readable program code, it is well possible to implement the same functionality by logically programming the method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers, etc. Such a controller may thus be regarded as a kind of hardware component, and means for performing various functions included therein may also be regarded as structures within the hardware component. Or even means for achieving the various functions may be regarded as either software modules implementing the methods or structures within hardware components.

The system, apparatus, module or unit set forth in the above embodiments may be implemented in particular by a computer chip or entity, or by a product having a certain function. One typical implementation is a computer. In particular, the computer may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

For convenience of description, the above devices are described as being functionally divided into various units, respectively. Of course, the functions of each element may be implemented in the same piece or pieces of software and/or hardware when implementing the present application.

It will be appreciated by those skilled in the art that embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

In one typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include volatile memory in a computer-readable medium, random Access Memory (RAM) and/or nonvolatile memory, etc., such as Read Only Memory (ROM) or flash memory (flashRAM). Memory is an example of computer-readable media.

Computer readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. Computer-readable media, as defined herein, does not include transitory computer-readable media (transmission media), such as modulated data signals and carrier waves.

It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or apparatus that comprises the element.

The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

In this specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In particular, for system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, as relevant to see a section of the description of method embodiments.

The foregoing is merely exemplary of the present application and is not intended to limit the present application. Various modifications and variations of the present application will be apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. which come within the spirit and principles of the application are to be included in the scope of the claims of the present application.

Claims

1. A risk control method based on identity verification, comprising:

acquiring authentication information submitted by a first user, wherein the authentication information comprises: at least one of authentication information of a user when logging in an account and authentication information of the user when paying;

2. The method of claim 1, wherein the risk control for the operation of the first user according to the information leakage level specifically includes:

3. The method of claim 2, the method further comprising:

when the first judgment result indicates that the information leakage level is lower than the first risk level, judging whether the information leakage level is lower than a second risk level, and obtaining a second judgment result, wherein the second risk level is lower than the first risk level;

4. The method according to claim 1, wherein said determining first risk characteristic information of said first user based on said authentication information, in particular comprises:

5. The method according to claim 4, wherein the determining the first risk characteristic information of the first user according to the historical operation information specifically includes:

6. The method of claim 1, wherein the determining the information leakage level of the first user according to the risk characteristic information specifically includes:

constructing an information leakage risk level model;

7. The method of claim 6, wherein the constructing the information leakage risk level model specifically includes:

acquiring a plurality of historical data;

screening black samples in the plurality of historical data;

extracting second risk characteristic information of each historical data;

8. The method of claim 7, wherein said screening black samples in said plurality of historical data comprises:

9. The method of claim 8, the method further comprising:

when the fourth judgment result indicates that the historical data is not the case report data, judging whether the historical data accords with a preset rule or not, and obtaining a fifth judgment result;

10. The method of claim 7, wherein the extracting the second risk characteristic information of each of the historical data specifically comprises:

11. The method of claim 7, further comprising, after said performing supervised learning of said plurality of historical data based on said black samples and said second risk profile information, generating an information leakage risk level model:

12. The method of claim 1, the first risk profile information comprising: at least one of a user portrayal risk feature, an account behavior risk feature, and a social behavior risk feature;

the user portrait risk characteristics represent risk characteristics generated based on user portraits, including at least one of whether users use public passwords or not and whether users install high-risk software or not, and the social behavior risk characteristics represent risk indexes generated based on social information, including at least one of whether users release excessive high-risk information or not, whether users join in high-risk rings/groups or not, whether users are added as friends by the high-risk users or not, and whether users actively add high-risk/unassociated users as friends or not.

13. The method of claim 1, wherein the information leakage level represents a level at which the first user is susceptible to active information leakage.

14. The method of claim 1, wherein the determining the information leakage level of the first user according to the first risk feature information specifically includes:

comparing the first risk characteristic information with characteristic information of a user with easy active information leakage to obtain a comparison result;

and evaluating the first risk characteristic information according to the comparison result, and judging the information leakage level of the first user.

15. A risk control device based on authentication, comprising:

the authentication information acquisition module is used for acquiring authentication information submitted by a first user, and the authentication information comprises: at least one of authentication information of a user when logging in an account and authentication information of the user when paying;

16. The apparatus of claim 15, the risk control module, in particular comprising:

17. The apparatus of claim 16, the risk control module further comprising:

18. The apparatus of claim 15, the first risk profile determination module specifically comprising:

19. The apparatus of claim 15, the information leakage level determining module specifically comprises:

20. The apparatus of claim 19, wherein the information leakage risk level model construction sub-module specifically comprises:

21. The apparatus of claim 20, the black sample screening unit, in particular comprising:

22. The apparatus of claim 21, the black sample screening unit further comprising:

23. The apparatus of claim 20, the second risk feature information extracting unit specifically includes:

24. A risk control device based on authentication, comprising:

at least one processor; the method comprises the steps of,