Risk identification method and device for data processing event

Abstract

The invention discloses a risk identification method and device for a data processing event. The method comprises the following steps: analyzing general event attributes and characteristic event attributes of the current data processing event, wherein the general event attributes are common attributes of data processing events of a plurality of data processing systems, and the characteristic eventattributes are special attributes of the data processing events in the corresponding data processing systems; carrying out a first risk identification through first risk identification rules, in which the identification is based on the general event attributes, so that a general identification result is obtained; and carrying out a second risk identification through second risk identification rules, in which the general identification result and the characteristic event attributes are combined for the identification, so that a comprehensive identification result for the current data processing event is obtained. The method and device provided by the invention has the advantages that the workload for rule configuration and maintenance is greatly reduced, so that the maintenance efficiencyfor risk control services can be improved.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a risk identification method for data processing events and a risk identification device for data processing events. Background technique [0002] Risk control means that risk managers take various measures and methods to eliminate or reduce the various possibilities of risk events, or risk control reduces the losses caused by risk events. By deploying SAAS (Software-as-a-Service, Software as a service) can achieve risk control. [0003] SAAS is a completely innovative software application model. The risk control service provider uniformly deploys the risk control software on its own server, and the tenants who use the risk control service (such as e-commerce websites, forums, personal websites, etc.) The Internet purchases risk control software services. When a user generates a data processing event (such as login, transaction, etc.) under the tenant, the ris...

AI Technical Summary

Problems solved by technology

[0005] 1. Existing risk control solutions usually configure and maintain risk identification strategies for each tenant separately, and the workload is relatively large

[0006] 2. For new tenants of risk control services, it takes a long time to deploy risk control identification strategies based on specific data processing service types, so that the early stage of access to risk control services can only be shared by other tenants. Risk control results are used to identify risks, and risk control capabilities are poor

[0007] 3. Since the risk identification processes of different tenants are isolated and unrelated, the risk identification results are not fully utilized, especially when a user involves data processing events of multiple tenants in one behavior process, the above identification mechanism Data processing events that are not associated with multiple tenants are jointly identified, which reduces the accuracy of risk identification

Since it is impossible for remote logins to occur at the same point in time or within a relatively short period of time, it is determined that a risky remote login event has occurred by combining the two events

However, the current risk identification scheme only identifies events that occur under tenant A or tenant B separately. During separate identification, since this device is only logged in in one city, it will not be identified as a risk event. Therefore, this scheme Lack of mechanisms for identifying multiple data processing events associated with different tenants

Images