A service data detection method, system, medium, device and program product

Abstract

This application provides a business data detection method, system, medium, device, and program product, relating to the field of network data security. The method includes: outputting security detection results based on abnormal business data; if the security detection results do not meet a confidence threshold, determining a data object to be invoked based on the abnormal business data; sending the data object to be invoked to a security detection agent, so that the security detection agent can use the data invocation tool corresponding to the data object to obtain security-related data related to the abnormal business data; the security-related data includes at least one of time-related data, content-related data, and identity-related data; and outputting a security detection result that meets the confidence threshold based on the abnormal business data and the security-related data. This application can improve the detection accuracy of business data.

Description

Technical Field

[0001] This application relates to the field of network data security, and in particular to a business data detection method, system, medium, device, and program product. Background Technology

[0002] With the rapid development of information technology, traditional user and entity behavior analysis suffers from problems such as low accuracy and high false alarm rate. It relies on predefined rules and baseline models, which are easily bypassed by attackers, and can lead to the real threats being overlooked.

[0003] Therefore, how to improve the detection accuracy of business data is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this application is to provide a business data detection method, system, medium, device, and program product that improves the accuracy of business data detection by performing inference detection through a business data detection model.

[0005] To address the aforementioned technical problems, this application provides a business data detection method, applied to a business data detection model, with the specific technical solution as follows:

[0006] Obtain abnormal business data;

[0007] Output security detection results based on the abnormal business data;

[0008] If the security detection result does not meet the confidence threshold, the data object to be invoked is determined based on the abnormal business data.

[0009] The data object to be invoked is sent to the security detection agent, so that the security detection agent can use the data invocation tool corresponding to the data object to be invoked to obtain security-related data related to the abnormal business data; the security-related data includes at least one of time-related data, content-related data, and identity-related data.

[0010] Based on the abnormal business data and the security-related data, output a security detection result that meets the confidence threshold.

[0011] Optionally, obtaining abnormal business data includes:

[0012] Obtain abnormal business operation logs from the cloud server;

[0013] The abnormal service operation logs are filtered for expired data and abnormal tokens to obtain the abnormal service data.

[0014] Optionally, if the security-related data includes identity-related data, the data object to be invoked based on the abnormal business data includes:

[0015] Extract the user characteristics corresponding to the abnormal business data, and determine the data object to be invoked based on the user characteristics.

[0016] Optionally, extracting user features corresponding to the abnormal business data and determining the data object to be invoked based on the user features includes:

[0017] Extract user attributes and user operation logs from the abnormal business data;

[0018] Calculate the node weight corresponding to each user operation in the user operation log; each user operation is represented as a user operation vector, which includes an operation type code and an operation timestamp;

[0019] Generate a user operation sequence in chronological order based on the user operations and their corresponding node weights.

[0020] The user identity features are obtained based on the user attributes and the user operation sequence;

[0021] The database associated with the user's identity characteristics is used as the data object to be invoked.

[0022] Optionally, determining the data object to be invoked based on the abnormal business data includes:

[0023] Extract the attribute information features corresponding to the abnormal business data, and use the database with the same attributes as the attribute information features as the data object to be called.

[0024] Optional, also includes:

[0025] The security detection intelligent agent is defined to include the data retrieval tool; the functional functions of the data retrieval tool include interfaces for querying user information, querying authentication information, querying alarm information, and querying download information.

[0026] This application also provides a business data detection system, applied to a business data detection model, including:

[0027] The data acquisition module is used to acquire abnormal business data;

[0028] The preliminary result output module is used to output security detection results based on the abnormal business data;

[0029] The object determination module is used to determine the data object to be called based on the abnormal business data if the security detection result does not meet the confidence threshold.

[0030] The intelligent agent data retrieval module is used to send the data object to be retrieved to the security detection intelligent agent, so that the security detection intelligent agent can use the data retrieval tool corresponding to the data object to retrieve the security-related data related to the abnormal business data; the security-related data includes at least one of time-related data, content-related data, and identity-related data.

[0031] The result output module is used to output a security detection result that meets the confidence threshold based on the abnormal business data and the security-related data.

[0032] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the business data detection method described above.

[0033] This application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor, when calling the computer program in the memory, implements the steps of the business data detection method described above.

[0034] This application also provides a computer program product, including a computer program that, when executed, implements the steps of the business data detection method described above.

[0035] This application provides a business data detection method applied to a business data detection model, comprising: acquiring abnormal business data; outputting a security detection result based on the abnormal business data; if the security detection result does not meet a confidence threshold, determining a data object to be invoked based on the abnormal business data; sending the data object to be invoked to a security detection agent, so that the security detection agent uses a data invocation tool corresponding to the data object to be invoked to obtain security-related data related to the abnormal business data; the security-related data includes at least one of time-related data, content-related data, and identity-related data; and outputting a security detection result that meets the confidence threshold based on the abnormal business data and the security-related data.

[0036] This application enables rapid initial screening of business data by acquiring abnormal business data and outputting preliminary security detection results. When the preliminary security detection results do not reach the confidence threshold, the application identifies the data objects to be invoked based on the abnormal business data, accurately locating key data objects related to the abnormal business data. This makes subsequent data invocation more targeted, further improving the accuracy and efficiency of the detection. The data objects to be invoked are sent to the security detection agent, which uses the corresponding data invocation tool to obtain security-related data related to the abnormal business data. This provides a more sufficient basis for the comprehensive and in-depth analysis of abnormal business data by the business data detection model, helping to more accurately determine the security of abnormal business data. Finally, based on the abnormal business data and security-related data, the application outputs security detection results that meet the confidence threshold, making the detection results more reliable and effectively avoiding false positives and false negatives. This provides strong support for the security of business data, helps to promptly discover and handle potential security threats, and ensures the normal and stable operation of business. It is of great significance for maintaining the security and stability of business systems, while also improving the overall quality of business data detection and providing strong technical support for enterprise data security management and decision-making.

[0037] This application also provides a business data detection system, a computer-readable storage medium, an electronic device, and a computer program product, which have the above-mentioned beneficial effects, and will not be elaborated here. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0039] Figure 1 A flowchart illustrating a business data detection method provided in an embodiment of this application;

[0040] Figure 2 A flowchart illustrating an exemplary business data detection method provided in this application embodiment;

[0041] Figure 3 A schematic diagram of the structure of a business data detection system provided in an embodiment of this application is shown below:

[0042] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0044] See Figure 1 , Figure 1 A flowchart of a business data detection method provided in this application embodiment, the method including:

[0045] S101: Obtain abnormal business data;

[0046] S102: Output security detection results based on the abnormal service data;

[0047] S103: If the security detection result does not meet the confidence threshold, determine the data object to be invoked based on the abnormal business data;

[0048] S104: The data object to be invoked is sent to the security detection agent, so that the security detection agent can use the data invocation tool corresponding to the data object to be invoked to obtain security-related data related to the abnormal business data; the security-related data includes at least one of time-related data, content-related data, and identity-related data.

[0049] S105: Based on the abnormal business data and the security-related data, output a security detection result that meets the confidence threshold.

[0050] In step S101, the acquired abnormal business data can be abnormal information detected during normal system operation and risk prevention and control. There is no limitation on how to acquire business warning information; abnormal events in the business process can be monitored based on the business monitoring model of the business system to generate abnormal business data, and user identity can be detected based on the business data detection method disclosed in this application embodiment.

[0051] In one feasible implementation, abnormal business operation logs from a cloud server can be obtained. These logs are then filtered for expired data and abnormal tokens to obtain the abnormal business data. In practical applications, abnormal business operation logs from an enterprise's cloud server can be acquired. By deploying a log collection system on the cloud server, various log information during business operations can be monitored in real time. When abnormalities are detected in business operations, such as system errors, response timeouts, or data processing failures, the corresponding logs are recorded. Alternatively, abnormal business operation logs can be periodically retrieved from the cloud server's log storage area based on preset abnormal characteristic identifiers (such as specific error codes or abnormal keywords).

[0052] Subsequently, a valid time range for log data can be set. Based on the timestamp information in the log records, expired data exceeding this time range can be filtered out and removed. For example, for troubleshooting business anomalies with high time sensitivity, only anomaly logs from the most recent period (such as the last week or month) can be retained, while for long-term business performance analysis, the time range can be broadened. Alternatively, based on the storage capacity limitations of the log data, expired data can be filtered out according to a certain strategy (such as prioritizing the retention of the most recent logs with higher anomaly levels). Filtering expired data reduces the amount of data processed subsequently, improves data processing efficiency, and avoids interference from expired data in anomaly business analysis, helping to quickly locate and resolve current business anomaly issues.

[0053] When performing exception token filtering, characteristic patterns of exception tokens can be predefined. Exception tokens may include specific error codes, illegal user operation identifiers, non-compliant data format markers, etc. By using text matching, regular expressions, and other methods, log records containing exception tokens are searched and identified in the abnormal business operation logs and retained, while logs without exception tokens are filtered out. Contextual semantic analysis technology can also be combined to perform deep analysis of the log content of abnormal business operation logs to more accurately identify log content related to exception tokens. By accurately filtering out core data closely related to business exceptions, the log data after exception token filtering is more targeted and valuable, providing more accurate and effective data support for subsequent abnormal business data processing, and helping to more deeply uncover the root causes of business exceptions.

[0054] In steps S102 and S103, after acquiring abnormal business data, the business data detection model can first output a security detection result. If the confidence level of the preliminary security detection result is low and does not meet the confidence threshold, i.e., it cannot accurately determine whether the abnormal business data has a security problem, the data object to be called can be determined based on the characteristics and business logic of the abnormal business data. For example, if the abnormal business data is a record of a certain online transaction, and the confidence level of the preliminary detection result is insufficient, it can be determined based on the user information, transaction product information, transaction time, and other characteristics involved in the transaction to call other transaction record data objects, product evaluation data objects, and network traffic data objects within the transaction time period related to the user, so as to obtain more relevant information to further assess the security risks. Here, no specific limit is made on the confidence threshold, which can be set by those skilled in the art according to the business data detection accuracy requirements in the actual application scenario.

[0055] A security detection agent can be a software entity with autonomous decision-making and data retrieval capabilities. After the information of the data object to be retrieved is sent to the security detection agent, the agent selects an appropriate data retrieval tool based on information such as the type and storage location of the data object. For example, if the data object is stored in a relational database, the agent can use an SQL query tool to retrieve the data; if the data is stored in a distributed file system, it can use a corresponding file reading tool. By applying the data retrieval tool, the security detection agent can obtain security-related data related to abnormal business data, such as time-related data (time stamps for data generation, transmission, and processing), content-related data (the specific content, format, and structure of the data), and identity-related data (user identity information, permission information, etc.).

[0056] To ensure the data retrieval capabilities of the security detection agent, a data retrieval tool included in the security detection agent can be predefined. The data retrieval tool's functionalities include interfaces for querying user information, querying authentication information, querying alarm information, and querying download information.

[0057] In step S104, it is necessary to obtain the security-related data returned by the data object to be invoked. The security-related data returned by the data object to be invoked may contain multiple types of data, specifically including at least one of time-related data, content-related data, and identity-related data.

[0058] Time-related data refers to information related to the time of user operations, such as the frequency of user operations, the time interval between operations, and the regularity of operation times. By analyzing time-related data, it can be determined whether user operations conform to their normal behavioral patterns. If the time interval between user operations suddenly becomes abnormally frequent, or if the operation time changes from the user's usual activity time to irregular times such as late at night, it can be used to indicate abnormal identity.

[0059] Content-related data refers to information related to user actions, such as transaction amounts, types of goods traded, and transaction notes. For transaction-based businesses, a sudden and significant increase in a user's transaction amount, or a change in the types of goods traded that differ from the user's previous trading habits, can indicate potential identity risk. For example, if a user who usually buys everyday items suddenly starts frequently purchasing high-value electronic products with large transaction amounts, further verification of the user's identity is warranted.

[0060] Identity-related data refers to data directly related to a user's identity information, such as the user's identity verification history and identity information change history. If a user's identity verification history shows that they have failed verification multiple times in the past, or if the user's identity information has recently changed, the corresponding detection weight needs to be increased during the identity verification process to focus on verifying the user's identity.

[0061] By acquiring various types of security-related data, business data can be inspected from multiple dimensions. Security-related data can be directly returned by the data object to be invoked, or it can be obtained through further data querying and analysis. For example, for time-related data, user operation logs in the business system can be queried to statistically analyze the frequency and time intervals of user operations in different time periods. For content-related data, transaction records can be analyzed to extract information such as transaction amount and product type. For identity-related data, the user's identity information management database can be queried to obtain data such as the user's authentication history and information change records. Acquiring security-related data provides comprehensive and detailed data support for subsequent authentication.

[0062] In step S105 thereafter, the business data detection model performs another in-depth analysis on the acquired abnormal business data and security-related data until a security detection result that meets the confidence threshold is obtained.

[0063] Furthermore, if the security detection agent has already traversed all traversable data objects to be invoked, meaning all data retrieval tools have been exhausted, the confidence threshold can be adjusted to directly output the security detection result. Correspondingly, the security detection result should also include the corresponding confidence threshold.

[0064] Safety inspection results can be binary, indicating whether a risk exists or whether an anomaly exists. They can also be multivariate, including results such as the need for further verification in addition to the presence or absence of risk or anomalies.

[0065] This application embodiment acquires abnormal business data and outputs preliminary security detection results based on this data, enabling rapid initial screening of business data. When the preliminary security detection results do not reach the confidence threshold, the data objects to be invoked are determined based on the abnormal business data, accurately locating key data objects related to the abnormal business data. This makes subsequent data invocation more targeted, further improving the accuracy and efficiency of the detection. The data objects to be invoked are sent to the security detection intelligent agent, which uses the corresponding data invocation tool to obtain security-related data related to the abnormal business data. This provides more sufficient evidence for the comprehensive and in-depth analysis of abnormal business data by the business data detection model, helping to more accurately determine the security of abnormal business data. Finally, based on the abnormal business data and security-related data, a security detection result that meets the confidence threshold is output, making the detection results more reliable and effectively avoiding false positives and false negatives. This provides strong support for the security of business data, helps to promptly discover and handle potential security threats, and ensures the normal and stable operation of business. It is of great significance for maintaining the security and stability of business systems, and also improves the overall quality of business data detection, providing strong technical support for enterprise data security management and decision-making.

[0066] Based on the above embodiments, as a preferred embodiment, if the security-related data includes identity-related data, the user characteristics corresponding to the abnormal business data can be extracted, and the data object to be invoked can be determined based on the user characteristics.

[0067] When determining the data object to be invoked based on the aforementioned user characteristics, data association rules can be used. Abnormal business data may contain key user identification information, such as user accounts and user device identifiers. Through this identification information, detailed user data associated with the user can be retrieved from the business database, including the user's registration information, transaction history, and behavior logs. For example, if the abnormal business data relates to a suspicious transaction, all of the user's transaction records in the system, as well as their personal information filled in during registration, such as name, contact information, and ID number (if applicable), can be extracted from the user account in the transaction records. By extracting user data, it is possible to ensure that user data closely related to the abnormal business data is obtained, enabling rapid identification of users involved in business alerts and providing preliminary data support for risk assessment and identity verification.

[0068] In a more specific implementation, the following steps may be included:

[0069] A1: Extract user attributes and user operation logs from the abnormal business data;

[0070] A2: Calculate the node weight of each user operation corresponding to the user operation in each user operation log; each user operation is represented as a user operation vector, which includes an operation type code and an operation timestamp;

[0071] A3: Generate a user operation sequence in chronological order based on the user operations and their corresponding node weights;

[0072] A4: Obtain user identity features based on the user attributes and the user operation sequence;

[0073] A5: Use the database associated with the user's identity features as the data object to be invoked.

[0074] After acquiring abnormal business data, analyze the data structure to identify the user attributes it contains. User attributes may include, but are not limited to, user account information (such as username, user ID, and other fields used to uniquely identify users), basic information (such as gender, age range, region, etc.), and the user's role in the business (such as ordinary user, member user, administrator user, etc.). User attribute fields can be located and extracted by writing data parsing scripts (using programming languages ​​such as Python, Java, etc.) based on the format of the abnormal business data (such as JSON, XML, relational database table structure, etc.).

[0075] For user operation logs, relevant content can be traversed within the abnormal business data. Operation logs typically record various user behaviors within the business system, such as login time, logged-in device, accessed pages or functional modules, performed operations (e.g., submitting orders, modifying information, querying records), and operation timestamps. Complete user operation log records can be extracted according to the log's storage format (which may be a text log file, a log table in a database, etc.).

[0076] User attributes can include identity features. There are no restrictions on how to extract these features; various technical means can be used. For basic user registration information, such as name, ID number, and passport number, explicit identity information can be directly extracted from user data as identity features.

[0077] Beyond basic identity information, user behavioral characteristics can be extracted as user attributes. For example, user operating habits, including operating time preferences (whether operations are frequently performed at night or during the day), operating device type (e.g., whether the user primarily uses a mobile phone or computer), and operating location, can be extracted by analyzing long-term user behavior log data. Taking operating time preferences as an example, by statistically analyzing login time data over a user's defined historical period (e.g., the past year), it can be determined which time of day the user logs in most frequently; this time period can then be considered a behavioral characteristic of the user. User behavioral characteristics reflect a user's true behavioral patterns and are crucial for identifying abnormal operating behaviors. Furthermore, biometric information, such as fingerprints, facial recognition information, and iris information, can also be extracted as user attributes. Biometric information can be obtained through biometric data actively provided by the user during registration or legally collected when the user operates a device that supports biometrics.

[0078] In step A1, SQL queries can be used to access the database storing user data and extract a data table containing user attributes (such as age, gender, and region) and user operation logs (recording various user behaviors in the system, such as logging in, browsing pages, and purchasing goods). Alternatively, user attribute and operation log data can be received via a data interface according to the interface protocol. User attributes help to understand the basic user profile, while user operation logs record user behavior patterns and can serve as a key basis for subsequent analysis of user behavior patterns and the mining of user identity characteristics.

[0079] In step A2, weights can be set based on rules. Different weights can be assigned to different operation types based on business experience and the assessment of the importance of user actions. For example, in an e-commerce system, purchasing a product might be given a higher weight, browsing product details pages a slightly lower weight, and logging in an even lower weight, because purchasing behavior better reflects the user's key intent and value. Alternatively, machine learning algorithms can be used to calculate weights, using historical user operation data as training data. By learning the contribution of different operations to user behavior patterns, the weight of each operation can be derived. This step aims to quantify the importance of user operations using node weights, so that when generating user operation sequences subsequently, the criticality of user behavior can be more accurately reflected, which is beneficial for more accurately characterizing user identity features.

[0080] In step A3, the extracted user operation logs can first be sorted by operation timestamps to ensure that the operations are arranged in the actual order of occurrence. Combining the node weight of each operation, the user operations are transformed into a weighted operation sequence. For example, using the operation timestamp as the timeline, each time point corresponds to a user operation, and the weight of that operation is used as the weight label for that time point, forming an ordered sequence that contains both operation information and weight information. By restoring the chronological order of user behavior and incorporating operation weights, the user operation sequence can more realistically reflect the dynamic process of user behavior and the influence of key behaviors.

[0081] In step A4, statistical analysis can be used to correlate user attributes with user operation sequences. For example, by statistically analyzing the frequency of specific high-weight operations in the operation sequences of users of different age groups, it can be found that the frequency of a certain type of high-weight operation is much higher in the younger user group than in other age groups. This leads to the conclusion that the younger user group has a unique behavioral tendency in this operation, which can be considered as one of their identity characteristics.

[0082] By comprehensively mining user identity features through a combination of static attributes and dynamic behaviors, the resulting user identity features are more complete and accurate, better reflecting the user's true identity and behavioral tendencies within the system. This provides strong support for applications such as personalized recommendations and user profile construction. Finally, the database associated with user identity features can be used as the data object to be invoked.

[0083] In summary, this application's embodiments, by acquiring abnormal business data and extracting relevant user data, can accurately focus on business scenarios and corresponding users that may have security risks. By extracting user identity features from user data, the key attributes of the detection objects are further refined. By calling an identity recognition intelligent agent to read user identity features and determine the data objects to be called, and leveraging the agent's efficient processing capabilities and intelligent analysis algorithms, key data objects closely related to user business data detection can be quickly and accurately filtered from a large amount of data. When acquiring the security-related data returned by the data objects to be called, at least one of time-related data, content-related data, and identity-related data is included. Time-related data can reflect the temporal patterns and abnormal changes in user behavior, content-related data can reveal the specific content and potential risks of user behavior, and identity-related data is directly related to the authenticity and legitimacy of user identity. By integrating multi-dimensional data, a comprehensive and three-dimensional identity security assessment system can be constructed, enhancing the accuracy and reliability of business data detection. As can be seen, the identity verification method based on comprehensive data and strict rules in this application can effectively identify security threats such as false identities and abnormal behavior, help to prevent illegal operations in a timely manner, protect the safe and stable operation of the system and business, and provide users with reliable identity security.

[0084] In other implementations, attribute information features corresponding to abnormal business data can be extracted, and databases with the same attributes as the attribute information features can be used as data objects to be called.

[0085] Analyze the data structure of abnormal business data, parsing its various attribute fields, such as timestamps, data sources, data types, and related business modules. Use data parsing tools to extract these attribute fields. For example, for the timestamp attribute, extract its specific date and time format. Furthermore, feature extraction algorithms from machine learning can be used to automatically identify and extract attribute information features that have a key impact on anomaly detection.

[0086] Based on the extracted attribute information features, matching rules are determined. Simple equality matching can be used, comparing the attribute values ​​of the data object to be matched one-to-one with the extracted feature attribute values; a complete match is considered successful. Fuzzy matching can also be used, considering the potential for data error or variability. A similarity threshold is set; when the similarity between the attribute value of the data object and the feature attribute value reaches the threshold, a match is determined. Alternatively, multiple matching algorithms can be combined, such as rule-based matching and statistical matching, to improve accuracy and robustness. Finally, the database containing successfully matched data is used as the data object to be invoked.

[0087] See Figure 2 , Figure 2 This is a flowchart illustrating an exemplary business data detection method provided in an embodiment of this application.

[0088] Data, namely abnormal business operation logs, is sent to the cloud. Expired data and abnormal tokens are then filtered. This data is then fed into the business data detection model, which outputs preliminary security detection results.

[0089] If the initial security detection results fail to meet the confidence threshold, the business data detection model executes a distributed inference service to determine the data object to be invoked. This result is then sent to the security detection agent, which uses a data invocation tool to retrieve alarm logs (corresponding security-related data) from the data object (i.e., the data block) and returns them to the business data detection model. Subsequently, combining the invoked alarm logs and abnormal business operation logs, the business data detection model outputs the security detection results again.

[0090] If the confidence threshold still cannot be met, repeat the above process to use more data retrieval tools to obtain more or other types of alarm logs and achieve multi-round dialogue.

[0091] Until all database interface calls are completed, or the output security detection results meet the confidence threshold, a response analysis for the abnormal business data is generated as the final security detection result.

[0092] Furthermore, during each dialogue, the security-related data returned by the database interface can be filtered for abnormal tokens.

[0093] See Figure 3 , Figure 3 This application provides a schematic diagram of a business data detection system structure according to an embodiment of the present application. The present application also provides a business data detection device, including:

[0094] The data acquisition module is used to acquire abnormal business data;

[0095] The preliminary result output module is used to output security detection results based on the abnormal business data;

[0096] The object determination module is used to determine the data object to be called based on the abnormal business data if the security detection result does not meet the confidence threshold.

[0097] The intelligent agent data retrieval module is used to send the data object to be retrieved to the security detection intelligent agent, so that the security detection intelligent agent can use the data retrieval tool corresponding to the data object to retrieve the security-related data related to the abnormal business data; the security-related data includes at least one of time-related data, content-related data, and identity-related data.

[0098] The result output module is used to output a security detection result that meets the confidence threshold based on the abnormal business data and the security-related data.

[0099] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, can implement the steps of the methods provided in the above embodiments. The storage medium may include various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0100] This application also provides an electronic device that may include a memory and a processor. The memory stores a computer program, and when the processor invokes the computer program in the memory, it can implement the steps of the method provided in the above embodiments. Of course, the electronic device may also include various network interfaces, power supplies, and other components. Please see [link to relevant documentation]. Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device in this embodiment may include: a processor 2101 and a memory 2102.

[0101] Optionally, the electronic device may also include a communication interface 2103, an input unit 2104, a display 2105, and a communication bus 2106.

[0102] The processor 2101, memory 2102, communication interface 2103, input unit 2104, and display 2105 all communicate with each other through the communication bus 2106.

[0103] In this embodiment of the application, the processor 2101 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, an off-the-shelf programmable gate array, or other programmable logic devices.

[0104] The processor can call programs stored in memory 2102. Specifically, the processor can execute the operations performed by the electronic device in the above embodiments.

[0105] The memory 2102 is used to store one or more programs, which may include program code, including computer operation instructions. In this embodiment, the memory stores at least a program for implementing the following functions:

[0106] Obtain abnormal business data;

[0107] Output security detection results based on the abnormal business data;

[0108] If the security detection result does not meet the confidence threshold, the data object to be invoked is determined based on the abnormal business data.

[0109] The data object to be invoked is sent to the security detection agent, so that the security detection agent can use the data invocation tool corresponding to the data object to be invoked to obtain security-related data related to the abnormal business data; the security-related data includes at least one of time-related data, content-related data, and identity-related data.

[0110] Based on the abnormal business data and the security-related data, output a security detection result that meets the confidence threshold.

[0111] In one possible implementation, the memory 2102 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during the use of the computer.

[0112] In addition, memory 2102 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0113] The communication interface 2103 can be an interface for a communication module, such as the interface for a GSM module.

[0114] This application may also include a display 2105 and an input unit 2104, etc.

[0115] Figure 4 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of this application. In practical applications, the electronic device may include more than [other components]. Figure 4 More or fewer components as shown, or combinations of certain components.

[0116] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. As the system provided in the embodiments corresponds to the method provided in the embodiments, the description is relatively simple; relevant parts can be found in the method section.

[0117] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this application. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

[0118] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A business data detection method, applied to a business data detection model, characterized in that, include: Obtain abnormal business data; Output security detection results based on the abnormal business data; If the security detection result does not meet the confidence threshold, the data object to be invoked is determined based on the abnormal business data. The data object to be invoked is sent to the security detection agent so that the security detection agent can use the data invocation tool corresponding to the data object to be invoked to obtain security-related data related to the abnormal business data. The security-related data includes at least one of time-related data, content-related data, and identity-related data; Based on the abnormal business data and the security-related data, output a security detection result that meets the confidence threshold.

2. The business data detection method according to claim 1, characterized in that, Obtaining abnormal business data includes: Obtain abnormal business operation logs from the cloud server; The abnormal service operation logs are filtered for expired data and abnormal tokens to obtain the abnormal service data.

3. The business data detection method according to claim 2, characterized in that, If the security-related data includes identity-related data, the data objects to be invoked based on the abnormal business data include: Extract the user characteristics corresponding to the abnormal business data, and determine the data object to be invoked based on the user characteristics.

4. The business data detection method according to claim 3, characterized in that, Extracting user characteristics corresponding to the abnormal business data, and determining the data object to be invoked based on the user characteristics, includes: Extract user attributes and user operation logs from the abnormal business data; Calculate the node weight corresponding to each user operation in the user operation log; each user operation is represented as a user operation vector, which includes an operation type code and an operation timestamp; Generate a user operation sequence in chronological order based on the user operations and their corresponding node weights. The user identity features are obtained based on the user attributes and the user operation sequence; The database associated with the user's identity characteristics is used as the data object to be invoked.

5. The business data detection method according to claim 2, characterized in that, Based on the abnormal business data, the data objects to be invoked include: Extract the attribute information features corresponding to the abnormal business data, and use the database with the same attributes as the attribute information features as the data object to be called.

6. The business data detection method according to claim 1, characterized in that, Also includes: Define the data retrieval tools included in the security detection intelligent agent; The data retrieval tool includes interfaces for querying user information, querying authentication information, querying alarm information, and querying download information.

7. A business data detection system, applied to a business data detection model, characterized in that, include: The data acquisition module is used to acquire abnormal business data; The preliminary result output module is used to output security detection results based on the abnormal business data; The object determination module is used to determine the data object to be called based on the abnormal business data if the security detection result does not meet the confidence threshold. The intelligent agent data retrieval module is used to send the data object to be retrieved to the security detection intelligent agent, so that the security detection intelligent agent can use the data retrieval tool corresponding to the data object to be retrieved to obtain security-related data related to the abnormal business data. The security-related data includes at least one of time-related data, content-related data, and identity-related data; The result output module is used to output a security detection result that meets the confidence threshold based on the abnormal business data and the security-related data.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the business data detection method as described in any one of claims 1-6.

9. An electronic device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program, and the processor, when calling the computer program in the memory, implements the steps of the business data detection method as described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program, which, when executed, implements the steps of the method as described in any one of claims 1 to 6.

Images