Risk event control method, device and system

Abstract

The present invention provides a risk event control method, device and system. The method includes: obtaining the user's operation information, comparing the operation information with the historical operation information in the middle-stage database, and judging whether the user's operation meets the preset release conditions; if not, blocking the user operation corresponding to the operation information, and adding an audit label to the operation information; sending the operation information to the middle-stage database, the middle-stage database is used to audit the operation information according to the audit label and return the audit result; processing the user operation according to the audit result, and sending the processing result and the audit result to the front desk via the middle-stage database for visual display. The present invention uses the background risk monitoring processing to link with the middle-stage database to judge the risk situation, and combines with visual display to realize automatic processing of risk events, ensuring all-day work, and there is no problem of unmanned duty at special times and holidays, which greatly saves the cost of human audit and reduces the risk processing time.

Description

Technical Field

[0001] The present invention relates to the field of intelligent risk control technology, and in particular to a risk event control method, device and system. Background Art

[0002] There are two common problems in the current intelligent risk control of financial channels. One is that it is difficult to quickly develop and deploy real-time risk situation charts; the other is that detected risks cannot be automatically processed in a timely manner. Automatic risk processing is a major problem. Different financial transaction risk events often need to be judged based on multiple attributes of the transaction, such as transaction amount, transaction volume, login location IP and other complex flow information. If risks are all processed manually, it will be difficult to meet the current risk control needs of enterprises, and there may be situations where they are not processed in a timely manner or misjudgments. Summary of the invention

[0003] The main purpose of the embodiments of the present invention is to provide a risk event control method, device and system to realize automatic processing of risk events, thereby avoiding untimely processing and misjudgment while meeting risk control requirements.

[0004] In order to achieve the above object, an embodiment of the present invention provides a method, which includes:

[0005] Obtain the user's operation information, compare the operation information with the historical operation information in the middle platform database, and determine whether the user's operation meets the preset release conditions;

[0006] If the preset release condition is not met, the user operation corresponding to the operation information is blocked, and a review tag is added to the operation information;

[0007] Sending the operation information with the audit tag added to the middle platform database, the middle platform database is used to audit the operation information according to the audit tag and return the audit result;

[0008] The user operation corresponding to the operation information is processed according to the audit result, and the processed result and the audit result are sent to the front-end via the middle-end database for visual display.

[0009] Optionally, in one embodiment of the present invention, the operation information includes login information and transaction information, wherein the login information includes an IMEI code, a login IP address, and a login GPS address, and the transaction information includes a transaction amount, a transaction time, and a number of transactions.

[0010] Optionally, in one embodiment of the present invention, comparing the operation information with the historical operation information in the middle office database to determine whether the user's operation meets the preset release conditions includes: comparing the login information or transaction information with the historical login information or historical transaction information in the middle office database, and scoring the user operation corresponding to the login information or transaction information; determining whether the scoring result exceeds a preset threshold, if it exceeds the preset threshold, determining that the user's operation does not meet the preset release conditions, and if it does not exceed the preset threshold, determining that the user's operation meets the preset release conditions.

[0011] Optionally, in one embodiment of the present invention, comparing the login information with the historical login information in the middle station database and scoring the user operation corresponding to the login information includes: traversing the historical login information in the middle station database, determining whether the IMEI code, login IP address and login GPS address in the login information are present in the historical login information, and scoring the user operation corresponding to the login information according to the determination result.

[0012] Optionally, in one embodiment of the present invention, the transaction information is compared with the historical transaction information in the middle platform database, and the user operation corresponding to the transaction information is scored, including: comparing the transaction amount, transaction time and number of transactions in the transaction information with the historical transaction information in the middle platform database, judging whether the transaction amount, transaction time and number of transactions are consistent with the historical transaction information, and scoring the user operation corresponding to the transaction information according to the judgment result.

[0013] Optionally, in one embodiment of the present invention, the review label includes a manual review label and an intelligent review label.

[0014] Optionally, in one embodiment of the present invention, the operation information with the audit tag added is sent to the middle station database, and the middle station database is used to audit the operation information according to the audit tag, and return the audit result, including: sending the operation information with the manual audit tag added to the middle station database, and the middle station database is used to perform a manual outbound audit on the operation information according to the manual audit tag, and return the manual audit result.

[0015] Optionally, in one embodiment of the present invention, the operation information with the audit tag added is sent to the middle station database, and the middle station database is used to audit the operation information according to the audit tag, and return the audit result, including: sending the operation information with the smart audit tag added to the middle station database, and the middle station database is used to perform a verification code audit on the operation information according to the smart audit tag, and return the smart audit result.

[0016] The embodiment of the present invention further provides a risk event control device, the device comprising:

[0017] The information comparison module is used to obtain the user's operation information, compare the operation information with the historical operation information in the middle station database, and determine whether the user's operation meets the preset release conditions;

[0018] A label adding module, used to block the user operation corresponding to the operation information and add a review label to the operation information if the preset release condition is not met;

[0019] An information review module, used to send the operation information with the review tag added to the middle platform database, and the middle platform database is used to review the operation information according to the review tag and return the review result;

[0020] The visualization display module is used to process the user operation corresponding to the operation information according to the audit result, and send the processed result and the audit result to the front end via the middle end database for visualization display.

[0021] Optionally, in one embodiment of the present invention, the operation information includes login information and transaction information, wherein the login information includes an IMEI code, a login IP address, and a login GPS address, and the transaction information includes a transaction amount, a transaction time, and a number of transactions.

[0022] Optionally, in one embodiment of the present invention, the information comparison module includes: a scoring unit, used to compare the login information or transaction information with the historical login information or historical transaction information in the middle office database, and score the user operation corresponding to the login information or transaction information; a judgment unit, used to judge whether the scoring result exceeds a preset threshold, if it exceeds the preset threshold, it is judged that the user's operation does not meet the preset release conditions, and if it does not exceed the preset threshold, it is judged that the user's operation meets the preset release conditions.

[0023] Optionally, in one embodiment of the present invention, the scoring unit is also used to traverse the historical login information in the middle station database, determine whether the IMEI code, login IP address and login GPS address in the login information exist in the historical login information, and score the user operation corresponding to the login information according to the judgment result.

[0024] Optionally, in one embodiment of the present invention, the scoring unit is also used to compare the transaction amount, transaction time and number of transactions in the transaction information with the historical transaction information in the middle office database, to determine whether the transaction amount, transaction time and number of transactions are consistent with the historical transaction information, and to score the user operation corresponding to the transaction information according to the judgment result.

[0025] Optionally, in one embodiment of the present invention, the review label includes a manual review label and an intelligent review label.

[0026] Optionally, in one embodiment of the present invention, the information review module is also used to send the operation information with a manual review tag added to the middle platform database, and the middle platform database is used to perform a manual outbound review of the operation information according to the manual review tag and return the manual review result.

[0027] Optionally, in one embodiment of the present invention, the information review module is also used to send the operation information with the smart review tag added to the middle platform database, and the middle platform database is used to perform verification code review on the operation information according to the smart review tag and return the smart review result.

[0028] The embodiment of the present invention also provides a risk event control system, the system comprising: a background monitoring engine, a middle-stage database and a front-end display module;

[0029] The backend monitoring engine obtains the user's operation information, compares the operation information with the historical operation information in the middle-end database, and determines whether the user's operation meets the preset release conditions; if it does not meet the preset release conditions, blocks the user operation corresponding to the operation information, adds an audit tag to the operation information, and sends the operation information with the audit tag to the middle-end database;

[0030] The middle-end database audits the operation information according to the audit tag, and sends the audit result to the background monitoring engine and the front-end display module;

[0031] The backend monitoring engine processes the user operation corresponding to the operation information according to the audit result, and sends the processing result to the frontend display module;

[0032] The front-end display module visually displays the audit results and processing results.

[0033] Optionally, in one embodiment of the present invention, the operation information includes login information and transaction information, wherein the login information includes an IMEI code, a login IP address, and a login GPS address, and the transaction information includes a transaction amount, a transaction time, and a number of transactions.

[0034] Optionally, in one embodiment of the present invention, the background monitoring engine is also used to: compare the login information or transaction information with the historical login information or historical transaction information in the middle office database, and score the user operations corresponding to the login information or transaction information; determine whether the scoring result exceeds a preset threshold, if it exceeds the preset threshold, then determine that the user's operation does not meet the preset release conditions; if it does not exceed the preset threshold, then determine that the user's operation meets the preset release conditions.

[0035] Optionally, in one embodiment of the present invention, the background monitoring engine is also used to traverse the historical login information in the middle platform database, determine whether the IMEI code, login IP address and login GPS address in the login information are in the historical login information, and score the user operation corresponding to the login information according to the judgment result.

[0036] Optionally, in one embodiment of the present invention, the background monitoring engine is also used to compare the transaction amount, transaction time and number of transactions in the transaction information with the historical transaction information in the middle office database, to determine whether the transaction amount, transaction time and number of transactions are consistent with the historical transaction information, and to score the user operation corresponding to the transaction information according to the judgment result.

[0037] Optionally, in one embodiment of the present invention, the review label includes a manual review label and an intelligent review label.

[0038] Optionally, in one embodiment of the present invention, the middle station database is also used to receive operation information with manual review tags added, perform manual outbound review on the operation information according to the manual review tags, and return the manual review results.

[0039] Optionally, in one embodiment of the present invention, the middle platform database is also used to receive operation information with smart audit tags added, perform verification code audit on the operation information according to the smart audit tags, and return the smart audit results.

[0040] Optionally, in one embodiment of the present invention, the front-end display module is also used to visually display the review results and processing results according to preset display rules.

[0041] Optionally, in one embodiment of the present invention, the foreground display module is also used to receive interaction instructions input by the user, and send the interaction instructions to the middle-end database, so that the middle-end database performs data maintenance according to the interaction instructions.

[0042] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the program.

[0043] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above method.

[0044] The present invention conducts risk situation judgment through the linkage between background risk monitoring and processing and the middle-end database, and combines it with visual display to realize automatic monitoring and processing of risk events, ensuring round-the-clock work, eliminating the problem of unmanned duty at special times and holidays, greatly saving manpower review costs, and reducing risk processing time. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 This is a flow chart of a risk event control method according to an embodiment of the present invention;

[0047] Figure 2 is a flow chart of comparing operation information with historical operation information in an embodiment of the present invention;

[0048] Figure 3 This is a schematic diagram of the structure of a risk event control device according to an embodiment of the present invention;

[0049] Figure 4 This is a schematic diagram of the structure of the information comparison module in an embodiment of the present invention;

[0050] Figure 5 This is a schematic diagram of the structure of a risk event control system in an embodiment of the present invention;

[0051] Figure 6 This is a schematic diagram of the workflow of the risk event control system in an embodiment of the present invention;

[0052] Figure 7 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] Embodiments of the present invention provide a risk event control method, device and system.

[0054] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] like Figure 1 The flowchart of a risk event control method according to an embodiment of the present invention is shown. The risk event control method according to the present invention can use the background intelligent risk control engine as the execution subject. The method shown in the figure includes:

[0056] Step S1, obtain the user's operation information, compare the operation information with the historical operation information in the middle station database, and determine whether the user's operation meets the preset release conditions.

[0057] The operation information input by the user can be obtained through the front-end application software, and the operation information includes login information and transaction information. The collected operation information input by the user is compared with the historical operation information stored in the middle-end database, and the consistency between the operation information and the historical operation information is used to determine whether the user's operation meets the preset release conditions.

[0058] Specifically, the user's operation can be scored based on the consistency between the operation information and the historical operation information. For example, whether the login GPS address in the login information exists in the historical login information of the user, if it does, what is the proportion of the login GPS address, and the proportion value can be used as the score of the user's login operation. By comparing the score of the user's login operation with the preset threshold, it is determined whether the user's login operation falls within the preset threshold range. If it falls within the preset threshold range, it is determined that the user's login operation meets the preset release conditions, and the login operation can be released. Among them, if it does not fall within the preset threshold range, it is determined that the user's login operation does not meet the preset release conditions, and the login operation is suspended or blocked.

[0059] Furthermore, the score of the user operation behavior can also be obtained by scoring the transaction information in the operation information, for example, by comparing the transaction amount in the transaction information with the transaction amount in the user's historical transaction information. Specifically, the transaction amount can be subtracted from the average of the historical transaction amounts, and the absolute value of the difference is used as the score of the transaction operation.

[0060] In addition, monitoring of risk events includes but is not limited to: business transaction volume (transaction volume monitoring), transaction amount (large amount anomalies, etc.), risk event pre-interception volume (flow monitoring), risk event interception amount, risk event in-process blocking volume, risk event in-process blocking amount, anti-phishing monitoring (phishing website monitoring), brute force disassembly monitoring (login flow monitoring), overseas high-risk IP addresses, etc.

[0061] Step S2: If the preset release condition is not met, the user operation corresponding to the operation information is blocked, and a review tag is added to the operation information.

[0062] When a user operation does not meet the preset release conditions and is blocked or suspended, an audit tag is added to the operation information. Audit tags include manual audit tags and intelligent audit tags.

[0063] Step S3, sending the operation information with the audit tag added to the middle platform database, the middle platform database is used to audit the operation information according to the audit tag and return the audit result.

[0064] Among them, after the operation information with the audit tag is sent to the middle-office database, the middle-office database will audit the operation information. Specifically, the middle-office database will verify the information by initiating an outbound call to the user based on the manual audit tag. Furthermore, the outbound call can be automatically made through the outbound call platform without the need for business personnel, so as to avoid the problem that risk events cannot be handled in a timely and effective manner due to no one on duty at special times and holidays.

[0065] Step S4, processing the user operation corresponding to the operation information according to the audit result, and sending the processed result and the audit result to the front-end via the middle-end database for visual display.

[0066] Among them, the user operation is processed according to the audit result returned by the middle-end database. Specifically, if the audit result is passed, the blocked or suspended operation is released; if the audit result is not passed, the user operation is judged as a risk event and blocked. The processed result is sent to the middle-end database, and the middle-end database sends the audit result and processing result to the front-end for visual display.

[0067] Furthermore, users can customize the data and format of the visual display, and enter operation instructions through the front-end to maintain the data in the middle-end database.

[0068] As an embodiment of the present invention, the operation information includes login information and transaction information, wherein the login information includes the IMEI code, login IP address and login GPS address, and the transaction information includes the transaction amount, transaction time and number of transactions.

[0069] In this embodiment, if Figure 2 As shown, the operation information is compared with the historical operation information in the middle station database to determine whether the user's operation meets the preset release conditions, including:

[0070] Step S21, compare the login information or transaction information with the historical login information or historical transaction information in the middle platform database, and score the user operation corresponding to the login information or transaction information.

[0071] For example, whether the login GPS address in the login information exists in the historical login information of the user, and if so, what is the proportion of the login GPS address, and the proportion value can be used as the score of the user's login operation. Furthermore, the score of the user's operation behavior can also be obtained by scoring the transaction information in the operation information, for example, by comparing the transaction amount in the transaction information with the transaction amount in the historical transaction information of the user. Specifically, the transaction amount can be subtracted from the average of the historical transaction amounts, and the absolute value of the difference can be used as the score of the transaction operation.

[0072] Step S22, determine whether the scoring result exceeds the preset threshold. If it exceeds the preset threshold, it is determined that the user's operation does not meet the preset release conditions. If it does not exceed the preset threshold, it is determined that the user's operation meets the preset release conditions.

[0073] Specifically, by comparing the score of the user's login operation with the preset threshold, it is determined whether the user's login operation falls within the preset threshold range. If it falls within the preset threshold range, it is determined that the user's login operation meets the preset release condition, and the login operation can be released. If it does not fall within the preset threshold range, it is determined that the user's login operation does not meet the preset release condition, and the login operation is suspended or blocked.

[0074] In this embodiment, the login information is compared with the historical login information in the middle platform database, and the user operation corresponding to the login information is scored, including: traversing the historical login information in the middle platform database, determining whether the IMEI code, login IP address and login GPS address in the login information exist in the historical login information, and scoring the user operation corresponding to the login information according to the determination result.

[0075] In this embodiment, the transaction information is compared with the historical transaction information in the middle platform database, and the user operation corresponding to the transaction information is scored, including: comparing the transaction amount, transaction time and number of transactions in the transaction information with the historical transaction information in the middle platform database, judging whether the transaction amount, transaction time and number of transactions are consistent with the historical transaction information, and scoring the user operation corresponding to the transaction information according to the judgment result.

[0076] Among them, it is determined whether the IMEI code, login IP address and login GPS address in the login information exist in the user's historical login information. If they exist, the proportion value is used for scoring. If they do not exist, it is determined that the login operation does not meet the preset release conditions. In addition, it is determined whether the transaction amount, transaction time and number of transactions are consistent with the historical transaction information. If they are consistent, they are subtracted from the average of the historical amount, the historical average transaction time and the average of the historical number of transactions, and the absolute value of the difference is used as the score; if they are inconsistent, it is determined that the transaction operation does not meet the preset release conditions.

[0077] As an embodiment of the present invention, the review label includes a manual review label and an intelligent review label.

[0078] In this embodiment, the operation information with the audit tag added is sent to the middle station database, and the middle station database is used to audit the operation information according to the audit tag, and return the audit result including: the operation information with the manual audit tag is sent to the middle station database, and the middle station database is used to perform a manual outbound call audit on the operation information according to the manual audit tag, and return the manual audit result.

[0079] Among them, the middle-office database verifies the information by initiating manual outbound calls to users based on manual review labels. Furthermore, manual outbound calls can be automatically made through the outbound call platform without the need for business personnel, thereby avoiding the problem that risk events cannot be handled in a timely and effective manner due to no one on duty at special times and holidays.

[0080] In this embodiment, the operation information with the audit tag added is sent to the middle station database, and the middle station database is used to audit the operation information according to the audit tag, and return the audit result including: sending the operation information with the smart audit tag added to the middle station database, and the middle station database is used to perform verification code audit on the operation information according to the smart audit tag, and return the smart audit result.

[0081] Among them, the middle-office database sends a verification code to the user for information verification based on the intelligent review label. Furthermore, the verification code can be automatically verified by sending SMS or email without the need for business personnel, thereby avoiding the problem that risk events cannot be handled in a timely and effective manner due to no one on duty at special times and holidays.

[0082] like Figure 3 FIG. 1 is a schematic diagram of the structure of a risk event control device according to an embodiment of the present invention. The device shown in the figure includes:

[0083] The information comparison module 10 is used to obtain the user's operation information, compare the operation information with the historical operation information in the middle station database, and determine whether the user's operation meets the preset release conditions.

[0084] The operation information input by the user can be obtained through the front-end application software, and the operation information includes login information and transaction information. The collected operation information input by the user is compared with the historical operation information stored in the middle-end database, and the consistency between the operation information and the historical operation information is used to determine whether the user's operation meets the preset release conditions.

[0085] Specifically, the user's operation can be scored based on the consistency between the operation information and the historical operation information. For example, whether the login GPS address in the login information exists in the historical login information of the user, if it does, what is the proportion of the login GPS address, and the proportion value can be used as the score of the user's login operation. By comparing the score of the user's login operation with the preset threshold, it is determined whether the user's login operation falls within the preset threshold range. If it falls within the preset threshold range, it is determined that the user's login operation meets the preset release conditions, and the login operation can be released. Among them, if it does not fall within the preset threshold range, it is determined that the user's login operation does not meet the preset release conditions, and the login operation is suspended or blocked.

[0086] Furthermore, the score of the user operation behavior can also be obtained by scoring the transaction information in the operation information, for example, by comparing the transaction amount in the transaction information with the transaction amount in the user's historical transaction information. Specifically, the transaction amount can be subtracted from the average of the historical transaction amounts, and the absolute value of the difference is used as the score of the transaction operation.

[0087] In addition, monitoring of risk events includes but is not limited to: business transaction volume (transaction volume monitoring), transaction amount (large amount anomalies, etc.), risk event pre-interception volume (flow monitoring), risk event interception amount, risk event in-process blocking volume, risk event in-process blocking amount, anti-phishing monitoring (phishing website monitoring), brute force disassembly monitoring (login flow monitoring), overseas high-risk IP addresses, etc.

[0088] The tag adding module 20 is used to block the user operation corresponding to the operation information and add a review tag to the operation information if the preset release condition is not met.

[0089] When a user operation does not meet the preset release conditions and is blocked or suspended, an audit tag is added to the operation information. Audit tags include manual audit tags and intelligent audit tags.

[0090] The information audit module 30 is used to send the operation information with the audit tag added to the middle platform database, and the middle platform database is used to audit the operation information according to the audit tag and return the audit result.

[0091] Among them, after the operation information with the audit tag is sent to the middle-office database, the middle-office database will audit the operation information. Specifically, the middle-office database will verify the information by initiating an outbound call to the user based on the manual audit tag. Furthermore, the outbound call can be automatically made through the outbound call platform without the need for business personnel, so as to avoid the problem that risk events cannot be handled in a timely and effective manner due to no one on duty at special times and holidays.

[0092] The visualization display module 40 is used to process the user operation corresponding to the operation information according to the audit result, and send the processed result and the audit result to the front end via the middle end database for visualization display.

[0093] Among them, the user operation is processed according to the audit result returned by the middle-end database. Specifically, if the audit result is passed, the blocked or suspended operation is released; if the audit result is not passed, the user operation is judged as a risk event and blocked. The processed result is sent to the middle-end database, and the middle-end database sends the audit result and processing result to the front-end for visual display.

[0094] Furthermore, users can customize the data and format of the visual display, and enter operation instructions through the front-end to maintain the data in the middle-end database.

[0095] As an embodiment of the present invention, the operation information includes login information and transaction information, wherein the login information includes an IMEI code, a login IP address and a login GPS address, and the transaction information includes a transaction amount, a transaction time and a number of transactions.

[0096] In this embodiment, if Figure 4 As shown, the information comparison module 10 includes:

[0097] A scoring unit, used to compare the login information or transaction information with the historical login information or historical transaction information in the middle office database, and score the user operation corresponding to the login information or transaction information;

[0098] The determination unit is used to determine whether the scoring result exceeds a preset threshold. If it exceeds the preset threshold, it is determined that the user's operation does not meet the preset release conditions. If it does not exceed the preset threshold, it is determined that the user's operation meets the preset release conditions.

[0099] In this embodiment, the scoring unit is also used to traverse the historical login information in the middle station database, determine whether the IMEI code, login IP address and login GPS address in the login information exist in the historical login information, and score the user operation corresponding to the login information according to the judgment result.

[0100] In this embodiment, the scoring unit is also used to compare the transaction amount, transaction time and number of transactions in the transaction information with the historical transaction information in the middle office database, to determine whether the transaction amount, transaction time and number of transactions are consistent with the historical transaction information, and to score the user operation corresponding to the transaction information according to the judgment result.

[0101] As an embodiment of the present invention, the review label includes a manual review label and an intelligent review label.

[0102] In this embodiment, the information review module is also used to send the operation information with manual review tags added to the middle platform database. The middle platform database is used to perform manual outbound review of the operation information according to the manual review tags and return the manual review results.

[0103] In this embodiment, the information review module is also used to send the operation information with the smart review tag added to the middle platform database. The middle platform database is used to perform verification code review on the operation information according to the smart review tag and return the smart review result.

[0104] Based on the same application concept as the above-mentioned risk event control method, the present invention also provides the above-mentioned risk event control device. Since the principle of solving the problem by the risk event control device is similar to that of the risk event control method, the implementation of the risk event control device can refer to the implementation of the risk event control method, and the repeated parts will not be repeated.

[0105] The present invention conducts risk situation judgment through the linkage between background risk monitoring and processing and the middle-end database, and combines it with visual display to realize automatic processing of risk events, ensuring round-the-clock work, eliminating the problem of unmanned duty at special times and holidays, greatly saving manpower review costs, and reducing risk processing time.

[0106] like Figure 5 FIG. 1 is a schematic diagram of the structure of a risk event control system according to an embodiment of the present invention. The system shown in the figure includes: a backend monitoring engine 100, a middle-end database 200, and a front-end display module 300. The schematic diagram of the workflow of the risk event control system of the present invention is as follows: Figure 6 shown.

[0107] The backend monitoring engine obtains the user's operation information, compares the operation information with the historical operation information in the middle-end database, and determines whether the user's operation meets the preset release conditions; if it does not meet the preset release conditions, the user operation corresponding to the operation information is blocked, and an audit tag is added to the operation information, and the operation information with the audit tag is sent to the middle-end database;

[0108] The operation information input by the user can be obtained through the front-end application software connected to the background monitoring engine, and the operation information includes login information and transaction information. The background monitoring engine compares the collected operation information input by the user with the historical operation information stored in the middle-end database, and determines whether the user's operation meets the preset release conditions based on the consistency between the operation information and the historical operation information.

[0109] Specifically, the background monitoring engine can score the user's operation based on the consistency between the operation information and the historical operation information. For example, whether the login GPS address in the login information exists in the historical login information of the user, if it does, what is the proportion of the login GPS address, and the proportion value can be used as the score of the user's login operation. By comparing the score of the user's login operation with the preset threshold, it is determined whether the user's login operation falls within the preset threshold range. If it falls within the preset threshold range, it is determined that the user's login operation meets the preset release conditions, and the login operation can be released. Among them, if it does not fall within the preset threshold range, it is determined that the user's login operation does not meet the preset release conditions, and the login operation is suspended or blocked.

[0110] Furthermore, the score of the user operation behavior can also be obtained by scoring the transaction information in the operation information, for example, by comparing the transaction amount in the transaction information with the transaction amount in the user's historical transaction information. Specifically, the transaction amount can be subtracted from the average of the historical transaction amounts, and the absolute value of the difference is used as the score of the transaction operation.

[0111] When a user operation does not meet the preset release conditions and is blocked or suspended, the background monitoring engine adds an audit tag to the operation information. Audit tags include manual audit tags and intelligent audit tags.

[0112] In addition, monitoring of risk events includes but is not limited to: business transaction volume (transaction volume monitoring), transaction amount (large amount anomalies, etc.), risk event pre-interception volume (flow monitoring), risk event interception amount, risk event in-process blocking volume, risk event in-process blocking amount, anti-phishing monitoring (phishing website monitoring), brute force disassembly monitoring (login flow monitoring), overseas high-risk IP addresses, etc.

[0113] The middle-end database audits the operation information according to the audit tag, and sends the audit result to the back-end monitoring engine and the front-end display module;

[0114] Among them, the backend monitoring engine sends the operation information with the audit tag to the middle-office database, which then audits the operation information. Specifically, the middle-office database verifies the information by initiating an outbound call to the user based on the manual audit tag. Furthermore, the outbound call can be automatically made through the outbound call platform without the need for business personnel, thus avoiding the problem that risk events cannot be handled promptly and effectively due to unattended work at special times and holidays.

[0115] The background monitoring engine processes the user operation corresponding to the operation information according to the audit result, and sends the processing result to the front-end display module.

[0116] Among them, the background monitoring engine processes the user operation according to the audit result returned by the middle-end database. Specifically, if the audit result is passed, the blocked or suspended operation will be released; if the audit result is not passed, the user operation will be judged as a risk event and blocked.

[0117] The front-end display module visualizes the audit results and processing results, wherein the front-end display module includes chart components such as Echarts.

[0118] Among them, from the current chart development, since different risks involve multiple channels, and different channels require different modules to display, each module needs to encapsulate its own interface, and finally it is necessary to combine the interfaces of different modules to obtain the data required by the chart. Since the chart components are relatively large, the implementation cost and integration cost are relatively high during the development of each module, making it difficult to achieve rapid development and deployment. In order to improve development efficiency, save R&D costs, and deploy quickly, it is necessary to develop lightweight chart components for unified calling.

[0119] In this embodiment, the user can customize the data and form of visual display in the front-end display module, and input operation instructions through the front-end display module to perform data maintenance on the data in the middle-end database. Specifically, the user can select a suitable display method for the data in the front-end display module, customize the layout, set relevant data acquisition rules, etc., make the relevant risk form dynamic, and display it visually in the front-end display module. The user can perform certain interactive clicks in the front-end display module to facilitate the user to view relevant data and analyze data, and can also freely choose to close the display of certain data. If there are relevant errors in the data, the user can enter the middle-end through the front-end display module to perform manual data maintenance to ensure the accuracy of the data.

[0120] Furthermore, by integrating packaged chart components, chart configuration is simplified, which allows quick start and improves chart configuration efficiency. The chart style, layout, and data refresh time can all be customized, supporting multiple charts on a single page to meet most usage requirements.

[0121] As an embodiment of the present invention, the operation information includes login information and transaction information, wherein the login information includes an IMEI code, a login IP address and a login GPS address, and the transaction information includes a transaction amount, a transaction time and a number of transactions.

[0122] In this embodiment, the background monitoring engine is also used for:

[0123] Compare the login information or transaction information with the historical login information or historical transaction information in the middle office database, and score the user operations corresponding to the login information or transaction information;

[0124] Determine whether the scoring result exceeds the preset threshold. If it exceeds the preset threshold, it is determined that the user's operation does not meet the preset release conditions. If it does not exceed the preset threshold, it is determined that the user's operation meets the preset release conditions.

[0125] In this embodiment, the background monitoring engine is also used to traverse the historical login information in the middle platform database, determine whether the IMEI code, login IP address and login GPS address in the login information exist in the historical login information, and score the user operation corresponding to the login information according to the judgment result.

[0126] In this embodiment, the background monitoring engine is also used to compare the transaction amount, transaction time and number of transactions in the transaction information with the historical transaction information in the middle-end database, to determine whether the transaction amount, transaction time and number of transactions are consistent with the historical transaction information, and to score the user operation corresponding to the transaction information based on the judgment result.

[0127] As an embodiment of the present invention, the review label includes a manual review label and an intelligent review label.

[0128] In this embodiment, the middle-station database is also used to receive operation information with manual review tags added, perform manual outbound review on the operation information according to the manual review tags, and return the manual review results.

[0129] In this embodiment, the middle-end database is also used to receive operation information with smart audit tags added, perform verification code audit on the operation information according to the smart audit tags, and return the smart audit results.

[0130] As an embodiment of the present invention, the front-end display module is also used to visually display the audit results and processing results according to preset display rules.

[0131] As an embodiment of the present invention, the foreground display module is also used to receive interaction instructions input by the user, and send the interaction instructions to the middle-stage database, so that the middle-stage database performs data maintenance according to the interaction instructions.

[0132] The present invention simplifies the configuration of charts by integrating and packaging chart components, which can be quickly used and improve the efficiency of chart configuration; and the chart style, layout, and data refresh time can be customized, supporting multiple charts on a single page, meeting most usage requirements. Through the linkage between the middle and back ends, the big data algorithm is used to judge the risk situation, automatically handle risk events, and work 24 hours a day, 7 days a week, without the problem of unmanned duty at special times and holidays, which greatly saves the cost of human audit and reduces the time of risk processing.

[0133] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the program.

[0134] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above method.

[0135] like Figure 7 As shown, the electronic device 600 may further include: a communication module 6110, an input unit 6120, an audio processing unit 6130, a display 6160, and a power supply 6170. It is worth noting that the electronic device 600 does not necessarily have to include Figure 7 In addition, the electronic device 600 may also include Figure 7 For components not shown, reference may be made to the prior art.

[0136] like Figure 7 As shown, the central processor 6100 is sometimes also referred to as a controller or an operation control, and may include a microprocessor or other processor device and / or logic device. The central processor 6100 receives inputs and controls the operations of various components of the electronic device 600.

[0137] The memory 6140 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices. The above-mentioned information related to the failure may be stored, and a program for executing the relevant information may also be stored. The CPU 6100 may execute the program stored in the memory 6140 to implement information storage or processing.

[0138] The input unit 6120 provides input to the central processing unit 6100. The input unit 6120 is, for example, a key or a touch input device. The power supply 6170 is used to provide power to the electronic device 600. The display 6160 is used to display display objects such as images and texts. The display may be, for example, an LCD display, but is not limited thereto.

[0139] The memory 6140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that saves information even when the power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROMs, etc. The memory 6140 may also be some other type of device. The memory 6140 includes a buffer memory 6141 (sometimes referred to as a buffer). The memory 6140 may include an application / function storage unit 6142, which is used to store application programs and function programs or processes for executing the operation of the electronic device 600 through the central processor 6100.

[0140] The memory 6140 may also include a data storage unit 6143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 6144 of the memory 6140 may include various drivers for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0141] The communication module 6110 is a transmitter / receiver 6110 that sends and receives signals via an antenna 6111. The communication module (transmitter / receiver) 6110 is coupled to the central processor 6100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0142] Based on different communication technologies, multiple communication modules 6110 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless LAN module, etc. The communication module (transmitter / receiver) 6110 is also coupled to a speaker 6131 and a microphone 6132 via an audio processor 6130 to provide an audio output via the speaker 6131 and receive an audio input from the microphone 6132, thereby realizing a common telecommunication function. The audio processor 6130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 6130 is also coupled to the central processor 6100, so that recording can be performed on the local machine through the microphone 6132, and the sound stored on the local machine can be played through the speaker 6131.

[0143] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0144] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0145] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0146] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0147] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A risk event control method, characterized in that: The method comprises: Obtain the user's operation information, compare the operation information with the historical operation information in the middle platform database, and determine whether the user's operation meets the preset release conditions; If the preset release conditions are not met, the user operation corresponding to the operation information is blocked, and an audit tag is added to the operation information; wherein the audit tag includes a manual audit tag and an intelligent audit tag; Sending the operation information with the audit tag added to the middle platform database, the middle platform database is used to audit the operation information according to the audit tag and return the audit result; Process the user operation corresponding to the operation information according to the audit result, and send the processed result and the audit result to the front-end through the middle-end database for visual display; The sending of the operation information with the audit tag to the middle platform database, the middle platform database being used to audit the operation information according to the audit tag and returning the audit result includes: sending the operation information with the manual audit tag to the middle platform database, the middle platform database being used to automatically perform a manual outbound call audit on the operation information through the outbound call platform according to the manual audit tag and returning the manual audit result; The sending of the operation information with the audit tag added to the middle platform database, the middle platform database being used to audit the operation information according to the audit tag and returning the audit result includes: sending the operation information with the smart audit tag added to the middle platform database, the middle platform database being used to automatically audit the operation information with a verification code by sending a text message or an email according to the smart audit tag and returning the smart audit result; The operation information includes login information, wherein the login information includes an IMEI code, a login IP address, and a login GPS address; The comparing the operation information with the historical operation information in the middle station database to determine whether the user's operation meets the preset release conditions includes: Compare the login information with the historical login information in the middle office database and score the user operations corresponding to the login information; Determine whether the scoring result exceeds a preset threshold. If so, determine that the user's operation does not meet the preset release conditions. If not, determine that the user's operation meets the preset release conditions. The step of comparing the login information with the historical login information in the middle office database and scoring the user operation corresponding to the login information includes: Traverse the historical login information in the middle platform database, determine whether the IMEI code, login IP address and login GPS address in the login information exist in the historical login information, and if the result of the judgment is yes, determine the proportion of the login GPS address to score the user operation corresponding to the login information.

2. The method according to claim 1, characterized in that The operation information also includes transaction information, wherein the transaction information includes transaction amount, transaction time and number of transactions.

3. The method according to claim 2, characterized in that The comparing the operation information with the historical operation information in the middle station database to determine whether the user's operation meets the preset release conditions also includes: Compare the transaction information with the historical transaction information in the middle office database and score the user operations corresponding to the transaction information; Determine whether the scoring result exceeds the preset threshold. If it exceeds the preset threshold, it is determined that the user's operation does not meet the preset release conditions. If it does not exceed the preset threshold, it is determined that the user's operation meets the preset release conditions.

4. The method according to claim 3, characterized in that Compare the transaction information with the historical transaction information in the middle office database, and score the user operations corresponding to the transaction information, including: The transaction amount, transaction time and number of transactions in the transaction information are compared with the historical transaction information in the middle office database to determine whether the transaction amount, transaction time and number of transactions are consistent with the historical transaction information, and the user operation corresponding to the transaction information is scored based on the judgment result.

5. A risk event control device, characterized in that: The device comprises: The information comparison module is used to obtain the user's operation information, compare the operation information with the historical operation information in the middle station database, and determine whether the user's operation meets the preset release conditions; A label adding module, used to block the user operation corresponding to the operation information if the preset release conditions are not met, and add an audit label to the operation information; wherein the audit label includes a manual audit label and an intelligent audit label; An information review module, used to send the operation information with the review tag added to the middle platform database, and the middle platform database is used to review the operation information according to the review tag and return the review result; A visualization display module is used to process the user operation corresponding to the operation information according to the audit result, and send the processed result and the audit result to the front desk via the middle desk database for visualization display; The information review module is further used to send the operation information with the manual review tag to the middle platform database, and the middle platform database is used to automatically perform manual outbound review on the operation information through the outbound call platform according to the manual review tag, and return the manual review result; The information review module is further used to send the operation information with the smart review tag to the middle platform database, and the middle platform database is used to automatically conduct verification code review on the operation information by sending SMS or email according to the smart review tag, and return the smart review result; The operation information includes login information, wherein the login information includes an IMEI code, a login IP address, and a login GPS address; Wherein, the information comparison module includes: The first scoring unit is used to compare the login information with the historical login information in the middle platform database and score the user operation corresponding to the login information; The first determination unit is used to determine whether the scoring result exceeds a preset threshold value. If it exceeds the preset threshold value, it is determined that the user's operation does not meet the preset release condition. If it does not exceed the preset threshold value, it is determined that the user's operation meets the preset release condition. Among them, the first scoring unit is also used to traverse the historical login information in the middle platform database, and determine whether the IMEI code, login IP address and login GPS address in the login information exist in the historical login information. If the result of the judgment is yes, the proportion of the login GPS address is determined to score the user operation corresponding to the login information.

6. The device according to claim 5, characterized in that The operation information also includes transaction information, wherein the transaction information includes transaction amount, transaction time and number of transactions.

7. The device according to claim 6, characterized in that The information comparison module also includes: The second scoring unit is used to compare the transaction information with the historical transaction information in the middle office database and score the user operation corresponding to the transaction information; The second determination unit is used to determine whether the scoring result exceeds a preset threshold. If it exceeds the preset threshold, it is determined that the user's operation does not meet the preset release conditions. If it does not exceed the preset threshold, it is determined that the user's operation meets the preset release conditions.

8. The device according to claim 7, characterized in that The second scoring unit is used to compare the transaction amount, transaction time and number of transactions in the transaction information with the historical transaction information in the middle office database, determine whether the transaction amount, transaction time and number of transactions are consistent with the historical transaction information, and score the user operation corresponding to the transaction information based on the judgment result.

9. A risk event control system, characterized in that: The system includes: a backend monitoring engine, a middle-end database and a front-end display module; The backend monitoring engine obtains the user's operation information, compares the operation information with the historical operation information in the middle-end database, and determines whether the user's operation meets the preset release conditions; if it does not meet the preset release conditions, the user operation corresponding to the operation information is blocked, and an audit tag is added to the operation information, and the operation information with the audit tag is sent to the middle-end database; wherein the audit tag includes a manual audit tag and an intelligent audit tag; The middle-end database audits the operation information according to the audit tag, and sends the audit result to the background monitoring engine and the front-end display module; wherein the middle-end database is also used to receive the operation information with the manual audit tag added, and according to the manual audit tag, automatically conduct a manual outbound audit on the operation information through the outbound call platform, and return the manual audit result; the middle-end database is also used to receive the operation information with the smart audit tag added, and according to the smart audit tag, automatically conduct a verification code audit on the operation information by sending SMS or email, and return the smart audit result; The backend monitoring engine processes the user operation corresponding to the operation information according to the audit result, and sends the processing result to the frontend display module; The front-end display module visually displays the audit results and processing results; The operation information includes login information, wherein the login information includes an IMEI code, a login IP address, and a login GPS address; Wherein, the background monitoring engine is also used for: Compare the login information with the historical login information in the middle office database and score the user operations corresponding to the login information; Determine whether the scoring result exceeds a preset threshold. If so, determine that the user's operation does not meet the preset release conditions. If not, determine that the user's operation meets the preset release conditions. Among them, the background monitoring engine is also used to traverse the historical login information in the middle platform database, and determine whether the IMEI code, login IP address and login GPS address in the login information exist in the historical login information. If the result of the judgment is yes, the proportion of the login GPS address is determined to score the user operation corresponding to the login information.

10. The system according to claim 9, characterized in that The operation information includes transaction information, wherein the transaction information includes transaction amount, transaction time and number of transactions.

11. The system according to claim 10, characterized in that The background monitoring engine is also used for: Compare the transaction information with the historical transaction information in the middle office database and score the user operations corresponding to the transaction information; Determine whether the scoring result exceeds the preset threshold. If it exceeds the preset threshold, it is determined that the user's operation does not meet the preset release conditions. If it does not exceed the preset threshold, it is determined that the user's operation meets the preset release conditions.

12. The system according to claim 11, characterized in that The background monitoring engine is also used to compare the transaction amount, transaction time and number of transactions in the transaction information with the historical transaction information in the middle office database, determine whether the transaction amount, transaction time and number of transactions are consistent with the historical transaction information, and score the user operation corresponding to the transaction information based on the judgment result.

13. The system according to claim 9, characterized in that The front-end display module is also used to visually display the review results and processing results according to preset display rules.

14. The system according to claim 9, characterized in that The foreground display module is also used to receive interaction instructions input by the user, and send the interaction instructions to the middle platform database, so that the middle platform database performs data maintenance according to the interaction instructions.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 4 is implemented.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 4.

Images